There are both very legitimate and concerning reasons for using virtual private networks (VPNs), proxy servers, or Tor. On the one hand, people are concerned about their privacy. Just like they wouldn’t want everyone to know what their postal addresses are, some web users also make it a point to mask their IP addresses.

So, with a VPN, for example, a user who’s physically located in the U.S. can look like he or she’s coming from London. He or she simply logs in and chooses a location. A proxy, meanwhile, communicates with a server on a user’s behalf. He or she connects to a proxy server, which would then forward the connection onto the site. Using a local proxy server means connecting to a local router that would then make the onward connection to the Web.

Finally, Tor bounces user traffic around to mask its actual origin. It is a software that provides anonymity. Tor users do not want anyone to know where they are or which services they are using. Their data is cleaned out of identifying information and encrypted before it is relayed to another node. When each layer is decrypted, it is relayed again to make it extremely difficult to identify where it came from.

Not all users using VPN, proxy, and Tor connections have good intentions, however. Those on the receiving end—typically advertisers, marketers, website owners, and businesses in general—are beset by challenges from masked connections that lead to geo-spoofing and potential abuse. At worst, masked connections can pose threats to corporate networks and become a component to a series of cyber attacks.

VPNs, Proxies, and Tor: A Bane to Network Owners

As mentioned earlier, not all VPN, proxy, and Tor users can be trusted. Some may just be hiding behind legitimate IP addresses to get into target networks owned by large companies, government institutions, media providers, financial service providers, and anyone who may be keeping proprietary and confidential information.

That said, organizations may need the help of a VPN detection API in instances when:

• Some VPN, proxy, and Tor users might use the services to bypass content access restrictions enabled by digital rights management (DRM) strategies and systems to access or stream content not intended for them. The API can spot masked IP addresses so content providers can check if they are legitimate subscribers based on their locations.

• A small percentage of VPN, proxy, and Tor users may use stolen identities on payment portals and processing systems for transactions. Transactions made with masked IP addresses may not have been instigated by real account owners.

• Potentially dangerous users may try to bypass networks’ built-in protections via IP spoofing. A VPN detection API can automatically flag masked IP addresses for further screening with regard to legitimacy.

• Freemium abusers may spoof IP addresses so registration portals that track subscribers via their IP addresses can’t catch them. Configuring the API to automatically block signups from masked IP addresses can keep potential abusers out of one’s network.

VPN Detection API at Work

A VPN detection API can automatically identify VPN, proxy, and Tor users. For instance, with an API you could see the following results for different IP addresses:

• 202[.]142[.]151[.]190 is a proxy server’s IP address (i.e., the mention “proxy = true”) as detected by a VPN detection API
• 91[.]218[.]203[.]59 is a Tor exit node’s IP address (i.e., the mention “tor = true”) as detected by a VPN detection API
• An IP address that isn’t masked by any of the three aforementioned technologies would show the result below (i.e., the mention “proxy, vpn, and tor = false”)

---

Checking if an IP address is masked using a VPN detection API can be beneficial to businesses in a variety of situations. For instance, it can help organizations reinforce their DRM strategies, prevent fraud, filter traffic, and stop freemium abuse.

About the Author

IPIFY is a simple public IP address data provider. Learn more about us on https://www.ipify.org/.