How a Website Decides You Are Using a VPN (2026)

“They detected my VPN” is usually described as a single event. It is not. A site scores a connection across several independent signals, each with its own cost and reliability, and acts when the total crosses a threshold. Understanding the order they are checked in explains why some connections sail through and others meet a challenge page immediately.

Signal one: the address range itself

The cheapest check by a wide margin, and the one that catches most traffic. Every address belongs to an autonomous system, and it is public knowledge which systems are hosting providers rather than consumer ISPs. A request from a datacenter range is not proof of a VPN — it could be a server, a scraper or a corporate proxy — but it is a strong prior, and it costs a single lookup.

Commercial feeds go further and label individual ranges as belonging to known VPN operators. This is why a brand new server is anonymous for a while and a long-lived one is not: the feed catches up. It is also why address reputation, described in IP reputation and captchas, follows the range rather than you.

Signal two: internal contradictions

The address claims one place; the rest of the request claims another. Each mismatch is weak alone and damning in combination:

• Time zone. The browser reports the operating system's zone, which follows your real settings rather than your exit — see the timezone leak.
• Language headers. A German address sending Accept-Language for another locale is common and unremarkable on its own; combined with anything else it adds weight.
• Resolver location. If queries arrive from a resolver on a different continent from the connection, the two do not belong together. That is the same escape described in DNS leaks.
• Address family. An IPv4 connection alongside an IPv6 request from your real network is one of the loudest possible contradictions — see IPv6 leaks.

Signal three: how the connection is made

Before any content is exchanged, the TLS handshake exposes cipher order, extensions and version support. That combination is characteristic of the library that built it, and a fingerprint that says one client while the request headers say another is inconsistent in a way ordinary browsing never is. The mechanics are in TLS fingerprinting.

Timing is a quieter member of the same family. Round-trip time is bounded by distance, so a connection whose address claims one continent while its latency matches another is arithmetically impossible. Few services do this, because it costs measurement rather than a lookup.

Signal four: who else uses that address

Shared exits mean many users behind one address. From the service's side that looks like an unusual number of distinct accounts, devices and sessions from a single household — a pattern that has nothing to do with cryptography and everything to do with arithmetic. Account history reinforces it: an account that has connected from the same city for two years and appears from another country today is scored differently from a new one.

What each signal costs to change

• Address category: changed by using a different kind of exit. This is the one real lever, and it is why residential and mobile addresses are priced the way they are — see proxy types compared.
• Contradictions: genuinely fixable. Stop the leaks, and align time zone and locale with the exit you use. Free, and most people never do it.
• Handshake fingerprint: a property of your client software, not a setting. Choosing a well-maintained client matters more than any option inside it.
• Shared-address arithmetic: not fixable on a shared exit by definition. A dedicated address removes it and removes the anonymity that came from the crowd.

The honest summary: a service that wants to know whether you are on a VPN can find out. What you control is whether you hand it a second, independent reason to think so — and that part is worth doing regardless, because those same contradictions are what identifies you to everyone else. Check yours with the leak test.

FAQ