Fraudsters have to be stealthy if they want to get away with ad fraud, form jacking, or web scraping. To bypass the multiple security checks that many websites have in place, they need to mimic the behaviors of legitimate visitors. One way to do that is by using a proxy. Proxies are widely used for both valid and malicious purposes.

The good news is that there are ways to detect proxies. detect proxies, VPNs, and TOR users can look for clues that indicate a proxy connection by analyzing HTTP headers. For example, if the latency between the browser and server is much higher than expected (due to the detour over a proxy), that might be a sign that the user is using a proxy. Similarly, if the IP geolocation doesn’t match that of the user’s browser or device settings, that might also be a proxy indication.

Detect Proxies, VPNs, and TOR Users: Strengthen Your Access Control Systems

Other common ways to detect a proxy include checking for a known list of proxy IP addresses or detecting the use of a popular proxy program like TOR by looking at the IP port used, which is typically used for proxy programs and VPNs. Additionally, some tools can “pierce” the veil of a proxy and reveal the user’s original IP address and location.

Residential Proxy Detection can also identify network traffic that has been routed through legitimate residential IP addresses to mask the true origin of suspicious activity. This makes it harder to detect than traffic originating from datacenter proxies or misconfigured home networks.