What a website actually sees

When you open a page, the server learns exactly one network fact for certain: the IP address the connection came from. Everything else about “where you are” and “what kind of network you’re on” is derived from that address or inferred from the rest of the request.

From the address, a site looks up:

  • Who owns it. Every public address belongs to a network with an AS number (ASN) and a registered name: a home ISP, a mobile carrier, AWS, a hosting company.
  • Where it probably is. IP geolocation is a commercial database guess. For home lines it’s usually the right country and often a nearby city; for VPN exits it’s wherever the provider says the server is.
  • Its reputation. Lists of VPN exits, Tor exits, open proxies and addresses seen in abuse.

Beyond the address, the request itself carries hints: the User-Agent and language headers, the browser’s timezone (readable by any script on the page), how the TLS handshake looks, and, if you’re behind certain proxies, headers like Via or X-Forwarded-For that announce the proxy outright.

How VPN and proxy detection works

No single trick does it. Detection services stack several weak signals.

The network the address belongs to

This is the cheap and effective one. Ordinary people browse from ISPs and mobile carriers, not from AWS, DigitalOcean or Hetzner. Most commercial VPNs and proxies rent servers in data centers, so their exit addresses belong to hosting ASNs. “This address is in a data center” alone catches most of them, along with scrapers and bots running in the cloud.

It’s also why corporate traffic gets caught: cloud security gateways and VPN concentrators exit from data-center ranges too.

Known exit lists

Some lists are public. The Tor Project publishes the current list of Tor exit addresses, and Apple publishes the egress ranges for iCloud Private Relay so sites can recognise it instead of blocking it.

Commercial IP intelligence providers build their own lists, broadly by connecting through VPN services and recording the exit addresses they get, and by scanning for open proxies. Their coverage of the big consumer VPNs is good. Their coverage of small and self-hosted VPNs is not, and their answers disagree with each other more often than their marketing suggests.

Leaks that reveal the real address

A VPN or proxy hides your address only for the traffic that actually goes through it.

WebRTC. Video calls in the browser use WebRTC, which asks a STUN server “what address do you see me as?” over UDP. With a full-tunnel VPN that UDP goes through the tunnel and reveals nothing new. With a browser-extension proxy, which only carries the browser’s HTTP and HTTPS requests, the UDP can go straight out of your normal connection and report your real public address to any page that asks. Current browsers by default no longer expose your local LAN address this way (they substitute a random .local name), but the public address is a separate matter.

DNS. If your system keeps using the ISP’s DNS resolver while web traffic goes through the VPN, every site you look up is still announced to your ISP. “DNS leak” tests work by making your browser resolve a unique, random hostname under a domain the tester controls, then checking which resolver came to ask. If it’s your ISP’s resolver, your DNS is outside the tunnel.

IPv6. Some VPNs only tunnel IPv4. If your line has IPv6, connections to dual-stack sites can go out over IPv6, directly, with your real address.

Inconsistencies

Weaker signals that get combined with the above:

  • Timezone versus location. The browser says Asia/Seoul, the IP geolocates to Frankfurt.
  • Latency. The round trip to the client is far longer than the claimed location explains, because the packets detour through a tunnel.
  • Connection fingerprints. Tunnels lower the packet size (MTU), which can show up in TCP handshake values, and a TCP/IP or TLS fingerprint that doesn’t match the User-Agent’s operating system is suspicious.
  • Volume. Hundreds of accounts or sign-ups from one address in an hour.

What detection mostly misses

Residential proxies. Some proxy networks route traffic through real home connections, through apps and SDKs installed on people’s devices or through rented home lines. The exit address belongs to a normal ISP, geolocates to a normal city and has a clean history. IP-based detection has very little to go on.

Your own VPN at home. A WireGuard server on your home router, used from a café, exits from your home ISP. To the site it’s indistinguishable from you sitting at home.

And the reverse problem: CGNAT and mobile carriers put many real users behind one public address. Block one and you block a neighbourhood. That’s why sensible services rarely block mobile carrier ranges outright, even when abuse comes from them.

What DechoNet’s IP check shows, and what it can’t

The IP check reads everything from the connection your browser makes to our edge. No script runs in your browser to collect anything.

It shows:

  • The address of this connection, IPv4 or IPv6, whichever your browser used. Only that one; if you have both, the other isn’t shown.
  • ASN, network name and an estimated location (country, city), taken from Cloudflare’s metadata for the connection, plus the TLS version, HTTP protocol and your User-Agent.
  • Type: Cloud if the ASN is on a short list of large clouds (Amazon, Google, Microsoft, Cloudflare and a few others) or the network name matches one; Hosting for well-known hosting companies (DigitalOcean, Linode, Vultr, OVH, Hetzner and similar) or a name containing words like “hosting” or “data center”; VPN only when the network’s registered name contains one of a handful of VPN brands (Mullvad, NordVPN, ExpressVPN, Surfshark, CyberGhost, Private Internet Access). Everything else is ISP.
  • Proxy: Yes when Cloudflare’s measured TCP round-trip time to your connection is over 500 ms. Nothing else.

Be clear about what that means. Most VPN providers don’t run their own named network; they rent servers from hosting companies, so their exits show as Hosting or Cloud, not VPN, and any provider not in that short list shows as whatever network it rents from. A VPN or proxy on a residential line shows as ISP. Cloudflare WARP and Private Relay exits run by Cloudflare show as Cloud.

The Proxy field is a latency hint, not detection. A VPN server in your own country adds a few milliseconds and won’t trip it. A SOCKS or HTTP proxy usually won’t either, because the TCP connection Cloudflare measures starts at the proxy, not at you. What does trip it: a far-away VPN exit, a satellite link with long round trips, a congested mobile connection.

It’s useful for one question: what do sites see when I connect, and which network does my traffic leave from? It is not an IP reputation service, and it can’t check an arbitrary address. That’s what the next section is for.

Checking an IP from your logs

For an address that isn’t yours, look it up in layers.

Who owns it. The ASN lookup accepts an IP and shows the network, its holder and the prefixes it announces. From a terminal, Team Cymru’s whois service gives the same mapping in one line:

$ whois -h whois.cymru.com " -v 8.8.8.8"
AS      | IP               | BGP Prefix          | CC | Registry | Allocated  | AS Name
15169   | 8.8.8.8          | 8.8.8.0/24          | US | arin     | 2023-12-28 | GOOGLE - Google LLC, US

A home ISP or mobile carrier means “probably a person”. A cloud or hosting provider means a server, a VPN, a proxy or a corporate gateway.

Its reverse DNS name. The reverse DNS lookup, or dig -x 203.0.113.10 +short. Cloud names like ec2-…compute.amazonaws.com, or a hosting company’s generic name, confirm what the ASN suggested. ISPs often name customer lines with patterns that include words like “dyn”, “pool” or “dsl”. Many addresses have no PTR at all, which proves nothing.

Tor. Check the address against the Tor Project’s exit list.

Reputation. If you need a VPN/proxy score, use a commercial IP intelligence API, and ideally two. Treat the output as a probability.

Before blaming the client, make sure the address in your logs is really the client’s. If every request seems to come from one or two addresses, you’re probably logging your own load balancer or CDN. In nginx behind a trusted proxy:

set_real_ip_from 10.0.0.0/8;          # your load balancer's range
real_ip_header X-Forwarded-For;
real_ip_recursive on;

Only trust X-Forwarded-For from proxies you run. Anyone can send that header, and believing it from the open internet lets clients choose their own IP.

If you’re being flagged

If a site treats you as a VPN or proxy and you don’t think you are one, open the IP check and look at the network name.

  • A VPN brand, hosting company or cloud: something is routing your traffic. Check for a VPN app, an antivirus “secure browsing” or “safe web” feature, a browser extension, iCloud Private Relay (Settings → your name → iCloud → Private Relay), Cloudflare WARP, or your browser’s proxy setting. On a work laptop, it’s likely a corporate gateway, and only IT can change that.
  • Your normal ISP or mobile carrier: the site is using a reputation score or other signals. CGNAT and mobile addresses are shared, so the score may reflect other users. Switching networks (Wi-Fi to mobile data or back) usually gives you a different address; otherwise contact the site.

If you run the site

Some opinions, from the operator side:

  • Don’t hard-block on IP type alone. Data-center addresses include corporate users, Private Relay users and people protecting their privacy. Use the signal to add friction proportional to risk (a CAPTCHA, a second factor, a manual review) rather than a blanket 403.
  • Block on behaviour where you can. Ten sign-ups a minute from one address is a stronger signal than “this address is in a data center”.
  • Expect residential proxies to get through. If IP reputation is your only defence against account abuse, the abusers with budget will already be past it.
  • Check what you’re deciding on. The HTTP check shows how your site responds to a request from outside your network, which helps confirm that a block or challenge fires where you think it does.

For the other common question about addresses (why a home or mobile IP changes on its own), see why your IP address keeps changing.

Check your own domain now

Free, no sign-up. Runs the exact check this guide describes and shows what to fix.