Detecting VPNs and proxies at scale

Most traffic is perfectly legitimate, and plenty of people use a VPN for entirely good reasons. But when you are fighting fraud, knowing that a connection is hidden behind a proxy or anonymising service is a valuable signal. Here is how we think about detecting it.

No single signal is enough

The biggest mistake in proxy detection is relying on one clue. Any individual indicator can be wrong, so we combine many weaker signals into a confidence score rather than a simple yes or no. That keeps false positives low while still catching the traffic that matters.

Signals worth watching

Several characteristics, taken together, paint a reliable picture of how a connection is reaching you:

• Network ownership. Addresses belonging to hosting providers and data centres behave very differently from home broadband.
• Known ranges. Many commercial VPN and proxy services operate from identifiable address ranges.
• Routing behaviour. The path a connection takes can hint at relays sitting in the middle.
• Reputation history. Addresses with a track record of abuse deserve closer scrutiny.

Score, do not just label

We surface a clear risk level alongside the underlying details, so you can decide how strict to be for your use case. A bank might treat a medium score very differently from a media site applying regional licensing. You stay in control of the policy.

Keep the data fresh

The infrastructure behind proxies and VPNs changes constantly, so detection only stays accurate if the data behind it is continually refreshed. That is an ongoing investment, and it is exactly the kind of work an API should handle for you so your own team does not have to.

Putting it to work

With SpocIPData, every lookup can return security signals alongside location and network data, so you can build smarter sign-up, login and checkout flows without bolting on a separate service.