Proxy, VPN, and TOR Detection: What the Signals Really Mean

Most filtering rules eventually reduce to a question about the network a visitor is on. But “proxy” is not one thing, and the various detections that get bundled under that label carry wildly different weight. Treating them as interchangeable is how filtering rules end up blocking remote workers.

The taxonomy that matters

Five categories behave differently enough that your rules should distinguish them.

• Datacenter proxies. Traffic exiting a hosting provider. Cheap, fast, and easy to identify from the address range alone. Almost no consumer has a legitimate reason to browse a retail site from a server rack.
• Commercial VPNs. Consumer privacy services. Identifiable because the operators run known infrastructure, but the users are overwhelmingly ordinary people with an entirely reasonable motive.
• Residential proxies. Exits through consumer broadband connections. Difficult to detect and dangerous to block, because a real household is behind the address.
• Mobile proxies. Exits through carrier networks. The hardest of all, because carrier-grade NAT means an address may legitimately represent thousands of subscribers.
• TOR exit nodes. Publicly enumerated and trivially identifiable. Volume is low; motives are mixed.

ASN and reverse DNS

The autonomous system number is the most durable piece of context attached to an address. Ranges are allocated to organisations, and the organisation type tells you a great deal: a consumer ISP, a hosting company, a mobile carrier, or a business known for anonymity services.

Reverse DNS adds texture. Consumer ISPs typically assign descriptive hostnames encoding region and connection type. Hosting providers use generic machine-oriented naming. Missing reverse DNS is mildly notable in itself.

Both are stable over months rather than minutes, which makes them far more dependable than any single-request observation—but they only classify infrastructure. They say nothing about the person using it.

Consistency checks

The strongest evidence that an address is not where the visitor is comes from contradictions between things that ought to agree.

• Timezone against geography. The browser reports the operating system timezone. An IP in one continent paired with a system clock configured for another is a meaningful mismatch.
• Language against geography. Weaker on its own—plenty of people run an English-language OS anywhere in the world—but it contributes.
• Latency against distance. Physics sets a floor on round-trip time. A connection claiming to originate nearby while exhibiting round-trip times consistent with an intercontinental path is routing through somewhere else.

Each of these has innocent explanations. Travellers exist. Expatriates exist. Corporate laptops carry the wrong timezone for weeks. Which is exactly why these belong in a score rather than a rule.

WebRTC and connection leakage

WebRTC can expose local network details that differ from the apparent public address, which historically made it a reliable way to unmask VPN users. Browsers have progressively restricted this, extensions block it, and mobile support is inconsistent.

Treat it as opportunistic. When the signal appears and contradicts the public address, it is strong. Its absence means nothing at all, and building a rule that requires it will fail against precisely the privacy-aware population most likely to suppress it.

What each signal is actually worth

Signal	Reliability	Innocent explanation
Datacenter ASN	Very high	Rare for consumer traffic; some corporate egress
Known VPN operator	High for classification	Very common and entirely legitimate
TOR exit node	Very high	Privacy, journalism, censorship circumvention
Timezone mismatch	Medium	Travel, misconfigured devices
Latency inconsistency	Medium	Congestion, satellite, poor routing
Missing reverse DNS	Low	Common on many legitimate networks
WebRTC disagreement	High when present	Absent for most privacy-tool users

Score, then decide by context

The recurring mistake is turning a classification into a verdict. “Uses a VPN” is a fact about a connection, not a statement about intent.

Let context set the response. On a paid ad landing page, datacenter traffic can be refused outright with almost no downside—you are declining to pay for a visit that was never a person. On a checkout page, the same refusal aimed at commercial VPN traffic will cost real orders from customers who simply care about privacy. Same signal, opposite correct answer, because the cost of being wrong is completely different.