How modern systems detect proxies, VPNs, and Tor exit nodes, and what this means for privacy and security.
The three most common tools for masking an IP address are HTTP/SOCKS proxies, VPN tunnels, and the Tor anonymity network. Each works differently, serves different purposes, and presents different challenges for detection systems. Understanding how detection works helps both security practitioners protecting their services and privacy-conscious users understanding what they're up against.
From a service operator's perspective, proxy, VPN, and Tor usage is a significant fraud signal. The majority of automated fraud, account takeover attempts, and carding attacks originate from masked IPs. Detecting anonymisation tools isn't about punishing privacy — it's about quantifying the additional risk that comes with traffic that's deliberately obscuring its origin.
From a user's perspective, understanding detection helps set realistic expectations. A commercial VPN will not make you invisible; it shifts which IP address services see, but sophisticated detection can still identify that the connection is coming through a VPN.
Open proxies — servers that relay traffic for anyone who connects — are the oldest and simplest form of IP masking. Detection relies on multiple layers:
X-Forwarded-For or Via that reveal the proxy relationship and sometimes the original IP.Commercial VPN services present a more sophisticated challenge than open proxies, but they are still highly detectable through several mechanisms:
IP range databases are the primary tool. Major VPN providers (NordVPN, ExpressVPN, Mullvad, Private Internet Access, and dozens of others) operate finite sets of exit servers whose IP ranges are thoroughly catalogued by threat intelligence providers. A lookup against these databases identifies most commercial VPN traffic.
ASN ownership is the secondary signal. VPN providers either own their own ASNs or lease from data centre providers. Neither resembles a residential ISP, making the connection type obviously non-residential even when the specific VPN provider isn't identified.
Active probing can detect VPN endpoints by testing for open VPN protocol ports (OpenVPN typically uses UDP/1194, WireGuard uses UDP/51820, IKEv2 uses UDP/500 and UDP/4500). Servers responding on these ports are likely VPN endpoints.
WebRTC leaks are a browser-specific detection method. WebRTC (used for video chat) can expose your real local IP even when a VPN is active, because WebRTC requests can bypass the VPN tunnel. JavaScript running in the page can read this and compare it to the stated connection IP.
Traffic pattern analysis looks at connection behaviour. VPN traffic tends to involve consistent, high-throughput connections to a single IP rather than the varied pattern typical of residential browsing.
Tor is the most straightforward of the three to detect, despite being the most technically sophisticated anonymisation tool. The Tor Project publicly maintains a list of all active exit nodes at check.torproject.org/torbulkexitlist. Any IP on this list is unambiguously a Tor exit node — there are essentially no false positives. When a request arrives from a Tor exit IP, the originating user's real IP is completely unknown; all that can be said is that the connection came through Tor.
Because Tor exit nodes are public, security-sensitive services commonly block all of them preemptively. Tor's architecture means the exit node operator sees the destination but not the origin, while the origin knows the first relay but not the exit — this is why Tor provides strong anonymity but is so identifiable at the destination.
The most sophisticated anonymisation product for evading detection is the residential proxy — a real home internet connection enrolled in a proxy network. These IPs pass all ASN, connection type, and hostname checks because they genuinely are residential IPs. Detection relies on less reliable signals: known provider IP ranges (partially catalogued), traffic velocity anomalies (a single residential IP making thousands of requests per hour), and behavioural analysis.
Detection rarely means automatic blocking. Most fraud systems treat proxy/VPN/Tor status as a risk multiplier rather than a binary gate. An IP flagged as a VPN with a low fraud score and no abuse history might be allowed through with a CAPTCHA challenge. The same IP with a high fraud score and recent abuse would face a hard block. The appropriate response depends on the risk tolerance of the specific application and the other signals available.
For users with legitimate reasons to use VPNs — remote workers, journalists in restrictive countries, privacy advocates — the practical implication is that using a VPN may trigger additional verification steps on sensitive services. This is a deliberate design choice by those services, not a technical malfunction.
Need proxy detection, VPN detection, or abuse scoring in your own application?