VPN Detection

Maintains a real-time, continuously updated registry of IP addresses associated with commercial VPN services, Tor exit relays, and public proxies. Detection engines query these threat intelligence feeds to instantly flag connections. Key data points include:

• Last seen timestamp for temporal relevance
• Service provider name for categorization
• VPN protocol (WireGuard, OpenVPN) for fingerprinting

The technical process of identifying traffic routed through intermediary servers by inspecting HTTP headers (X-Forwarded-For, Via), analyzing latency patterns, and cross-referencing IP metadata against commercial proxy databases. Unlike VPN detection, which focuses on encrypted tunnels, proxy detection often targets HTTP/SOCKS proxies that may leak originating IP information in headers. Effective detection requires real-time lookups against threat intelligence feeds that categorize IPs by type: residential proxies, data center proxies, and mobile proxies.

The identification of traffic originating from cloud hosting providers (AWS, Azure, GCP) and server farms rather than residential ISPs. This is a strong heuristic indicator of automated scraping infrastructure because legitimate consumer traffic rarely originates from these ranges. Detection relies on ASN (Autonomous System Number) lookups and IP-to-ISP mapping databases. Key indicators include:

• IP ranges registered to IaaS providers
• Lack of PTR records consistent with residential ISPs
• Traffic patterns inconsistent with human browsing behavior

A scoring mechanism that evaluates the trustworthiness of an IP address based on historical behavior, threat intelligence feeds, and association with malicious activities. Reputation databases aggregate signals including:

• Spamhaus blocklist appearances
• Tor exit node status
• Known botnet C2 communication
• Frequency of CAPTCHA challenges served
• VPN/proxy database membership Low reputation scores trigger automated blocking or step-up authentication challenges before the connection reaches the application layer.

A passive identification technique that analyzes the specific parameters of a client's Transport Layer Security handshake—including cipher suites, extensions, elliptic curves, and signature algorithms—to identify the originating software or bot. JA4 fingerprinting generates a concise hash of the Client Hello packet, enabling high-fidelity identification of scraping tools regardless of destination IP. VPNs may mask the source address but often fail to normalize the TLS client behavior of the underlying tooling, creating a detectable fingerprint mismatch.

A stateless identification method that combines unique device attributes to generate a stable identifier for tracking and blocking scrapers. Key signals include:

• Canvas rendering hash
• WebGL vendor and renderer strings
• Installed fonts enumeration
• AudioContext fingerprint
• Screen resolution and color depth VPNs hide the IP address but cannot mask these client-side artifacts. Headless browsers like Puppeteer often exhibit detectable inconsistencies in these signals, enabling identification even through encrypted tunnels.