The message is blunt and usually final: VPN or proxy detected, and the page refuses to continue. What the site is reporting is a classification rather than an accusation. A fraud or anti-bot service looked up your exit address, matched it against lists of known VPN and proxy endpoints, and returned a verdict before you touched anything on the page. We run a proxy network and FFraud, an IP-intelligence engine that produces exactly this kind of classification, so we can walk you through both sides of the counter: what makes an address read as a VPN or proxy, and what it takes to read as an ordinary connection.
Two very different people search this message. One is not using a proxy at all and has no idea why a streaming service or a shop suddenly treats them like one. The other runs a proxy on purpose and needs it to stop being seen. Both get their own fix section below, because the levers are different.
Why a website says you are using a VPN or proxy
Your exit address carries a signal that services look up in real time. Three signals dominate the verdict: the address appears on a published list of VPN or proxy endpoints, it belongs to a hosting or datacenter network that no ordinary person browses from, or the request leaks a proxy header that announces the hop. Any single one is enough for a site that buys this classification to refuse the connection. The verdict is a property of the address, which is why it arrives before the site has watched a single thing you do.
Your request
arrives with an exit IP
IP lookup
known-exit lists, ASN class
Request read
headers, ports, leaks
Verdict
pass, challenge, or refuse
The five signals, and the lever each one gives you
The classification is built from a few readings. None of them is mysterious, and each one is something you can measure yourself before a site does.
It is on a known-exit list
Fraud-intelligence vendors such as DataDome, IPQualityScore, and MaxMind keep lists of addresses that operate as VPN or proxy endpoints, and sites query them on every request. A commercial VPN's exit ranges are shared by many thousands of users and become known quickly, so they reach these lists fast, often within days of going live. The wider detection stack behind this is walked in how websites detect proxies.
It belongs to a hosting network
Every address maps to an ASN, the public identifier of the network that owns it, and a hosting or datacenter ASN is itself the signal, because homes do not sit in server ranges. This is the input a datacenter proxy can never change, and the reason such an address shows up with a high fraud score even on the day it is born.
The request announces the hop
Some proxies attach headers (Via, X-Forwarded-For, Forwarded) or answer on a default proxy port, which advertises the extra hop directly, no list lookup required. The taxonomy of how loudly a proxy announces itself is its anonymity level, covered in transparent vs anonymous vs elite proxies. One request shows you exactly what a site receives:
# What the site sees: your exit address and any proxy header in the request
curl -x http://203.0.113.10:8080 -s https://httpbin.org/headers
A Via or X-Forwarded-For line in that output is a leak you can close at the client, and it will flag you no matter how clean the address is.
The browser leaks a second location
WebRTC can hand a site your real address through a STUN request even while every page load goes through the proxy, and a DNS resolver outside the tunnel tells the same story. The site now sees two locations at once and flags the mismatch. This is a client problem, not an address problem, which is why it survives every proxy change until you close it in the browser itself.
Too many identities from one address
An address that many unrelated accounts sign in from looks like shared or automated infrastructure, and shared infrastructure reads as a proxy even without a list entry against it. This one builds over time, which means an exit that passed on Monday can fail on Friday because of what other traffic did in between.
| The signal a site reads | What raises the VPN-or-proxy verdict |
|---|---|
| Known-exit list | Your address is a published VPN or proxy endpoint |
| Hosting network (ASN) | Your address sits in a datacenter range, not a consumer ISP |
| Proxy headers or ports | The request advertises a hop, via headers or a default proxy port |
| WebRTC or DNS leak | The client exposes a second, real location the exit does not match |
| Many accounts, one IP | The address looks like shared or automated infrastructure |
Where the message shows up, and what each site is really checking
The wording changes from site to site, but the machinery behind it is the same classification with different thresholds.
Streaming services
Netflix shows "You seem to be using an unblocker or proxy" and pauses playback, and Hulu and Prime Video have their own versions of the same wall. Streaming services license content per country, so they buy the classification specifically to keep exits that hide the viewer's country out, and they run some of the strictest list matching there is. Datacenter VPN ranges are their easiest catch. What that means for proxy choice on these platforms is covered in proxies for Hulu, and the same logic holds across the category.
Shops, ticketing, and sneaker sites
Retail platforms fight automated buyers, so their thresholds are tuned for volume patterns: one address touching many carts, sessions that move faster than a human, headless browsers with mismatched fingerprints. The VPN-or-proxy message here is often the polite front of a bot verdict. The address class still decides the first gate, but these sites weigh the behavior readings more heavily than a streaming service does.
Banks and payment apps
Banks flag proxy exits because criminals hide behind them, and a login from a datacenter range on an account that normally connects from one city is exactly the pattern fraud teams alarm on. The honest advice is the boring one: do not put a proxy or VPN in front of your bank. The likely outcome is not access, it is a frozen account and a phone call, and no address quality changes that calculus.
Games and app stores
Game platforms mostly flag proxies around account creation, region switching, and purchases rather than play, and a flagged address at signup can shadow the account afterwards. The free-tier version of this problem, and why it usually ends in bans, is measured in free proxies for Roblox, and the pattern generalizes across launchers.
The fix when you are not using any proxy at all
The message without a proxy in play means something in your path reads as one. This list clears the overwhelming majority of those cases.
Clear a false VPN-or-proxy verdict on a normal connection
- 1
Turn off software that proxies your traffic
Antivirus web protection, some ad blockers, and privacy browsers route traffic through a local proxy, and sites read it. Turn the web-shield feature off, reload, and test again.
- 2
Check the system proxy setting is actually off
A closed VPN app can leave the system proxy switched on, so every browser still routes through a dead endpoint. Where that switch lives on every platform is in our guide to turning proxy settings off.
- 3
Get a fresh address from your ISP
Restart the router; most consumer connections pick up a different address on reconnect. If the message follows you across addresses, the whole range may be listed and it is worth telling your ISP.
- 4
Test on mobile data
If the site works over mobile data, the verdict is about your home or office address, not your account. Some carriers put thousands of customers behind one shared address, which occasionally lands on a flagged list through no fault of yours.
The fix when you run a proxy on purpose
Reading clean means removing each signal in the order of how heavily it counts. The address class dominates, so start there.
Read the exit before you trust it
Run the exit through our proxy checker to see the ASN, the network class, and the country, then put the same address through FFraud to see the fraud score and whether it is already classified as a VPN or proxy endpoint. A high score before you send any real traffic means the address arrived dirty, and no amount of careful use will un-list it. Finish with the curl call above to confirm the request carries no Via or X-Forwarded-For line.
Move the exit to a consumer ISP
The network class is the input that dominates the verdict, and a residential address satisfies it by design: it belongs to a real home ISP, so the ASN reads right and the address is not born on a datacenter list. Our residential proxies route through real home connections and start at $0.44/GB pay-as-you-go.
What the classifier reads on each exit class
| Feature | Datacenter VPN exit | Residential exit |
|---|---|---|
| ASN class | hosting range | consumer ISP |
| On known-exit lists | usually, and fast | not when the pool is maintained |
| Shared with strangers | thousands per exit | depends on the pool |
| Survives streaming checks | rarely | usually |
| Cost | flat subscription | per GB |
The residential exit removes the two signals that fire first, the hosting ASN and the list entry. It does not remove fingerprint or behavior checks, which belong to the client.
Signal weighting as fraud-intelligence vendors document it; see sources below
A residential label is not proof
A specific residential address can still be flagged if a previous user burned it, and classification is probabilistic either way. Read the exit in the checker and the fraud lookup before you rely on it: a clean exit is a snapshot you measure, not a property you inherit with the label.
That snapshot logic, and why yesterday's clean reading does not carry, is its own subject in what is a clean IP.
Close the client-side leaks
Use a proxy that does not add Via or X-Forwarded-For, and turn off WebRTC and DNS leakage in the browser so no second location contradicts the exit. Set the browser timezone to match the exit country, because a Berlin clock on a Dallas address is a mismatch no list can cause and no list entry can excuse.
Keep one identity per exit
Spreading unrelated accounts across a single exit is the pattern that reads as shared infrastructure even when the address itself is clean. For logins, hold one address per identity with a sticky session rather than rotating mid-account; the mechanics of that choice are in sticky vs rotating sessions. A VPN-or-proxy verdict is one specific way an address gets refused, and the broader set of refusal reasons lives in why is my IP blocked.
What reading clean does not buy you
A clean residential exit clears the classification that stops most VPN and proxy traffic, the address-level check, but detection does not end at the address. Sites also read your TLS fingerprint, your header order, your timezone measured against your IP's country, and your behavior across the session, so a clean address behind a headless client with a mismatched fingerprint still gets flagged, just one gate later. No address makes a browser that reports the wrong timezone look consistent with its exit. A believable exit removes the reason most of these verdicts fire, and a believable client removes the rest. Anyone selling an address that is never detected is selling the list entry, not the result.
Sources
- Netflix Help Center, "Netflix says: You seem to be using an unblocker or proxy": the streaming version of the message and Netflix's stated reason for it.
- DataDome, "What are data center proxies and how to detect them?": how anti-bot systems score hosting networks against ISP-registered ranges.
- IPQualityScore, "Proxy detection": the known-exit lists and the proxy, VPN, and abuse signals behind a classification.
- Cloudflare, "Machine learning to detect bot attacks that use residential proxies": why residential reputation is weighed against known-proxy classification and behavior.
