VPN detection: what is a VPN?
VPN detection, with the VPN detection module from DeepBlue you get extra information about the user of a VPN. But what exactly is a VPN and what is it used for? VPN stands for Virtual Private Network. People use a VPN to surf anonymously, because a VPN hides the IP address of the device that is connected to the internet. The internet traffic goes through the server of the VPN provider.
Using a VPN can be useful to maintain privacy on the internet, to securely use public networks, and to bypass regional blockades. Wikipedia gives a clear explanation about VPN and its use.
VPN detection: that's how it works
Regular traffic on your website may not be as noticeable, but traffic from VPN IP addresses deserves extra attention because it is more likely to be malicious and may be a preparatory phase of an attack. Using a proprietary technology, it is possible to recognize VPN traffic.
We manage a database of all new and existing VPN providers. This allows us to see if users are using a VPN. On a daily basis we collect information about new and existing VPN providers. We store this information historically so that information about IP addresses can also be consulted with retroactive effect. This allows us to provide more information regarding IP addresses and domain names used by the VPN provider. Knowing that an IP address belongs to a particular VPN provider can help with triage (searching other IP addresses from the same provider in your logs to get a more complete picture of an attack).
VPN detection to prevent abuse
VPN detection can help you prevent abuse. While there are legitimate reasons to use a VPN, it is also used by hackers and people with malicious intent. These people abuse the anonymity that a VPN offers. Hackers can pay for a VPN service with anonymous cryptocurrencies, such as Bitcoin, for example. By using DeepBlue Security & Intelligence's VPN detection, you can identify and counter potential attacks and abuse.
