← All guides

How to detect VPN and proxy users at signup

VPN detection is genuinely hard, and most implementations quietly fail. The common approach — check whether the IP belongs to a hosting provider's ASN — misses the majority of consumer VPN traffic, because the large consumer VPNs rent capacity from ordinary hosting companies rather than running their own networks.

  1. 1

    Know why the obvious method fails

    ASN lookups tell you an address belongs to a hosting company. That catches servers, and it catches VPN operators who own their own network. It misses NordVPN, Surfshark, PIA and CyberGhost exits sitting on shared hosts, because the ASN belongs to the host, not the VPN. We measured this: fifteen real NordVPN exits, and three of them looked completely clean to an ASN-only check.

  2. 2

    Ask the operators instead

    Several major VPN providers publish their live server lists — the same endpoints their own apps call to pick a server. NordVPN publishes roughly 9,000 exit addresses; Mullvad publishes its relays. Reading those is exact rather than inferred, and it is public data, so there is no licence question. Providers who publish nothing still need the inferential approach.

  3. 3

    Separate the categories in your response

    "Datacenter", "commercial VPN", "public proxy" and "Tor exit" are four different facts with four different meanings. A Tor exit on a banking signup is a strong signal. A commercial VPN on a consumer app is Tuesday.

    curl "https://www.layercall.com/v1/score/ip?ip=1.2.3.4" \
  -H "X-Api-Key: YOUR_KEY"
  4. 4

    Fix your geolocation while you are here

    A geolocation database maps a VPN range to where the operator registered it, not where the exit physically is. That is how a user connecting through Amsterdam gets reported as Switzerland. If you make decisions on country, a VPN silently corrupts them — so prefer the operator's declared location when the exit is known.

What this gets wrong

Every check here has a cost in real customers. These are the ones that actually bite — several because we shipped them ourselves.

  • Blocking VPN users outright. This is the single most costly overreaction in fraud prevention. Privacy-conscious users, remote employees on corporate VPNs, travellers and entire regions route this way, and they are disproportionately the technical customers who pay.
  • Trusting an ASN label without verifying who holds it. We had one ASN labelled as a VPN provider that actually belonged to Wake Forest University — every student looked like a VPN user.
  • Reading a VPN's registered country as the user's location. It is frequently a different continent.
  • Counting datacenter plus VPN plus proxy as three separate penalties. They are usually one fact about one connection; adding them up manufactures risk that is not there.

Try it before you integrate

Paste any IP, email, phone or domain into the playground — no signup. Or get a free API key for 1,000 lookups a month, no card.