Seatext library / BotRefund evidence
Proxy vs VPN Detection: How They Differ and What It Means for Ad Fraud
Proxies operate at the application layer and often leak identifying headers, making them easier to spot through HTTP fingerprinting and WebRTC leaks. VPNs encrypt all traffic at the network layer, so detection relies on...
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Proxies and VPNs both hide a user's real IP address, but they leave different forensic footprints. A proxy typically handles only HTTP or SOCKS traffic for a specific application, which means browser-level signals like WebRTC, DNS routing, and HTTP headers can reveal inconsistencies between the proxy IP and the actual device. A VPN creates an encrypted tunnel for all network traffic, so those application-layer leaks are largely eliminated; instead, detection shifts to network-level indicators such as known VPN IP ranges, TCP/IP stack anomalies, latency patterns, and behavioral analysis of the session.
| Criterion | Proxy Detection | VPN Detection |
|---|---|---|
| Primary detection layer | Application layer (HTTP headers, WebRTC, DNS) | Network layer (IP reputation, TCP/IP fingerprint, timing) |
| Typical leak vectors | WebRTC IP leak, DNS tunnel leak, HTTP header mismatches, Accept-Language vs IP geo mismatch | Known VPN IP ranges, data center ASN patterns, MTU/TTL anomalies, latency inconsistency |
| Evasion difficulty | Harder to fully hide; requires browser-level spoofing of WebRTC, timezone, language, and headers | Easier to mask at application layer; residential VPNs and obfuscated protocols blur the line |
| False positive risk | Corporate proxies, CDN edges, and legitimate forward proxies can trigger alerts | Corporate VPNs, privacy-focused users, and residential VPN exit nodes increase false positives |
| Best detection signals | WebRTC Network Leak, DNS Routing Mismatch, HTTP User-Agent Mismatch, Languages Mismatch | IP Address Inconsistency, OS/TCP TTL Mismatch, Latency Mismatch, Suspicious Ports, Netprobe Telemetry Missing |
| Takeaway | Check browser-network consistency; a single mismatched header often reveals a proxy | Correlate IP reputation with behavioral patterns; no single network signal is definitive |
How Proxy Detection Works
Proxies forward requests on behalf of a client, but they often fail to strip or rewrite every identifying signal. BotRefund's detection engine checks 106 browser, network, hardware, and behavior signals together rather than scoring any single signal in isolation. For proxies, the most revealing signals live at the application layer.
WebRTC Network Leak is a classic example. Even when a browser routes HTTP traffic through a proxy, WebRTC's STUN requests can bypass the proxy and expose the real local and public IP addresses. The detection compares the WebRTC-discovered IP against the proxy IP; a mismatch flags the session.
DNS Tunnel Leak and DNS Routing Mismatch check whether DNS queries and web traffic follow the same network path. A proxy may handle HTTP but let DNS resolve locally, creating a route discrepancy.
HTTP Header Mismatches — User-Agent, Accept-Language, and protocol version — often betray a proxy. The proxy may forward a generic header while the browser sends something different, or the proxy's own headers (Via, X-Forwarded-For) reveal its presence.
Timezone and Language Evasion signals (Timezone Evasion, UTC Timezone Bias, Languages Mismatch, Accept-Language Mismatch) verify that the claimed location matches the browser's locale settings. A proxy in Germany serving a browser set to US English and Pacific Time is a red flag.
How VPN Detection Works
VPNs encrypt all traffic at the OS network stack, so application-layer leaks like WebRTC and DNS are largely contained inside the tunnel. Detection therefore shifts to network-level and behavioral indicators.
IP Address Inconsistency and IP Reputation are the starting points. Known VPN exit IPs — especially data center ranges — are cataloged. Residential VPNs and proxy botnets (malware on consumer devices that routes traffic through home IPs) make this less reliable alone.
OS / TCP TTL Mismatch examines the Time-To-Live value in IP packets. Different operating systems set different initial TTLs (Linux 64, Windows 128). A VPN may preserve the original TTL, but some implementations normalize it, creating a mismatch with the claimed OS.
Latency Mismatch measures round-trip time between the client and server against the expected latency for the claimed geo-location. A VPN adds hop distance; a user "in New York" with 80ms latency to a New York server suggests a distant exit node.
Suspicious Ports and Netprobe Telemetry Missing check for open ports typical of VPN servers (OpenVPN 1194, WireGuard 51820) and whether active network probes return expected telemetry. Their absence or presence adds weight to the VPN hypothesis.
Why the Difference Matters for Ad Fraud
Click fraud operations use both proxies and VPNs to mask bot traffic. Understanding the detection gap helps advertisers choose the right defense.
Server-side log analysis (IP, headers, User-Agent) catches basic proxy traffic but misses sophisticated botnets that rotate residential proxies. As BotRefund's documentation notes, server-side audits "struggle to detect advanced botnets" because the IP looks like a legitimate residential connection.
Client-side behavioral audits — running in the browser — capture the WebRTC, DNS, timezone, and fingerprint signals that expose proxies. For VPNs, client-side scripts can measure latency, canvas fingerprint, and input behavior (mouse tremor, click speed) that remain visible even inside an encrypted tunnel.
BotRefund's approach combines both: network signals (VPN Detection, IP reputation) with 106 client-side signals to reach a combined classification. The system does not rely on any single signal; "signals become a decision only when they are seen together."
Practical Detection Signals Compared
| Signal | Proxy Relevance | VPN Relevance | Notes |
|---|---|---|---|
| WebRTC Network Leak | High — often bypasses proxy | Low — usually contained in tunnel | Primary proxy giveaway |
| DNS Tunnel Leak | High — DNS may leak outside proxy | Low — DNS routed through VPN | Check DNS vs HTTP path alignment |
| HTTP Header Mismatch | High — proxy adds/strips headers | Low — headers pass through unchanged | Via, X-Forwarded-For, User-Agent |
| IP Reputation / Known Ranges | Medium — data center proxies listed | High — VPN exit IPs cataloged | Residential IPs reduce reliability |
| TCP TTL / OS Fingerprint | Low — proxy doesn't alter TTL | Medium — VPN may normalize TTL | Compare claimed OS vs packet TTL |
| Latency vs Geo | Medium — proxy adds some latency | High — VPN adds measurable hop | Requires baseline expectations |
| Behavioral (mouse, click, scroll) | High — works regardless of network | High — works regardless of network | BotRefund: pointer behavior, speed, path |
Residential Proxies and VPNs: The Blurry Line
Modern fraud increasingly uses residential proxy networks — malware-infected home devices or peer-to-peer VPNs (like Hola) that route traffic through real consumer IPs. These defeat pure IP-reputation checks because the IP belongs to a legitimate ISP and residential subnet.
BotRefund's source pack highlights this: "Residential Proxy Botnets: Malware on regular household computers and phones redirects clicks through normal consumer IP addresses, hiding bot activity within legitimate regional traffic." Click farms using real smartphones similarly bypass IP-range filters.
Detection must then rely on behavioral and browser-fingerprint signals that are independent of IP origin: automation properties (CDP Debugger Leak, Native Patching, Engine Mismatch), input behavior (superhuman speed, grid-aligned movement, absence of tremor), and session patterns (unnatural durations, no scrolling).
Decision Framework: Choosing a Detection Approach
- Start with client-side instrumentation. Server logs alone cannot see WebRTC, canvas fingerprint, or mouse behavior. Deploy a lightweight script that collects the 106 signals BotRefund uses.
- Correlate network and browser layers. A session with a residential IP but data-center TTL, WebRTC leak, and linear mouse movement is almost certainly automated.
- Weight signals by context. Corporate VPN users are legitimate; flag them only when combined with behavioral anomalies (instant form submit, no scroll, superhuman clicks).
- Preserve evidence for refunds. Capture click IDs (GCLID, FBCLID) linked to behavioral proof. BotRefund generates "compliance-ready refund reports" for Google and Meta disputes.
- Filter in real time. Delayed analysis lets poisoned conversion data train bidding algorithms. Real-time pixel protection stops invalid sessions from triggering conversion events.
Limitations and When This Advice Doesn't Apply
- Corporate environments: Legitimate enterprise proxies and VPNs will trigger network signals. Always combine with behavioral verification before blocking.
- Privacy tools: Tor, multi-hop VPNs, and hardened browsers (Mullvad, Brave) intentionally mask fingerprints. Detection confidence drops; treat as "unknown" rather than "bot."
- Mobile apps: WebView and in-app browsers may not expose WebRTC or allow script injection. App-specific SDKs are needed.
- Encrypted Client Hello (ECH) and DNS-over-HTTPS: Emerging standards hide SNI and DNS, reducing visibility into routing mismatches.
- Single-signal decisions: Never block based on one indicator (e.g., VPN IP alone). BotRefund's model requires the full pattern.
Key Facts from BotRefund's Detection Model
| Category | Signals | What It Checks |
|---|---|---|
| Network, VPN & Geolocation | 15 signals (01-15) | WebRTC leak, DNS routing, timezone/language consistency, latency, IP coherence, TCP TTL, HTTP headers |
| Evasion, Debugger & Anti-Stealth | 6 signals (16-21) | CDP debugger, native patching, engine mismatch, rebrowser leaks, JS engine mismatch, automation properties |
| Behavioral (Pointer, Motion, Speed, Path, Engagement, Session) | Multiple | Linear mouse, tremor absence, superhuman speed, grid-aligned paths, no scroll/clicks, unnatural durations |
| Refund Outcomes | — | 83% refund success rate for high-volume advertisers; recovery back to 2017 Google Ads spend |
Frequently Asked Questions
Can a proxy be detected without client-side code?
Partially. Server-side checks catch header leaks (Via, X-Forwarded-For) and known proxy IPs, but miss WebRTC, DNS leaks, and browser fingerprint mismatches. Advanced residential proxies evade server-only detection entirely.
Does a VPN hide me from all detection?
No. A VPN hides your IP and encrypts traffic, but browser fingerprint (canvas, WebGL, fonts), behavioral patterns (mouse, typing, scroll), and network timing (latency, TTL) remain observable. Residential VPNs reduce IP-reputation signals but not behavioral ones.
What's the hardest proxy type to detect?
Residential rotating proxies with proper header rewriting, WebRTC blocking, and DNS-over-HTTPS. They mimic real users at the network layer. Only behavioral analysis (mouse tremor, click timing, session flow) reliably catches them.
How does BotRefund use these signals for refunds?
The platform captures Google Click IDs (GCLID) and Facebook Click IDs (FBCLID) alongside behavioral evidence of invalidity (bot-like input, no engagement, automation traces). It packages this into platform-compliant dispute reports that Google and Meta accept for billing refunds.
Should I block all VPN traffic?
Not recommended. Many legitimate users (privacy advocates, corporate remote workers, travelers) use VPNs. Blocking by VPN IP alone creates false positives. Instead, score VPN traffic higher and require behavioral verification before allowing conversions.
What's the difference between a proxy and a VPN for a fraudster?
Proxies are cheaper and easier to rotate at scale (thousands of residential IPs via botnet). VPNs provide encryption and stability but are harder to scale for high-volume click fraud. Sophisticated operations use both: VPN for infrastructure, residential proxies for the click layer.
How often do detection signatures update?
Continuously. New VPN protocols (WireGuard, Shadowsocks), proxy obfuscation methods, and browser automation frameworks (Puppeteer Stealth, Playwright) require ongoing signal updates. BotRefund's AI evaluates the full 106-signal pattern rather than relying on static signatures.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.