How do websites detect a VPN or proxy?
Nothing in your connection announces that it passes through a VPN or a proxy. Sites instead compare signals: the address's owner and history, whether the resolver, WebRTC address and time zone agree with it, and packet timing. Each signal is weak on its own, but together they produce a risk estimate the service acts on.
This is a general explanation for people who want to know why a service flagged them. It is not a guide to getting around any particular system.
Why services care
There are usually three reasons: account and payment fraud, content licences tied to a country, and bots that create accounts or scrape data. The second is covered in What is geo-blocking.
Detection does not always mean a block. The outcome may be normal access, an extra check such as a code sent by text message, limits on certain actions, or a refusal.
The signals and what they measure
| Signal | What it measures | When it gets it wrong |
|---|---|---|
| Network type (ASN) | Whether the address belongs to a home or mobile provider, or to a data center or hosting company | Corporate and university networks, and legitimate servers run by users |
| Lists of known addresses | Whether the address is recorded as an exit for a VPN service, an open proxy or the Tor network | Stale lists, and addresses that have passed to a new owner |
| Reputation | The address's history: spam, attacks, or large numbers of accounts | Shared addresses, where everyone pays for one user's behaviour |
| Request headers | Headers some proxies add that name the original address or reveal a relay | Rarely; when present they are an explicit signal |
| DNS resolver | Whether the resolver that looked up the site sits in the address's country and network | People using a public resolver far from their country |
| WebRTC | Whether the browser reveals a public address other than the one the request came from | Networks with more than one exit |
| Time zone and language | Whether the device settings fit the address's country | Travellers and expatriates, of whom there are many |
| Latency | Whether round-trip time fits the distance to the claimed location | Slow or congested networks |
Who owns the address
Every routed address on the internet is announced by an Autonomous System. RFC 1930 defines one as a group of IP prefixes run by one or more operators with a single routing policy. The AS number tells you the owner: a home broadband provider, a mobile operator, or a hosting company.
Ordinary users rarely browse from hosting networks, so this is the strongest and cheapest signal. See What is an ASN.
Mobile networks, by contrast, usually put many subscribers behind one public address using carrier-grade NAT. RFC 6598 reserves an address range for linking subscribers to such NAT devices.
Blocking a mobile address means blocking many real subscribers, so services are more careful before they do it. More in What is CGNAT and IP reputation.
What the request itself reveals
Some proxies add headers that tell the site they exist, such as Via, X-Forwarded-For, or the standard Forwarded header defined in RFC 7239. They exist to tell a server the client's real address when a request passes through an intermediary.
A proxy that adds them is announcing itself. You can see what your browser sends with the HTTP headers tool.
Even without those headers, a mismatch can show up lower down. The first TCP packets carry traits that differ between operating systems. If the browser says it runs on a phone while its packets carry the traits of a server operating system, something sits in between.
The resolver: who asked for the site?
- The page includes a link to a unique random subdomain, such as
a7f3k.test.example.com, that nobody has looked up before. - Your browser tries to load it, so your device asks its configured resolver.
- The query ends up at the site's authoritative DNS server, which sees the address of the resolver that asked.
- The site compares that resolver with your connection's address. A resolver in one country and an exit in another is an obvious mismatch.
Some resolvers also pass part of the user's own address to the authoritative server, under the extension in RFC 7871. That can expose part of your real address. This is what is called a DNS leak.
WebRTC: an address from another path
WebRTC lets the browser make direct voice and video connections. To learn its public address it sends requests to STUN servers, and those requests may not go through the proxy. If they leave over your normal connection, the site learns a second address.
RFC 8828 describes four modes for which addresses a browser reveals. The fourth requires media to be proxied whenever HTTP traffic is. See WebRTC leaks.
Time zone and language
Any page can read your device's time zone with one line of JavaScript. Your preferred languages arrive with every request in the Accept-Language header, defined in section 12.5.4 of RFC 9110. The same document warns that such negotiation headers make it easier for a server to single out an individual.
Still, this is a weak signal: a Syrian living in Germany who uses Arabic and Berlin time is entirely normal.
Latency and distance
Light in optical fibre travels at about two thirds of its speed in a vacuum, roughly 200,000 km per second. Every 100 km of fibre path therefore adds about one millisecond to the round trip, a floor no network can beat.
A site can measure timing twice. The first measurement comes from the TCP handshake and covers the path to whatever opened the connection, which is the proxy.
The second happens inside the page, with a message your browser answers, and covers the whole path to your device. A large gap between the two points to a relay far from the user.
How to see what a site sees
- The My IP tool shows your address, AS number and country: the first signal as the databases see it.
- The DNS leak test shows which resolvers ask on your behalf, and their countries.
- The WebRTC leak test shows the addresses your browser exposes.
- If you use a proxy, the proxy checker shows its exit address, response time and how well it hides the original address.
If a service flags you by mistake
- Check your connection first. A leak exposes your real address or country, and fixing it protects your privacy before anything else.
- Read the service's terms. Some services forbid VPNs and proxies outright, in which case your normal connection is the right way in.
- Do not share your account or open it from several places at once. That raises a risk score more than any network signal.
- Contact support if you are asked for a check you cannot complete. Explaining your situation, such as living abroad, resolves many cases.
syriaproxy addresses from this angle
syriaproxy addresses are mobile addresses on the Syriatel network (AS48065), shared by many subscribers behind the operator's NAT, not data center addresses. Names are resolved inside Syria by Syriatel's resolvers, IPv6 is blocked in the tunnel, and the extension keeps WebRTC from revealing your address. A service may still tell you use a tunnel, since latency, device settings and account details stay as they are.
FAQ
Can a website know for certain that I use a VPN?
Sometimes, for example when the address is listed as a known exit of a VPN service. In many cases it remains a probability the service estimates from several signals, not a certainty.
Why was I flagged as a VPN user when I am not using one?
Perhaps your address is shared with other users, as on mobile and corporate networks. A previous user may have abused it, or a database may have misclassified your network.
Does a private browsing window hide these signals?
No. Private browsing discards history and cookies when the window closes, but it does not change your address, your resolver or your time zone.
Open the free network tools and compare their results with the signals described here.