How to detect proxy and VPN traffic on your landing pages

You bought traffic for Bangladesh, the clicks arrived, and the conversion rate is close to zero. Or the network tells you a large share of your leads came from outside the offer's allowed countries, even though your ad targeting was set correctly. In both cases there is a good chance part of that traffic was routed through proxies or VPNs.

Proxy and VPN visitors are one of the most common reasons affiliate campaigns look fine in the ad dashboard and fall apart in the network's report. This guide explains why they show up, how to detect them on your landing pages, and what to do with them once you know.

Why proxy and VPN traffic hurts affiliates

A proxy or VPN hides the visitor's real connection behind a different IP address. There are legitimate reasons to use one, such as privacy or a work network, but on a paid campaign the share of real buyers behind them is small. Much of it comes from:

• Incentivised users who complete offers for rewards and switch location to qualify for offers in other countries.
• Fraud rings submitting fake leads at scale, rotating through proxy IPs so each submission looks like a new person.
• Bots and scrapers running from hosting providers and cloud servers.
• Competitors or ad-checking tools clicking your ads and links.

The damage shows up in three places. Your ad spend goes on clicks that will never convert. Your EPC drops because the denominator is full of junk. And the leads that do get submitted are rejected by the network for being out of geo or fraudulent, which can hurt your standing with the advertiser.

How proxy and VPN detection works

You cannot reliably spot a proxy from the browser alone. The useful signal is the IP address itself: what network it belongs to, how it has been used before, and whether it is known to route traffic for other people.

An IP check returns several fields that matter here:

• proxy: the address belongs to a proxy service or is otherwise used to relay traffic.
• vpn: the address belongs to a VPN provider.
• active_vpn: a VPN appears to be in active use on this connection right now, which is a stronger signal than the address simply belonging to a VPN range.
• tor: the address is a Tor exit node.
• bot_status: the traffic pattern looks automated.
• recent_abuse: the address has been linked to abuse recently.
• fraud_score: an overall 0 to 100 risk score that combines these signals.
• Country, region, city, ISP, ASN and organization: where the address appears to be and who operates it.

The network fields are often the quickest giveaway. A visitor who says they are a mobile user in Lahore but whose ISP is a cloud hosting company in another country is not a mobile user in Lahore.

Where to check on your landing page

On the first page load

Checking the IP when the visitor first lands lets you decide what they see. You can serve a different page, skip the redirect to the offer, or simply tag the visit as suspicious in your tracker. This is the best place to protect click-redirect flows, because you stop junk before it reaches the advertiser's link.

On form submission

If you collect leads yourself, check again when the form is submitted. This is where you decide whether to forward the lead, hold it for review, or drop it. A check at submission also catches visitors who switched connection between landing and submitting.

Server side, not in the browser

Run the check from your server, using the IP your server sees for the request. Anything done only in the browser can be skipped or faked. Keep your API key on the server too; it should never appear in page source.

What to do about it

Detection is only useful if you act on it consistently. Here is a practical setup.

Set rules per offer

Different offers tolerate different levels of risk. A geo-restricted offer should treat any proxy or active_vpn flag as a reason to hold the lead, because the location cannot be trusted. A worldwide offer with a strong verification step can be more relaxed and rely mainly on the score.

A reasonable starting point:

• Block tor and bot_status outright on lead forms.
• Hold visitors with proxy or active_vpn set on geo-restricted offers.
• Hold any score of 75 or more.
• Allow low scores from residential and mobile networks in the right country.

Check the location against the offer

Compare the country the IP resolves to with the countries the offer accepts. If they do not match, the lead is likely to be rejected whether a proxy is involved or not. Do this before you forward, not after.

Watch the ISP and organization fields

Group your traffic by ISP or organization in your tracker. If a large share of a placement's clicks comes from hosting providers, that placement is sending you non-human or relayed traffic. Pause it rather than filtering it one lead at a time.

Use a middle path for borderline visitors

Some real customers use a VPN at work or on public Wi-Fi. If you block every VPN, you will lose some genuine leads. For visitors in the suspicious range, add a second step such as an SMS code or email confirmation instead of a hard block. Real people complete it; most fraud does not.

Make a check part of every redirect

For click-redirect traffic, the check fits between the click and the redirect:

curl -H "Authorization: Bearer fn_your_key" \
  "https://fraudnova.com/api/v1/check?ip=198.51.100.42"

If the result is clean, redirect to the offer. If it is flagged, send the visitor to a fallback page instead and log the result. Each check costs 1 credit, so it is worth checking unique visitors rather than every repeat page view.

Auditing traffic you already bought

If you want to know how much of last week's traffic came through proxies, export the IPs from your tracker and check them in bulk. The batch endpoint takes up to 100 IPs per request. Group the results by source and placement and you will see quickly which ones are worth scaling and which are burning money.

Next step

Take a handful of IPs from your recent clicks or leads and run them through the free IP checker. You will see the proxy, VPN, Tor and risk signals for each one without creating an account.

When you want to check every visitor automatically, the proxy and VPN detection API returns all of these signals in one request. Verify your email and you get 25 free credits, then it is 1 credit per check with no subscription. Request and response details are in the API docs.