How to Detect VPN, Proxy and Tor Signups Without Blocking Real Users
How IP intelligence identifies VPNs, proxies, Tor exits and data-center traffic, and how to use those signals without turning away legitimate customers.
7 min read
Fraudsters hide their real location and spread activity across many addresses using VPNs, proxies, Tor and cloud servers. Detecting that traffic at signup is one of the strongest fraud signals you can get, but it needs care: plenty of honest people use VPNs every day.
The different kinds of anonymizing traffic
- Tor exit nodes: the public exits of the Tor network. Tor offers strong anonymity, and real customers rarely use it to sign up for business software.
- Open and anonymous proxies: servers that relay traffic, often compromised machines. A strong risk signal.
- Commercial VPNs: consumer privacy services. Very common among legitimate users, especially on public Wi-Fi or at work.
- Data-center (hosting) IPs: addresses belonging to cloud and hosting providers. Real people rarely browse from them, but bots and automation often do.
How detection works
IP intelligence services combine several sources: published lists (the Tor network publishes its exit nodes), observed behavior across many sites, and ownership data showing which network (ASN) an address belongs to and whether that network is a hosting provider, a VPN company or a residential ISP.
The result for each IP is a set of flags (VPN, proxy, Tor, hosting), the network owner, an approximate location, and usually a risk estimate.
Don't just block every VPN
A blanket VPN block will turn away privacy-minded customers, remote workers and travelers. A better approach:
- Block Tor and anonymous proxies on high-value actions such as free trials, payouts and promo codes.
- Review VPN and data-center traffic instead of blocking it, or require an extra step such as phone verification.
- Combine signals. A VPN alone is weak evidence. A VPN plus a disposable email plus a phone number from a different country than the IP is strong evidence. Checking them together catches far more fraud with fewer false positives.
Location mismatches
Comparing the IP's country with other details is a cheap, effective check. If someone's phone number is from one country and they're connecting from another, that's worth a closer look, especially combined with an anonymizer. It's also worth limiting signups to the countries you actually serve, sending the rest to review.
How VerifyGrid does it
VerifyGrid's IP intelligence returns country, region, city, network owner and ASN for any IPv4 or IPv6 address, with is_vpn, is_proxy, is_tor and is_hosting flags and a 0–100 risk score. Private and reserved ranges are recognized without a lookup.
The signup check runs the IP alongside the email and phone, adds points when the phone and IP countries differ, and returns one allow, review or block decision from your own rules, including an allowed-countries rule.
Look up any address with the free IP lookup.