How VPN Detection Works: Signals and Probability
VPN detection is a probabilistic science — not a definitive one. Websites and services use multiple signals to estimate whether a visitor is using a VPN or proxy. Here's how the detection engines work, and how SPEEDEXA's VPN Detection tool scores them.
The Core Signals
Every VPN detection engine combines several independent signals into a probability score. The most common signals are:
1. Datacenter ASN Detection
Every IP belongs to an Autonomous System (AS). Residential ISPs (Comcast, BT, Airtel) have different ASNs than hosting providers (AWS, DigitalOcean, Vultr). If an IP resolves to a datacenter ASN, VPN likelihood increases significantly.
Signal weight: High. Datacenter ASN alone adds ~50 points to VPN score.
2. ASN Name Keywords
If the ASN name contains words like "VPN", "PROXY", "TUNNEL", or "ANONYMOUS", that's a strong indicator. Many commercial VPN providers use ASN names that identify their purpose.
Signal weight: High. Adds 30–40 points.
3. Geolocation vs Language Mismatch
If your browser language is set to German (de-DE) but your IP geolocates to Singapore, that's suspicious. VPN users often have mismatched language/IP combinations.
Signal weight: Medium. Adds ~15 points.
4. Major Cloud Provider Hosting
If your IP belongs to Google Cloud, AWS, Cloudflare, or Microsoft Azure, it's likely a VPN exit node. These providers offer cheap VPN hosting and are heavily used by commercial VPN services.
Signal weight: Medium. Adds ~10 points.
5. Elevated Latency
VPN tunnels add latency. If your RTT is significantly higher than expected for your region, it may indicate VPN routing. A user in London with 250 ms RTT to a London server likely routes through a distant VPN node.
Signal weight: Medium. Adds ~10 points.
6. IP Reputation Databases
Commercial detection services (IPQualityScore, MaxMind, etc.) maintain databases of known VPN IPs. If your IP appears in these lists, VPN likelihood jumps.
Signal weight: Very High. Adds 40–70 points.
How SPEEDEXA Scores VPN Likelihood
SPEEDEXA's VPN Detection tool combines the signals above and applies a weighted score:
| Signal | Weight |
|---|---|
| Datacenter ASN | +50 |
| VPN/Proxy keywords in ASN | +30 |
| Geo-language mismatch | +15 |
| Major cloud provider | +10 |
| Elevated latency (>200 ms) | +10 |
The final score is clamped to 0–95%. It's a probability, not a verdict.
Score Interpretation
- 0–30%: Low likelihood. Direct connection.
- 30–60%: Medium. Possible VPN or business connection.
- 60–95%: High. VPN/proxy likely active.
Why Detection is Never 100% Certain
VPN detection has an inherent false-positive rate:
- Corporate networks sometimes route through datacenter ASNs
- Cloud-based remote work (VDI, AWS WorkSpaces) looks like a VPN
- Residential proxies don't show up in ASN databases at all
- Mobile carrier CGNAT can confuse IP geolocation
That's why SPEEDEXA reports a probability score with indicator explanations, not a binary "yes/no" answer.
Check your VPN likelihood
SPEEDEXA analyzes 5 signals to estimate VPN/proxy likelihood.
⚡ Run VPN Test on SPEEDEXAHow to Lower Your VPN Score
If you're not using a VPN but getting a high score:
- Check corporate network: Your office may route traffic through a datacenter.
- Disable browser extensions: Some proxies/VPN extensions route all traffic.
- Restart your router: You may have been assigned a recycled IP previously used by a VPN.
- Contact your ISP: If your IP is flagged as a former VPN endpoint, ask for a new one.
Frequently Asked Questions
Can VPNs bypass detection?
High-quality "residential VPNs" that use real ISP IPs (not datacenter) can evade most detection. They're expensive and slower, so most users don't use them.
Does SPEEDEXA store my IP?
No. All detection runs client-side in your browser. Your IP is sent to api.ipify.org and ipapi.co only to fetch details — nothing is stored on SPEEDEXA servers.
Is VPN detection legal?
Yes. Detecting a VPN is not illegal — it's simply traffic analysis. Using a VPN is also legal in most countries. What matters is what you do with the connection.
Summary
VPN detection is a weighted combination of 5+ signals. Datacenter ASNs, keywords, geo mismatches, cloud hosting, and latency all contribute. SPEEDEXA's tool provides a transparent, client-side analysis with full indicator breakdowns — no opaque black box.