What Is IP Reputation? Proxy and VPN Detection Explained

What is IP reputation?

IP reputation is an assessment of how trustworthy an IP address is, based on who operates it, what kind of network it belongs to, which public and private lists it appears on, and how it has behaved in the past. Services turn those signals into an IP reputation score or a set of labels such as “VPN”, “proxy”, “Tor” or “hosting”. Websites use the result to decide whether to let a visit through, ask for an extra check, or block it. It is the main way websites detect a VPN or proxy.

An IP reputation describes an address, not a person. Many people can share one address, and one person can move through many, which is why the check is useful and also why it sometimes flags honest users.

How an IP reputation score is built

When a request reaches your server, you see the connecting IP address. A reputation check looks that address up against data collected in advance: registry and routing data, lists of known VPN, proxy and Tor endpoints, abuse reports, and the history of what the address has done on other sites. Most providers return two kinds of output:

• Categories: yes or no answers such as “is a VPN”, “is a Tor exit”, “is hosting”, plus the network owner and a likely country.
• A risk score: a number that weighs those signals together with recent abuse. Every vendor scales and weights it differently, so a score of 75 from one service means nothing next to a 75 from another.

Categories are easier to act on and to explain to a user. Either way, the data is only as fresh as its last update: VPN providers add servers daily and home addresses get reassigned.

The signals behind proxy and VPN detection

ASN and hosting ranges

Every block of public addresses is routed by an autonomous system (AS), a group of networks under one routing policy, as RFC 1930 defines it. Each AS has a number (ASN) and a known owner. If the owner is a cloud or server hosting company, the visit almost certainly comes from a server, a VPN endpoint, or a remote browser rather than a person on a phone or a home connection. This is the cheapest and most reliable signal. Its limit is that some legitimate traffic also leaves from hosting space, such as a company that routes staff through a cloud security gateway.

Known VPN exit lists

Detection services connect through commercial VPN apps and record the addresses they exit from. The ASN check already catches VPNs on rented servers; the list adds the ones inside ordinary ISP networks. Providers rotate servers constantly, so a list is always a little behind.

The Tor exit list

Tor is the easiest case because the Tor Project publishes the data itself. Its bulk exit list is a plain list of exit relay addresses, and it held about 1,200 addresses when we downloaded it on October 22, 2026. Downloading the whole list lets you check visitors locally, so you never send their addresses to anyone. The Tor Project’s page on how to block or restrict Tor users also asks operators to consider application-level limits first, such as restricting posting to registered users, and notes that hundreds of thousands of people use Tor every day for ordinary privacy.

Open proxy scans

Some machines accept proxy connections from anyone, because they were set up badly or taken over by malware. Scanners find and list them. A fresh hit is a strong signal; once the machine is fixed or the address is reassigned, the listing is wrong.

Abuse reports and blocklists

Mail servers, firewalls and websites report addresses that send spam, attack logins or commit fraud. Recent reports from many sources carry weight. One old report on a dynamic home address mostly tells you about its previous user.

Geolocation mismatch

The IP address gives a likely location. Other parts of the visit give their own hints: the browser time zone and language, the account’s country, the phone number prefix, the payout method. A device set to one country’s time zone while the IP says another is a classic VPN sign. It is also what every traveler looks like, so treat a mismatch as a reason to look closer, not a verdict. IP geolocation itself is an estimate: network operators can publish where their ranges are in the geofeed format of RFC 8805, but databases still lag and make mistakes, especially at city level.

Residential proxy indicators

Residential proxies route traffic through real home and mobile devices, so the address passes the ASN check. Detection relies on patterns instead: one home address serving many unrelated accounts, an address seen only for minutes, or connection traits that do not fit the claimed device. What is a residential proxy? explains how these networks work and why they are hard to catch.

How websites detect a VPN beyond the IP address

Sites often combine IP reputation with signals from the device and the session:

• DNS resolver location. If the resolver a device uses sits in a different country from the connecting IP, the traffic may be tunneled.
• Network timing. A connection that claims to be local but has the delay of a long trip can point to a relay in between.
• Device consistency. The same device showing up from several countries in one day, or many accounts on one device. Device fingerprinting covers how devices are recognized and the privacy limits of doing it.
• Behavior. Speed, repetition and account patterns, covered in Ad fraud and bot traffic.

None of these is reliable alone. Together with the IP data, they turn “this address is odd” into “this visit is very likely not what it claims”.

Why honest users get flagged

Most wrong blocks come from shared addresses. RFC 6269, Issues with IP Address Sharing, warned in 2011 that when large numbers of people share one address, blocking that address to stop abuse also hits every innocent user behind it, and that geolocation places them wherever the shared gateway appears to be.

iCloud Private Relay deserves its own rule

Apple’s guide to preparing your network or server for iCloud Private Relay says the relay replaces the user’s IP address with one from Apple’s range, that one relay address may be shared by several users in the same area, and that the address still represents the user’s coarse location and region. Apple suggests that IP-based fraud checks may need adjusting so legitimate users are not affected, for example by treating these addresses like large carrier-grade NAT or enterprise addresses. Apple publishes the current relay ranges as a CSV of egress ranges in the RFC 8805 layout (prefix, country, region, city); it listed more than 285,000 ranges when we downloaded it. Private Relay covers Safari browsing, DNS queries and insecure HTTP app traffic, per Apple. Checked on October 22, 2026.

Private Relay keeps the user in the right region, so it is not location spoofing the way a VPN is, but many reputation services label it as a privacy proxy. Decide your rule on purpose instead of inheriting a vendor default.

How to handle a flagged user

Match the action to what is at stake. Reading a blog post from a VPN is harmless; claiming a reward an advertiser pays only for real users in one country is not.

1. Set rules per action. Browsing, signing up, earning and cashing out can each have their own rule.
2. Prefer friction over bans for weak signals. A recent abuse report on a mobile address is a reason for a challenge or a manual review, not for closing an account.
3. Say what was detected, in plain words. “We detected a VPN or proxy connection” tells honest users what to check without revealing how the check works.
4. Give steps to fix it. Turn off the VPN app and any always-on VPN setting, disable proxy extensions, pause the VPN inside security apps, switch between Wi-Fi and mobile data, or restart the router for a new address.
5. Offer an appeal. A contact link that carries the user ID and the time of the block speeds up review. Re-check the address then, because reputation changes.
6. Protect what was already earned. A connection check should stop new activity, not wipe a balance. Reverse rewards only when the underlying result is reversed or proven invalid.
7. Log the decision. Keep the label, time and action so you can answer appeals and measure false positives.

Privacy considerations

An IP address is personal data in many places. Recital 30 of the EU General Data Protection Regulation names internet protocol addresses among the online identifiers that can be used to profile and identify people. Fraud checks on IP addresses are common, but they come with duties:

• Collect only what you need, for as long as you need it. Keep detailed logs long enough for reversals and appeals, then delete or truncate them.
• Check locally where you can. Public lists such as the Tor exit list can be downloaded and matched on your own server, so the address never leaves it.
• Name the processing in your privacy policy. If you send addresses to an outside reputation service, say so and say why.
• Keep a human in the loop for serious outcomes. Closing an account or withholding money should never rest on an automated IP label alone.

This is general information, not legal advice.

Why IP reputation matters for rewards sites and offerwalls

Advertisers pay only for real people in the countries they target. A rewards site user on a VPN who appears to be in a higher-paying country reaches offers they do not qualify for, the advertiser reverses the result, and you lose both the reward you paid and the payout. That is why most offer partners prohibit proxy traffic, as our traffic quality rules do, and why incentivized traffic is held to a strict standard.

IP reputation is one layer among several. Stop multi-accounting and VPN abuse shows how to combine it with sign-up checks, device signals, account linking and cashout holds, and How Sharklio checks traffic quality describes the layers we run on our side.

Frequently asked questions