TL;DR: top-tier VPN detection false positive comparison
- IP blocklists are a solved problem for lazy fraudsters and a shrug for anyone with a residential proxy. The exit IP belongs to a real household in Ohio, and every reputation check comes back clean.
- cside uses TLS handshake fingerprint to flag proxy-mediated sessions from how the browser negotiates the handshake, not from the IP, so residential proxies and Tor exit nodes surface even when MaxMind and IPinfo classify the IP as residential.
- If your response to a VPN flag is an automatic block, you will punish privacy-conscious real users. If you feed it as one signal into a composite risk score, this is the higher-fidelity input.
The best VPN detection software identifies proxy-mediated sessions using TLS handshake fingerprint TLS fingerprinting rather than relying only on IP blocklists. That difference matters because residential proxies exit through real home broadband IP addresses that no blocklist will ever flag.
VPN detection software identifies connections that are being routed through a VPN, proxy, or anonymizing network. For fraud teams, VPN use at login or checkout is a meaningful risk signal. It is the standard evasion technique for credential stuffing, account takeover, and payment fraud operations that need to mask their true origin. The detection challenge is that IP blocklists, the most common approach, miss the most sophisticated VPN configurations and all residential proxies by design.
| Tool | Detection method | Residential proxy coverage | Real-time updates | Free tier |
|---|---|---|---|---|
| cside | TLS handshake fingerprint TLS fingerprinting + browser-layer signals | Connection-layer, IP-independent | Yes | Yes, 1,000 API calls/mo |
| MaxMind GeoIP | IP address database lookup | IP-database based | Database refresh | Limited |
| IPinfo | IP address classification | IP-database based | Database refresh | Limited |
Why IP blocklists miss the most dangerous VPN connections
IP blocklists work by maintaining a database of known VPN exit node IP addresses and data center IP ranges. When a connection arrives from an IP on the blocklist, it is flagged as VPN or proxy traffic. This approach catches connections from commercial VPN services that use predictable IP ranges, such as NordVPN, ExpressVPN, and similar services whose exit nodes are well-documented.
It does not catch residential proxy networks. Residential proxy services route traffic through the IP addresses of genuine consumer internet connections, home broadband operated by real ISPs. The exit node looks like a household in Ohio or a flat in Manchester. It is not on any blocklist. It appears identical to a legitimate user's home connection in every IP-based check.
Fraudsters running account takeover campaigns specifically use residential proxies to defeat IP-based VPN detection. The IPs they exit through are not data center IPs, not known VPN ranges, and not flagged by any blocklist. IP-based detection sees them as clean residential traffic.
How cside uses TLS handshake fingerprint TLS fingerprinting
TLS handshake fingerprint TLS fingerprinting analyzes how a device negotiates a TLS connection: the cipher suites it proposes, the TLS extensions it includes, and the specific values and order of negotiation parameters. That negotiation behavior reflects how the connection is being mediated. A browser connecting directly produces a different TLS negotiation fingerprint from a browser whose traffic is routed through a proxy intermediary, even when the IP address looks residential.
cside VPN detection uses TLS handshake fingerprint TLS fingerprinting to identify proxy-mediated connections at the session layer. Because TLS handshake fingerprint analyzes the TLS handshake rather than the IP address, it detects residential proxies, Tor exit nodes, and sophisticated VPN configurations that produce residential-looking IPs. cside returns this as part of a real-time session verdict, alongside the device fingerprint and other session risk signals.
TLS handshake fingerprint is an open standard. It captures a structural characteristic of how the connection is made, one that does not depend on databases of known bad IPs and does not need continuous list updates to stay effective.
MaxMind GeoIP
MaxMind GeoIP is a widely used IP address intelligence database that provides geolocation, ISP, and connection-type data for IP addresses. It includes flags for known VPN, proxy, and hosting-provider IPs based on IP range analysis and community intelligence.
MaxMind is accurate for commercial VPN services and data center IP ranges. For residential proxies, the preferred evasion technique for sophisticated fraud operations, MaxMind sees a residential ISP IP address and classifies it accordingly. MaxMind's data quality is not the issue here. IP-based analysis structurally cannot reveal a proxy when the exit IP is genuinely residential. The IP is real. The proxy is invisible at the IP layer.
MaxMind works well as a supplementary signal. For fraud-sensitive applications, it is best paired with a connection-layer signal rather than used as the only VPN check.
IPinfo
IPinfo provides similar IP intelligence: geolocation, ASN data, carrier information, and privacy-detection flags that identify VPN and proxy IPs from known ranges. Its privacy-detection database covers commercial VPN services, hosting providers, and Tor exit nodes.
The same structural limitation applies to any IP-based approach. Residential proxies that use genuine consumer IP addresses are classified as residential, because at the IP layer that is what they are. A connection-layer signal like TLS handshake fingerprint sees the proxy regardless of how the IP resolves.
Using VPN detection as a fraud signal
VPN use at login or checkout is a risk signal, not an automatic block criterion. Many legitimate users browse through VPNs for privacy reasons. The signal is most useful in combination with other session data. A VPN connection combined with a new, unrecognized device fingerprint and an automated-session signature is a high-confidence fraud indicator. A VPN connection from a device with a long, consistent account history is much lower risk.
cside returns VPN and proxy status as part of its real-time session verdict, alongside the device fingerprint and a flag for AI-agent and automated sessions. Your application combines these signals to make a proportionate risk decision rather than applying a blanket VPN block.
