Most of the time a site knows you are on a VPN from the address alone, before the page has even loaded. Leaks only come into it when the address isn’t already known.

The address gives it away

VPN servers are rented in data centers, and data center addresses are well catalogued. Some companies go further and sell lists that tag addresses with the name of the VPN service. MaxMind’s Anonymous IP data is one example. A site that uses such a list knows on your first request.

Shared VPN servers also collect a history. Hundreds of people use the same exit, and if some of them send spam or try stolen passwords, the address carries that record. That is why one server of your VPN works on a site and another one in the same city doesn’t.

Leaks and mismatches

When the address is clean, sites look at the rest of the connection:

A proxy fails in other ways too: the connection looks like it was opened by a Linux server, not by your computer. What websites can see about you explains these signals.

Residential proxies are harder

A residential proxy sends traffic through someone’s home connection, so the address looks ordinary. Address lists often miss them. What gives them away is the device behind the exit, often a phone or a TV box, which doesn’t match the desktop browser using it.

A VPN flag is not an accusation

A VPN flag says how an address is used, not who uses it. Travellers, remote workers and anyone on public Wi-Fi use VPNs. Sites still act on the flag because a wrong guess costs them more than an extra check costs you: a streaming service has country licences, a bank pays for every stolen account.

If your VPN gets blocked

  1. Rule out a leak first. Run the VPN check and look at IPv6, DNS and WebRTC.
  2. Try another server. If one works and another doesn’t, the blocked address has a history.
  3. If every server fails, the site probably refuses all VPN addresses. A dedicated IP from your provider sometimes helps; otherwise turn the VPN off for that one site.