Quick version: VPN detection isn't magic. It's a few cheap signals stacked together until the answer is obvious. Same tricks Netflix uses, same tricks we use - we just show our work.
The four signals
1. IP organization name
Every IP block on the internet is registered to an organization, listed in public WHOIS and ASN databases. When IP 91.219.235.4 shows up at our server, we look up its org and find NordVPN. Or M247 (a hosting company that NordVPN/CyberGhost rent from). Or Datacamp Limited (CyberGhost again). That's a strong VPN signal - residential ISPs don't have those names. The full list of "known VPN org names" is in our detection logic; we update it as we encounter new ones.
2. Timezone vs. browser timezone
Your operating system has a timezone. Intl.DateTimeFormat().resolvedOptions().timeZone in JavaScript reads it. Your IP, geolocated, also has a timezone (the one for that city). If they don't match - the IP says "Amsterdam, Europe/Amsterdam" but your browser says "America/Los_Angeles" - that's a tell. You're not magically present in two timezones. Either you traveled and didn't change your laptop, or you're using a VPN.
This signal alone has false positives (frequent travelers, expats, people whose laptops never adjusted timezone after moving) so we weight it 0.4 not 1.0.
3. Browser language vs. country
navigator.language tells us your browser's preferred locale - often en-US, de-DE, ru-RU. The country code suffix should roughly match the country your IP is in. If you're connecting from JP with en-US, that's an English-keyboard user routing through Japan - possible (expat) but more often a VPN.
Lowest-weight signal because lots of people legitimately have a US/UK English keyboard while living abroad. Worth 0.2 in our score.
4. Datacenter heuristic
If the org name contains "hosting", "cloud", "server", "datacenter" - and isn't on our explicit VPN-org list - it's still suspicious. AWS, DigitalOcean, Hetzner, OVH, Vultr all return strings like that. Residential ISPs return things like "Comcast Cable" or "Deutsche Telekom Privatkunden". The datacenter heuristic catches mid-tier and corporate VPNs that don't show up in our explicit list.
How streaming services do it differently
Netflix and similar services use commercial detection feeds (IPQualityScore, MaxMind, ipinfo.io Privacy, Spur, Digital Element) that go beyond the public org-name check. Those feeds:
- Maintain real-time inventories of every consumer VPN's current IP range, refreshed hourly
- Tag residential proxies (rotating IPs that look like home connections but are actually proxies)
- Score IPs by historical "abuse" - if the IP has been used for VPN-style activity recently, score is high
- Detect TLS fingerprint anomalies that indicate a forwarding proxy
- Use ML on connection-pattern data to flag suspicious IPs even before they're catalogued
That's why a VPN can pass our test (we don't pay for those feeds) but fail Netflix's (they do). If you want to stream, you need a VPN that actively rotates through residential-style IPs - currently best with NordVPN's "obfuscated servers", Surfshark's "MultiHop", or smaller providers like AstrillVPN.
What you can do with this test
- Confirm a new VPN is working - install, connect, check here. If we say "VPN", you're at least invisible to the basic check.
- Test if a free VPN extension actually does anything - many "free VPN" Chrome extensions are dead or don't actually proxy traffic.
- Diagnose Netflix blocks - if our test says "no VPN" but Netflix still blocks you, the IP got burned through other detection. Switch servers.
- Sanity-check before sensitive activity - quick visual confirmation the VPN is doing its job before logging into a sensitive account or torrenting.
Bottom line
Free VPN detectors give a fast yes/no using the same public signals streaming services started with. They're not a replacement for paid detection feeds, but they're enough to catch dead VPNs and verify a working one. Use this to confirm before you trust.