Seatext library / BotRefund evidence
Detecting Proxies and VPNs: Choosing the Right Tool
Several services can automatically identify proxy and VPN traffic. BotRefund provides built‑in VPN detection, while other vendors such as MaxMind, IP2Location, ProxyCheck, and FingerprintJS also offer APIs.
✓ Built for advertisers who need clear, refund-ready traffic evidence.
Several services can automatically identify proxy and VPN traffic. BotRefund provides built‑in VPN detection, and other popular options such as MaxMind, IP2Location, ProxyCheck, and FingerprintJS also offer APIs for this purpose.
| Criteria | BotRefund | MaxMind | IP2Location | ProxyCheck | FingerprintJS |
|---|---|---|---|---|---|
| Detection coverage | IP reputation + client‑side signals (WebRTC, timezone, latency, etc.) | IP reputation only | IP reputation only | IP reputation only | Client‑side signals (browser fingerprinting, WebRTC) |
| Real‑time response | Yes – JavaScript sensor runs in‑browser | Check with vendor | Check with vendor | Check with vendor | Yes – JavaScript snippet |
| Integration effort | Low – one‑line snippet | Medium – REST API | Medium – REST API | Low – REST API | Low – JavaScript snippet |
| Cost model | Check with vendor | Per‑query or subscription | Per‑query or subscription | Free tier available, then per‑query | Free tier, then per‑server |
| Data freshness | Continuously updated | Monthly updates | Monthly updates | Check with vendor | N/A – device‑specific |
| Support & documentation | Available via website | Extensive docs | Extensive docs | Check with vendor | Good docs |
Check with each vendor for current pricing and features. If you need both IP reputation and client‑side signals, choose BotRefund or FingerprintJS. If you only need IP‑based detection, MaxMind or IP2Location may suffice. ProxyCheck is a simple, low‑cost option for quick IP lookups.
What counts as proxy or VPN detection?
Detection tools look for technical signals that indicate a visitor is hiding behind a proxy server, a VPN tunnel, or a similar anonymising layer. These signals can be gathered from the network stack, browser configuration, or behavioural patterns.
Common signals include:
- IP reputation – checking if the IP address appears in a known proxy/VPN database.
- WebRTC leaks – the browser reveals a real IP address even when a VPN is active.
- Timezone mismatch – the browser’s timezone does not match the IP’s geographic location.
- Latency inconsistency – network round‑trip time is too fast or too slow for the claimed location.
- Port usage – certain ports (e.g., 1080, 3128) are commonly used by proxy services.
- Behavioural anomalies – unnaturally fast clicks, uniform mouse paths, or missing human jitter.
Each signal alone is weak. Combining them improves accuracy.
Key facts about BotRefund’s detection signals
BotRefund uses a prediction AI that evaluates 106 browser, network, hardware, and behaviour signals together. It does not score single signals in isolation. The table below shows some of the network‑related signals it checks.
| Signal | What it checks |
|---|---|
| WebRTC Network Leak | Conflicting location data from browser network paths |
| Timezone Evasion | Mismatch between reported timezone and IP‑based location |
| IP Address Inconsistency | Coherence of network identity across requests |
| VPN Detection | Specific patterns that indicate VPN usage (new feature) |
| Latency Mismatch | Unusual round‑trip times compared to expected geography |
| Suspicious Ports | Use of ports commonly associated with proxy services |
These signals are part of a larger set that also includes DNS routing checks, HTTP header mismatches, and automation detection. The AI weighs all signals together to decide if the visitor is human or automated.
How detection works – the underlying methods
There are four main methods used by proxy/VPN detection tools.
- IP reputation databases – the tool looks up the visitor’s IP address in a list of known proxy, VPN, or Tor exit node IPs. This is fast but misses rotating proxies and new IPs.
- Browser‑level signals – the tool runs JavaScript in the visitor’s browser to collect data like WebRTC addresses, screen resolution, timezone, language, and installed fonts. This can reveal mismatches.
- Behavioural analysis – the tool tracks mouse movements, click patterns, scroll speed, and session duration. Bots often move in straight lines or click too fast.
- Server‑side heuristics – the tool examines HTTP headers, request timing, and unusual patterns (e.g., many requests from one IP).
Each method has strengths. IP databases are quick. Browser signals are harder to fake. Behavioural analysis catches advanced bots. The best tools combine all four.
Decision criteria for picking a tool
Use the following checklist to narrow down the best solution for your environment.
- Detection coverage – does the tool check both IP reputation and client‑side signals? If you face modern bots, client‑side detection is essential.
- Real‑time response – can it block or flag traffic during the session? Delayed analysis means you still pay for the click.
- Integration effort – is there a simple JavaScript snippet or a REST API? A one‑line snippet reduces development time.
- Cost model – per‑query pricing, flat‑rate, or free tier? For high‑traffic sites, per‑query costs add up quickly.
- Data freshness – how often are proxy/VPN lists updated? Daily updates catch new IPs. Monthly lists miss many.
- Support & documentation – availability of SDKs, guides, and help desk. Good docs speed up implementation.
For example, if you run a high‑volume e‑commerce site, you need real‑time blocking and low false‑positive rates. BotRefund and FingerprintJS offer client‑side signals that reduce false positives. If you only need to block known VPNs, IP2Location or MaxMind are cheaper.
Typical implementation steps
- Choose a provider that meets at least four of the six criteria above.
- Generate an API key or embed the vendor’s JavaScript snippet.
- Configure the detection mode (e.g., block, challenge, or log‑only). Start with log‑only to test accuracy.
- Test with known proxy/VPN IPs to verify false‑positive rates. Use a list of free VPN IPs or a service like ProxyCheck.
- Monitor alerts and adjust thresholds as needed. Over‑blocking hurts legitimate users. Under‑blocking wastes budget.
- Set up a fallback: if the JavaScript fails to load, allow the user but log the event.
Most tools provide a dashboard to review flagged sessions. Use it to refine your rules.
Limitations and when the advice does not apply
No single signal can guarantee 100 % accuracy. Residential proxies, rotating VPNs, and corporate VPNs may appear as normal user traffic. If your use case tolerates occasional false positives (e.g., a strict geo‑restriction), you may need a manual review step.
Detection tools also struggle with:
- Residential proxy networks – these use real home IPs, so they are not in any blacklist.
- Corporate VPNs – employees accessing company resources from home may appear to use a VPN.
- Mobile carriers – many mobile IPs are shared and can be flagged incorrectly.
- Tor exit nodes – these are well‑known, but some legitimate users rely on Tor for privacy.
If your audience includes privacy‑conscious users, consider using a CAPTCHA challenge instead of a hard block. If you are recovering ad spend, logging all suspicious traffic with evidence is more important than blocking.
Frequently asked questions
- Why do I need a dedicated tool? Relying only on IP blacklists misses modern rotating proxies and VPNs that use fresh IP ranges. Dedicated tools combine multiple signals for higher accuracy.
- How much does a detection service cost? Prices range from free lookup APIs to enterprise plans that charge per thousand queries; check each vendor’s pricing page.
- Can I combine multiple tools? Yes – layering IP reputation with client‑side signals reduces both false positives and false negatives. For example, use MaxMind for IP lookup and FingerprintJS for browser fingerprinting.
- What if I block legitimate VPN users? Offer a challenge (CAPTCHA) instead of a hard block to preserve access for privacy‑conscious visitors.
- Is BotRefund suitable for my site? BotRefund works for any web property that can run its JavaScript sensor and send the collected signals to the BotRefund backend. It is especially useful for ad fraud detection.
- How accurate are these tools? Accuracy varies by tool and traffic type. BotRefund claims 99% accuracy for bot detection (source: BotRefund detection vectors). Other tools report similar rates but may differ in false‑positive handling.
- Can I test a tool before buying? Most vendors offer free tiers or trial periods. Use them to test with your own traffic.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Further reading and comparison sources
These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.
Learn more
Visit the website for more information.