VPN, proxy, Tor, and datacenter IP detection: what to block and what to review

VPN, proxy, Tor, and datacenter signals are useful, but they should not all mean the same thing. A privacy-conscious user on a VPN is different from a botnet rotating through hosting networks.

The practical question is not “is this IP suspicious?” It is “what should my application do next?”

Treat connection type as one signal

Connection risk gets stronger when it agrees with other context:

• Disposable email plus proxy.
• New account plus datacenter network.
• Country mismatch plus high cart value.
• Repeated sessions plus Tor or hosting ASN.
• API-key creation immediately after signup.

RequestGuard combines connection risk with email, domain, device, and behavior context so your backend can choose allow, challenge, review, or block.

Suggested actions

Signal pattern	Action
VPN only, normal account history	Usually allow.
Proxy plus disposable email	Challenge or review.
Tor plus payment or API-credit event	Review or block.
Datacenter plus repeated signup attempts	Block or rate-limit.
Hosting ASN plus country mismatch	Challenge or review.

Example check

const assessment = await requestGuard.assess({
  ip,
  email,
  userAgent,
  event: "signup",
  metadata: { requested_feature: "api_keys" },
});

if (assessment.decision === "review") {
  // Limit access until the user proves legitimacy.
}

Avoid overblocking

Many legitimate users use VPNs. Blocking every VPN can harm conversion, privacy-conscious users, and international teams.

Use the risk decision, reasons, and confidence together. Let low-risk VPN users continue, challenge uncertain sessions, and block only when multiple signals point to abuse.