VPN detection

VPN detection: what is a VPN?

VPN detection, with the VPN detection module from DeepBlue you get extra information about the user of a VPN. But what exactly is a VPN and what is it used for? VPN stands for Virtual Private Network. People use a VPN to surf anonymously, because a VPN hides the IP address of the device that is connected to the internet. The internet traffic goes through the server of the VPN provider.

Using a VPN can be useful to maintain privacy on the internet, to securely use public networks, and to bypass regional blockades. Wikipedia gives a clear explanation about VPN and its use.

VPN detection: that's how it works

Regular traffic on your website may not be as noticeable, but traffic from VPN IP addresses deserves extra attention because it is more likely to be malicious and may be a preparatory phase of an attack. Using a proprietary technology, it is possible to recognize VPN traffic.

We manage a database of all new and existing VPN providers. This allows us to see if users are using a VPN. On a daily basis we collect information about new and existing VPN providers. We store this information historically so that information about IP addresses can also be consulted with retroactive effect. This allows us to provide more information regarding IP addresses and domain names used by the VPN provider. Knowing that an IP address belongs to a particular VPN provider can help with triage (searching other IP addresses from the same provider in your logs to get a more complete picture of an attack).

VPN detection to prevent abuse

VPN detection can help you prevent abuse. While there are legitimate reasons to use a VPN, it is also used by hackers and people with malicious intent. These people abuse the anonymity that a VPN offers. Hackers can pay for a VPN service with anonymous cryptocurrencies, such as Bitcoin, for example. By using DeepBlue Security & Intelligence's VPN detection, you can identify and counter potential attacks and abuse.

cyber threat intelligence

VPN detection, why?

VPN detection can help to recognize and prevent attacks at an early stage and preventively block (former) employees who use a VPN. Via VPN detection we can find out more information regarding IP addresses and domain names used by the VPN provider.

VPN detection can also help identify suspicious traffic. If it is not normal or customary for employees to use a VPN, the VPN detection module can recognize this traffic. VPN detection can also preventively block VPN use by (ex) employees, because you can never know what kind of information a VPN provider keeps. Of course, this data can be queried or linked via an API.

Contact us about VPN detection

The VPN scraper that DeepBlue Intelligence has developed for VPN detection is part of the DeepBlue Raven platform. For more information, please contact us by e-mail info@deepbluesecurity.nl or by telephone on +31(0)70 800 2025.


This website uses cookies

We use cookies to improve your experience. Read more