How to Detect Proxies and VPNs in Real-Time: A Step-by-Step Implementation Guide

To detect proxies and VPNs in real-time, integrate a real-time IP reputation API with client-side browser fingerprinting. The API checks the visitor's IP against continuously updated databases of known proxy, VPN, Tor, and data-center ranges. Simultaneously, client-side scripts probe for WebRTC leaks, DNS routing mismatches, timezone and language inconsistencies, and TCP/IP stack anomalies. You score each signal, combine them into a single risk score, and decide — allow, challenge, or block — before the page fully loads.

Prerequisites Before You Start

• A website or application where you can add JavaScript and make server-side API calls
• Access to a real-time proxy/VPN detection API (commercial or self-hosted)
• Basic familiarity with JavaScript async/await and your backend language
• A way to log decisions for later audit (database, SIEM, or log aggregation)

Step 1: Choose a Real-Time Detection API

Pick an API that updates its IP databases continuously — not daily or weekly. Look for coverage of residential proxies, mobile gateways, and newly spun-up VPN endpoints. The API should return a structured response with at least: is_proxy, is_vpn, is_tor, is_datacenter, proxy_type, and a confidence score. Latency must stay under 50 ms at the 95th percentile so it doesn't slow page loads.

Step 2: Add Client-Side Fingerprinting Signals

Server-side IP checks alone miss residential proxies and compromised devices. Add a lightweight client-side script that collects:

• WebRTC Network Leak: Checks whether browser network paths reveal conflicting locations
• DNS Tunnel Leak: Checks whether DNS and web traffic follow the same route
• DNS Challenge Blocked: Checks whether DNS and web traffic follow the same route
• Timezone Evasion: Checks whether location and language settings agree
• Latency Mismatch: Checks whether connection and browser request details stay consistent
• Suspicious Ports: Checks whether the visitor's network identity is coherent
• UTC Timezone Bias: Checks whether location and language settings agree
• Languages Mismatch: Checks whether location and language settings agree
• Netprobe Telemetry Missing: Checks whether the visitor's network identity is coherent
• IP Address Inconsistency: Checks whether the visitor's network identity is coherent
• OS / TCP TTL Mismatch: Checks whether the visitor's network identity is coherent
• HTTP User-Agent Mismatch: Checks whether connection and browser request details stay consistent
• Accept-Language Mismatch: Checks whether location and language settings agree
• HTTP Protocol Mismatch: Checks whether connection and browser request details stay consistent
• DNS Routing Mismatch: Checks whether DNS and web traffic follow the same route

These signals come from BotRefund's detection vectors, which evaluate 106 browser, network, hardware, and behavior signals together rather than scoring any single signal in isolation.

Step 3: Build a Scoring Engine

Don't treat any single signal as decisive. Combine the API response and client-side signals into a weighted score. Example weights:

• API confidence ≥ 90%: +40 points
• WebRTC leak detected: +25 points
• DNS routing mismatch: +20 points
• Timezone/language mismatch: +15 points
• TCP TTL anomaly: +10 points
• Multiple mismatches (3+): +20 bonus points

Set thresholds: 0–30 = allow, 31–60 = challenge (CAPTCHA, email verification), 61+ = block or log for review. Adjust weights based on your false-positive tolerance.

Step 4: Implement the Decision Point

Run the API call and client-side collection in parallel during page load. Use Promise.all() or your backend's equivalent to wait for both. Compute the score, then:

1. If allow: proceed normally
2. If challenge: inject a CAPTCHA or request a second factor before showing protected content
3. If block: return a 403 or redirect to a static explanation page

Log every decision with the IP, score, contributing signals, timestamp, and user agent for later analysis.

Step 5: Handle Edge Cases and Allowlists

Corporate VPNs, legitimate privacy users, and some ISPs will trigger signals. Maintain an allowlist of known-good CIDR ranges (office VPN egress IPs, partner networks). Let users appeal a block via a contact form that logs the appeal with their IP and score. Review appeals weekly and adjust weights or allowlists.

Step 6: Verify the Implementation

Test with a labeled dataset: known VPN IPs (commercial providers), known residential proxies, Tor exit nodes, clean residential IPs, and corporate VPNs. Send each through your pipeline and confirm the score distribution matches expectations. Aim for <2% false positives on clean traffic and >90% detection on commercial VPN/proxy test sets. Re-test monthly as providers rotate IPs.

Key Detection Signals at a Glance

Signal Category	What It Checks	Source
WebRTC Network Leak	Whether browser network paths reveal conflicting locations	S1
DNS Tunnel Leak	Whether DNS and web traffic follow the same route	S1
DNS Challenge Blocked	Whether DNS and web traffic follow the same route	S1
Timezone Evasion	Whether location and language settings agree	S1
Latency Mismatch	Whether connection and browser request details stay consistent	S1
Suspicious Ports	Whether the visitor's network identity is coherent	S1
UTC Timezone Bias	Whether location and language settings agree	S1
Languages Mismatch	Whether location and language settings agree	S1
Netprobe Telemetry Missing	Whether the visitor's network identity is coherent	S1
IP Address Inconsistency	Whether the visitor's network identity is coherent	S1
OS / TCP TTL Mismatch	Whether the visitor's network identity is coherent	S1
HTTP User-Agent Mismatch	Whether connection and browser request details stay consistent	S1
Accept-Language Mismatch	Whether location and language settings agree	S1
HTTP Protocol Mismatch	Whether connection and browser request details stay consistent	S1
DNS Routing Mismatch	Whether DNS and web traffic follow the same route	S1

Comparison: Detection Approaches

Approach	Best For	Setup Effort	Detection Coverage	Main Limitation
IP Reputation API Only	Quick start, low traffic	Low	Known data-center VPNs, Tor, some proxies	Misses residential proxies, new endpoints
Client-Side Fingerprinting Only	No backend changes allowed	Medium	Browser-level leaks, automation signs	Can be spoofed; no IP context
Hybrid (API + Client-Side)	Production apps needing accuracy	Medium-High	Residential proxies, VPNs, botnets, automation	More complex; requires maintenance
Self-Hosted Database (MaxMind, IP2Location)	Data sovereignty, offline use	High	Depends on update frequency	Stale data without daily updates

Common Mistakes to Avoid

• Relying on a single IP blacklist — residential proxies rotate too fast
• Blocking all VPN traffic — breaks legitimate corporate and privacy users
• Skipping client-side signals — misses proxies on clean IPs
• Not logging decisions — prevents tuning and audit trails
• Hardcoding thresholds — traffic patterns shift; make weights configurable

Limitations

• No method catches 100% of residential proxies; they use real consumer IPs
• Sophisticated actors can spoof WebRTC, timezone, and fingerprint signals
• API latency adds to page load; cache results for repeat visitors
• Privacy regulations (GDPR, CCPA) may restrict fingerprinting — disclose and get consent where required
• Mobile apps need native SDKs; browser signals don't apply

FAQ

How often should I update my IP reputation data?

Daily at minimum. Commercial VPN and proxy providers rotate IPs hourly. Use an API that updates continuously rather than downloading static databases.

Can I detect a VPN without an API?

Partially. Client-side signals (WebRTC, DNS, timezone) can flag inconsistencies, but you won't know if the IP belongs to a known VPN provider without a reputation source.

What's the typical false-positive rate?

With a well-tuned hybrid approach, 1–3% on clean residential traffic. Corporate VPNs and privacy-focused ISPs account for most false positives — handle them with allowlists and appeals.

Does this work for mobile apps?

Not directly. Mobile apps need native network stack inspection (TCP TTL, DNS behavior) and device-level signals. Use a mobile SDK from your detection vendor.

How do I handle GDPR/CCPA compliance?

Treat fingerprint data as personal data. Disclose collection in your privacy policy, offer opt-out where required, and don't store raw fingerprints longer than necessary for fraud prevention.

What's the cost range for real-time detection?

Free tiers exist for low volume (10k–100k queries/month). Paid APIs range from $50–$500/month for mid-volume, scaling to thousands for enterprise. Self-hosted databases have upfront licensing plus update subscription costs.

Can I use this to protect ad campaigns?

Yes. Detecting proxy/VPN traffic before it triggers conversion pixels prevents pixel poisoning and saves ad spend. BotRefund uses this approach to capture click IDs with behavioral evidence for refund claims.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• Accurate Proxy and VPN Detection
• IP2Proxy Proxy VPN Detection - Check Proxy & VPN using IP Address
• Real-Time Proxy and VPN Detection | Fraud Prevention

Learn more

Visit the website for more information.