How to detect VPN and proxy users at signup

Most account fraud starts by hiding where the user really is. Fake accounts, credential stuffing and trial abuse almost never come from a normal home connection: they come from a VPN, a commercial proxy, a Tor exit, or a cheap datacenter box. If you can tell those apart from a real residential visitor, you can stop a large share of abuse before it starts.

The signals that matter

There are a handful of network categories worth separating:

• VPN: consumer VPN providers (NordVPN, ExpressVPN, Surfshark and many more), identifiable by their ASNs and published server lists.
• Commercial proxy: rotating proxy networks (Oxylabs, BrightData and similar) that resell residential and datacenter exits.
• Tor: exit nodes from the live public Tor list.
• Datacenter / hosting: cloud and hosting ASNs. A real person almost never signs up from a server.
• Residential proxy: the hardest case, a real home line being used as an exit. Behavioural signals (a residential IP making scanner-like requests on a decoy) give it away.

What to do with the verdict

Detection is only half the job. The right response depends on the risk and the action:

Allow residential, step-up (extra verification) on VPN and datacenter, and block Tor and known-bad on your most sensitive flows.

A single 0 to 100 risk score makes this easy to encode in your own rules: pick thresholds per flow (signup, login, password reset, checkout) rather than a blanket block that frustrates legitimate privacy-conscious users.

Try it now

huntback classifies any IP in milliseconds from a local dataset with full IPv4 coverage plus the live Tor and VPN lists, and cross-references it with attacks seen on our deception network. You can try the live classifier on the Fraud page, or get a free API key and wire it into your signup flow.