How does VPN detection work?
A website cannot directly see whether a VPN client is running on your computer. It can only infer from the source IP and public network data: whether the address belongs to a residential ISP, mobile carrier, hosting provider or proxy network; whether it appears in Tor or proxy samples; and whether DNS/WebRTC reveals a location that contradicts the egress.
So VPN detection is really egress-IP trait detection. It is not device inspection and it does not decrypt encrypted traffic.
Which signals are used?
Platforms combine signals; one signal is usually not enough. This page prefers explainable labels over an untraceable verdict.
- ASN / ISP: cloud, hosting or known proxy networks.
- Network type: hosting, residential, mobile or enterprise.
- Public flags: proxy, encrypted tunnel, Tor exit and shared egress.
- Consistency: DNS location, WebRTC candidates, time zone and language.
Why are there false positives?
A hosting IP is not automatically a VPN; enterprise links, cloud desktops, CDNs and public proxies can also sit in hosting ranges. Conversely, a residential proxy or a self-hosted node can look like an ordinary home connection.
Read the result together with DNS, WebRTC, browser environment and the target site’s actual behaviour. Do not rely on one label.
What should I do after a proxy signal?
First check whether it matches your setup: if you are intentionally using a proxy or encrypted tunnel, a hosting/proxy flag is expected. If you are not, inspect DNS, IPv6, browser extensions and the upstream network.
If you are evaluating an IP for sign-up or payment, continue with IP reputation and IP purity.
Frequently asked questions
Can every VPN be detected?
No. Detection depends on public IP data and network traits. Residential proxies, self-hosted nodes and unlisted egress may not trigger a signal.
Why is a hosting IP flagged as a proxy?
Hosting and cloud ranges are often used for proxies, crawlers and automation, so platforms treat them as risk signals. That does not prove a VPN is in use.
Does VPN detection see my real IP?
It reads the egress IP used to reach this site. If WebRTC exposes additional addresses, a separate WebRTC check can reveal them.
How do DNS and VPN detection relate?
When the DNS egress and public egress disagree, that adds another inconsistency signal. Use the DNS leak test and WebRTC test together.
Check DNS and WebRTC next
The egress IP is only one dimension. If DNS or WebRTC contradicts it, platforms see more inconsistency.