VPN and Residential Proxy Detection
What it detects
Section titled “What it detects”VPNs and proxy networks allow fraudsters to mask their real IP address, spoof geographic location, and automate fake signups or installs. This filter identifies and blocks traffic from known VPN exit nodes, data center proxies, and residential proxy networks.
How it works
Section titled “How it works”Integr8 cross-references each incoming IP against a continuously updated database of:
- Known VPN providers — commercial VPN services commonly used to mask identity
- Data center IPs — hosting providers and cloud infrastructure not associated with residential users
- Residential proxies — IP addresses belonging to real consumer devices that have been conscripted into proxy networks
Residential proxy detection is more conservative than standard VPN detection. It activates only after a threshold of proxy-associated traffic is observed for a specific Offer + Publisher combination, reducing false positives on legitimate traffic from shared ISPs.
Configuration
Section titled “Configuration”Navigate to Offers > Fraud Detection Groups > select a filter group > VPN / Proxy.
| Parameter | Default | Options | Description |
|---|---|---|---|
residential_vpn_check |
true | true, false | Block residential proxy IP addresses in addition to commercial VPNs and data center IPs |
threshold_percentage |
0 | 0–100% | Percentage of non-proxy vs. proxy/VPN traffic required before blocking activates. Set to 0 to block immediately with no threshold check |
minimum_request_count |
0 | 0+ | Minimum number of requests before the threshold is evaluated |
lookback_hours |
12 | 12, 24, 96, 720 | Lookback window in hours for measuring the VPN traffic ratio |
check_by_sub_id |
false | true, false | Calculate at sub ID level instead of publisher level |
Residential proxy blocking is disabled by default. Enable it only for campaigns where geo accuracy is critical, as it may block a small percentage of legitimate mobile users on shared ISP pools.
threshold_percentage, minimum_request_count, lookback_hours, and check_by_sub_id are managed by administrators. Contact your account admin to review or update those parameters.
What happens when triggered
Section titled “What happens when triggered”When a request is detected as VPN or proxy traffic:
- Block mode: The request is rejected with
fraud_reason: vpn_proxy. - Flag mode: The request is recorded with the fraud tag for audit, but attribution proceeds.
Review flagged or blocked traffic in Reports > Click Reports filtered by fraud_reason: vpn_proxy.
Related filters
Section titled “Related filters”- ISP Filter — blocks traffic from specific ISPs by name
- Data Validation — validates other request parameters before attribution