Websites detect VPN and proxy connections primarily by checking whether your IP address belongs to a known commercial VPN provider, data center, or hosting company rather than a residential ISP. You can check whether your connection is currently being flagged as a VPN on whatsmy.fyi.
Method 1: ASN-Based Detection
Every IP address block on the internet is registered to an organisation via an Autonomous System Number (ASN). These registrations are public. Commercial VPN providers (NordVPN, ExpressVPN, Mullvad, ProtonVPN, etc.) own IP blocks registered in their company name. When your IP belongs to one of these ASNs, you are immediately identifiable as a VPN user.
whatsmy.fyi uses a curated list of known VPN ASNs to detect this. If your ASN matches a known VPN provider, the VPN / Proxy Detection card shows "VPN detected".
Method 2: Data Center vs. Residential IP Detection
Most residential ISPs (Comcast, BT, Vodafone, etc.) have IP blocks that are clearly tagged in public databases as "residential". VPN servers typically run in data centers — AWS, Google Cloud, Azure, OVH, Hetzner, Vultr — whose IP ranges are also publicly known.
IP reputation databases (MaxMind, IPinfo, IPHub, etc.) classify IP addresses as residential, data center, or hosting. A data center IP is a strong signal of a VPN or proxy, even if the specific VPN provider is not identified.
Method 3: IP Reputation Databases
Specialised IP intelligence services maintain constantly updated databases of IP addresses associated with:
- Commercial VPN providers
- Tor exit nodes
- Known proxy services
- Anonymizing services
- IP addresses with a history of spam, fraud, or abuse
Services like MaxMind GeoIP2, IPQS (IP Quality Score), and Spur maintain these databases. Websites integrate them to block or restrict VPN traffic.
Method 4: DNS Leak Detection
When using a VPN, your DNS queries should go through the VPN's DNS servers. If your device instead uses your home ISP's DNS servers, there is a "DNS leak". Advanced detection systems compare the geographic location of your IP address with the location of the DNS servers resolving your queries. A mismatch is a strong signal of VPN use.
Method 5: Timezone and Language Mismatches
Your browser sends timezone and language preferences that typically reflect your physical location. If your IP address geolocates to Germany but your browser is configured for en-US with America/New_York timezone, sophisticated fraud detection systems can flag this inconsistency.
What Happens When a VPN Is Detected?
Different services react differently to detected VPN connections:
- Streaming services (Netflix, Disney+): Block the connection and display an error asking you to disable your VPN.
- Financial services: May trigger additional verification steps or temporary account locks for fraud prevention.
- Cloudflare bot protection: May show a CAPTCHA challenge.
- Most regular websites: Take no action — VPN detection is not a priority for most sites.
Can You Avoid VPN Detection?
Residential VPN providers assign IP addresses from residential ISP pools, making them much harder to detect. However, these services are more expensive and harder to operate. Some high-end VPN providers rotate residential IPs specifically to bypass detection.
No method is foolproof. The more techniques a detection system combines (ASN + IP reputation + DNS + browser fingerprint), the harder it is to avoid detection entirely.
Frequently Asked Questions
Is using a VPN illegal?
In most countries, using a VPN is completely legal. However, a small number of countries (China, Russia, Iran, North Korea) restrict or ban VPN use. Using a VPN to commit illegal activities is illegal regardless of the VPN.
Why does my VPN still show as a direct connection on whatsmy.fyi?
whatsmy.fyi checks against a list of known VPN ASNs. If your VPN provider operates its own IP ranges that have not been added to our list yet, it will show as a direct connection. This does not mean your VPN is not working — it means whatsmy.fyi has not yet identified that provider's ASN as a VPN.
Does a VPN hide my WebRTC IP?
Only if the VPN client specifically blocks WebRTC. See our full guide on WebRTC leaks for details.
