| Detection Method | How It Works | |----------------|--------------| | | Known proxy/VPN IP ranges are flagged (e.g., data center IPs vs. residential). | | Behavioral Analysis | Rapid changes in IP location (e.g., from US to Germany in 1 minute) trigger checks. | | HTTP Headers | Presence of Via , X-Forwarded-For , or Proxy-Connection headers. | | TLS Fingerprinting (JA3) | Unusual TLS handshake patterns from proxy software. | | WebRTC Leak Detection | WebRTC can reveal real IP even behind a proxy. | | CAPTCHA Challenges | Frequent CAPTCHA prompts for proxy traffic. | | Login Anomaly Detection | Login from a known proxy IP forces additional verification (2FA, email code). |