VPN detection is genuinely hard, and most implementations quietly fail. The common approach — check whether the IP belongs to a hosting provider's ASN — misses the majority of consumer VPN traffic, because the large consumer VPNs rent capacity from ordinary hosting companies rather than running their own networks.
Know why the obvious method fails
ASN lookups tell you an address belongs to a hosting company. That catches servers, and it catches VPN operators who own their own network. It misses NordVPN, Surfshark, PIA and CyberGhost exits sitting on shared hosts, because the ASN belongs to the host, not the VPN. We measured this: fifteen real NordVPN exits, and three of them looked completely clean to an ASN-only check.
Ask the operators instead
Several major VPN providers publish their live server lists — the same endpoints their own apps call to pick a server. NordVPN publishes roughly 9,000 exit addresses; Mullvad publishes its relays. Reading those is exact rather than inferred, and it is public data, so there is no licence question. Providers who publish nothing still need the inferential approach.
Separate the categories in your response
"Datacenter", "commercial VPN", "public proxy" and "Tor exit" are four different facts with four different meanings. A Tor exit on a banking signup is a strong signal. A commercial VPN on a consumer app is Tuesday.
curl "https://www.layercall.com/v1/score/ip?ip=1.2.3.4" \
-H "X-Api-Key: YOUR_KEY"
Fix your geolocation while you are here
A geolocation database maps a VPN range to where the operator registered it, not where the exit physically is. That is how a user connecting through Amsterdam gets reported as Switzerland. If you make decisions on country, a VPN silently corrupts them — so prefer the operator's declared location when the exit is known.
What a naive version of this gets wrong
- Blocking VPN users outright. This is the single most costly overreaction in fraud prevention. Privacy-conscious users, remote employees on corporate VPNs, travellers and entire regions route this way, and they are disproportionately the technical customers who pay.
- Trusting an ASN label without verifying who holds it. We had one ASN labelled as a VPN provider that actually belonged to Wake Forest University — every student looked like a VPN user.
- Reading a VPN's registered country as the user's location. It is frequently a different continent.
- Counting datacenter plus VPN plus proxy as three separate penalties. They are usually one fact about one connection; adding them up manufactures risk that is not there.
Originally published at www.layercall.com/guides/detect-vpn-at-signup.
Top comments (0)