How websites detect proxies and VPNs

There is no single "is this a VPN?" test. Sites and anti-fraud vendors combine many independent signals into a risk judgement — often a fraud score — and the more signals agree, the more confident the block. Understanding the stack matters because it explains why swapping your IP alone often is not enough: you may fix one layer while three others still shout "proxy". The signals fall into three groups: what the IP reveals, what leaks reveal, and what your client software reveals.

Below is what each group actually checks, roughly in the order a detection system applies it.

The first and cheapest checks are on the address. ASN: every IP belongs to an autonomous system, and if that ASN is a known hosting or cloud provider, the IP is flagged as datacenter — the single strongest proxy/VPN signal. IP reputation and block-lists: commercial databases (the kind behind IPQS, MaxMind, Spamhaus-style feeds) label millions of addresses as known proxy or VPN exits, so a lookup instantly classifies you. Open ports: a site can probe your IP for open proxy ports (1080, 3128, 8080) — a running proxy answers. GeoIP mismatch: if your IP says one country but your browser timezone and language say another, that inconsistency is suspicious. Shared-use velocity: many accounts or huge request volume from one IP marks it as a proxy hub.

This is why cheap free proxies fail instantly — they are already in every block-list — and why a clean dedicated IP lasts longer.

If the IP passes, detection moves to leaks. A DNS leak that resolves through your ISP, a WebRTC candidate exposing your real address, or an IPv6 connection outside the tunnel each betrays the real you behind a proxy — see our leaks guide. Then comes the hardest layer: client fingerprinting. Your TLS fingerprint (JA3/JA4) reveals the software making the request, and a handshake that says "Python" while your User-Agent says "Chrome" is an obvious contradiction. Browser fingerprinting adds canvas, fonts and more.

The lesson is honest and useful: a proxy or VPN changes your IP layer only. s4m is transparent that its proxies are datacenter, so they clear ASN checks where a datacenter origin is acceptable and can be kept clean via a dedicated IP — but you must also close leaks and keep your client consistent. Defeating the whole stack means aligning every layer, not swapping one address.