Why do websites think I'm using a VPN?

Written by Aldo · blue-team threat hunter
Last updated November 9, 2026 · 5 min read

A streaming service says “you seem to be using a VPN or proxy”. Your bank asks for an extra code. A shop won't take your card. You haven't turned on any VPN. What are they seeing?

Not your device. A website gets your IP address and a few things your browser reports, nothing more. To decide whether you're on a VPN, it asks a commercial database or its own rules about that address. Those databases are built from a handful of signals, and each one can be wrong about you.

The five signals sites use

The address belongs to a data centre. VPN servers run in data centres and clouds, so most sites treat any address from Amazon, Google Cloud, Microsoft Azure or a hosting company as “not a home connection”.
The address is on a list of known VPN or proxy servers. Some lists are public (iplover uses the community-maintained X4BNet list, credited wherever it matches); commercial vendors keep their own.
The address is a privacy relay. Apple publishes the exit addresses of iCloud Private Relay, so any site can recognise them.
Your browser's time zone doesn't match the address's location. A clock set to Berlin with an address in New York looks like a tunnel.
The address has a bad reputation, because other people on the same address (or the same provider block) misbehaved. That's common with shared addresses.

A worked example: four addresses, four network types

iplover's network-type check uses only public lists, the same kind of information a site's fraud tool starts from. On 9 November 2026 it returned:

Address	Network type	How we know
172.224.226.33	Privacy relay	In Apple's published list of iCloud Private Relay exit addresses. “Many people share it; it is not one person's address.”
3.5.140.1	Hosting, cloud or data center	In the ranges Amazon Web Services publishes: a server, not a home connection.
185.220.101.1	Tor exit node	In the Tor Project's exit list.
8.8.8.8	Hosting, cloud or data center (estimate)	Only an estimate from the owner's name, Google LLC. “Names can mislead.”

The first row is the one that surprises people. An iPhone user with Private Relay switched on looks, to a website, exactly like this: an address shared by many Apple users, routed through a content network. They never installed a VPN, and they're still flagged.

The last row shows the weakest signal. When no list covers an address, tools fall back on the network owner's name. A name containing “cloud”, “hosting” or a big tech brand pushes the guess towards “data centre”. Commercial databases do the same, with the same chance of being wrong, and they rarely tell you it's a guess. Ours says “(estimate)”.

Flagged without a VPN? Check these

Check	Where	Why it matters
iCloud Private Relay	In the iCloud settings of your Apple account, on iPhone, iPad or Mac. The name and place of the switch have changed between system versions; Apple's guide Set up iCloud Private Relay on all your devices shows the current steps.	It hides your address in Safari and is recognised everywhere. Turn it off for a test.
A VPN built into the browser	Opera's VPN, Edge's Secure Network, privacy extensions	They change your address for that browser only, so you forget they're on.
Work or school network, or a work device	Is your traffic going through the company's proxy or VPN?	Corporate gateways often sit in data centres.
Security software	“Safe browsing”, “web shield” or “secure DNS” features	Some route traffic through the vendor's servers.
Your time zone	Your device's date and time settings	A manually set zone that doesn't match where you are looks like a tunnel.
Your provider shares addresses (CGNAT)	Compare your router's WAN address with the one on iplover's homepage	Many customers share one public address, and its reputation.

The homepage of iplover runs two of these checks for you: the network type of your current address, and whether your browser's time zone matches its location.

What you can do about it

If it's a relay or VPN you use: turn it off for that site only, if the app allows it, or accept the extra checks as the price of the privacy.
If it's your provider's shared address: restarting your router sometimes gives you a different address. Some providers will give you your own public address on request, sometimes for a fee.
If a site keeps blocking you: tell its support team your address (copy it from iplover's homepage) and that it's a home connection. Fraud vendors do correct entries when sites report them.
On mobile data: carriers route many customers through a few gateways, so mobile addresses are often shared. Switching between Wi-Fi and mobile data is a quick test of which network the site dislikes.

What a site can't know

None of these signals sees inside your device. A site can't tell whether a VPN app is installed, only whether your current address looks like one. That cuts both ways: a good residential VPN can go unnoticed, and an ordinary customer on a shared address can be flagged. If a site says you're on a VPN and you aren't, its guess is wrong, not your connection.

Sources

Official documents we used to check the facts in this guide.