VPN and Residential Proxy Detection
What it detects
VPNs and proxy networks allow fraudsters to mask their real IP address, spoof geographic location, and automate fake signups or installs. This filter identifies and blocks traffic from known VPN exit nodes, data center proxies, and residential proxy networks.
How it works
Integr8 cross-references each incoming IP against a continuously updated database of:
- Known VPN providers — commercial VPN services commonly used to mask identity
- Data center IPs — hosting providers and cloud infrastructure not associated with residential users
- Residential proxies — IP addresses belonging to real consumer devices that have been conscripted into proxy networks
Residential proxy detection is more conservative than standard VPN detection. It activates only after a threshold of proxy-associated traffic is observed for a specific Offer + Publisher combination, reducing false positives on legitimate traffic from shared ISPs.
Configuration
Navigate to Fraud Prevention > Traffic Quality > VPN and Residential Proxy Detection to configure.
| Parameter | Default | Options | Description |
|---|---|---|---|
block_vpn | true | true, false | Block known commercial VPN exit nodes |
block_datacenter | true | true, false | Block traffic originating from data center IP ranges |
block_residential_proxy | false | true, false | Block residential proxy IP addresses |
block_mode | Block | Block, Flag | Action taken when detection triggers |
Residential proxy blocking is disabled by default. Enable it only for campaigns where geo accuracy is critical, as it may block a small percentage of legitimate mobile users on shared ISP pools.
What happens when triggered
When a request is detected as VPN or proxy traffic:
- Block mode: The request is rejected with
fraud_reason: vpn_proxy. - Flag mode: The request is recorded with the fraud tag for audit, but attribution proceeds.
Review flagged or blocked traffic in Reports > Click Reports filtered by fraud_reason: vpn_proxy.
Related filters
- ISP Filter — blocks traffic from specific ISPs by name
- Data Validation — validates other request parameters before attribution