Skip to content
PricingDocs

Network Layer

Network Intelligence Engine

See through VPNs, proxies, and Tor. Classify every connection by network type, location, and risk profile before it touches your application.

Get StartedAPI Docs

VPN Detection

5 Detection Methods

Multi-layered VPN detection beyond IP reputation. Network-level, protocol-level, and behavioral signals to catch commercial and self-hosted VPNs.

MethodAccuracyDetail
IP Reputation97.2%Database of 12M+ known VPN exit IPs, updated hourly from commercial and residential VPN providers.
WebRTC Leak Analysis99.1%STUN/TURN probe reveals real IP behind VPN tunnel. Works even when WebRTC is restricted to relay-only.
MTU/TTL Analysis94.8%VPN tunnels alter packet MTU and TTL values. Our edge network detects these deviations from expected values.
DNS Leak Detection96.5%Compares resolved DNS server location with claimed IP geolocation. Mismatches indicate VPN or proxy usage.
Timezone Mismatch91.3%Cross-references browser timezone with IP geolocation. Users in UTC+3 connecting from a UTC-8 IP are flagged.

Response Example

{
  "vpn": {
    "detected": true,
    "confidence": 0.97,
    "provider": "NordVPN",
    "methods": ["ip_reputation", "webrtc_leak", "mtu_analysis"],
    "realIp": "203.0.113.42"
  }
}

Proxy Detection

3 Proxy Types

Distinguishes between transparent, anonymous, and elite proxies using header analysis, connection characteristics, and behavioral fingerprinting.

MethodAccuracyDetail
Transparent Proxy99.5%Detected via X-Forwarded-For, Via, and other proxy-injected headers. Trivial to detect.
Anonymous Proxy97.8%No forwarding headers but detectable via connection timing, TCP fingerprint, and IP reputation.
Elite Proxy93.2%Detected via behavioral signals: datacenter ASN, connection pooling patterns, and residential IP scoring.

Response Example

{
  "proxy": {
    "detected": true,
    "type": "anonymous",
    "confidence": 0.98,
    "datacenter": true,
    "asn": { "num": 14061, "org": "DigitalOcean" }
  }
}

Tor Detection

Exit Node Identification

Real-time Tor exit node detection using a continuously updated directory of exit relays, combined with TLS fingerprinting unique to the Tor Browser.

MethodAccuracyDetail
Exit Node Directory99.8%Continuously synced with Tor consensus documents. New exit nodes detected within 60 seconds of joining the network.
TLS Fingerprint99.2%Tor Browser produces a unique JA4 hash due to its modified Firefox ESR base. Detectable even through bridges.

Response Example

{
  "tor": {
    "detected": true,
    "confidence": 0.99,
    "exitNode": "185.220.101.42",
    "exitNodeCountry": "DE",
    "tlsFingerprint": "t13d1516h2_8daaf6..."
  }
}

Geolocation

City-Level Precision

IP-to-location resolution with city-level precision for 98% of non-VPN traffic. Cross-validated with browser timezone and language signals.

MethodAccuracyDetail
IP Geolocation98.4%MaxMind GeoIP2 + proprietary correction layer for mobile carriers and CGNAT ranges.
Cross-Validation99.1%Browser timezone, language, and keyboard layout cross-checked against IP location for fraud scoring.

Response Example

{
  "geolocation": {
    "ip": "203.0.113.42",
    "city": "Berlin",
    "region": "Berlin",
    "country": "DE",
    "latitude": 52.5200,
    "longitude": 13.4050,
    "accuracy": "city",
    "timezoneMatch": true
  }
}

ASN Analysis

Network Classification

Classifies traffic by autonomous system to distinguish residential, mobile, datacenter, and hosting traffic. Datacenter traffic carries inherently higher fraud risk.

MethodAccuracyDetail
ASN Classification99.7%Every IP mapped to its ASN with classification: residential, mobile, datacenter, hosting, education, government.
Hosting Detection98.9%Identifies traffic from AWS, GCP, Azure, DigitalOcean, Hetzner, OVH, and 200+ other hosting providers.

Response Example

{
  "asn": {
    "number": 14061,
    "organization": "DigitalOcean, LLC",
    "type": "datacenter",
    "isHosting": true,
    "isResidential": false,
    "riskScore": 0.82
  }
}

Integration Example

Network intelligence data is included in every identification response. No extra API calls needed.

const result = await tracio.identify()

if (result.network.vpn.detected) {
  // Apply enhanced verification
  requireMFA(result.visitorId)
}

if (result.network.asn.type === 'datacenter') {
  // Flag for review — residential users don't use datacenter IPs
  flagForReview(result.visitorId, 'datacenter_traffic')
}

if (result.network.tor.detected) {
  // Block or challenge based on your policy
  challengeUser(result.visitorId, 'tor_detected')
}

See Every Connection Clearly

Start identifying VPNs, proxies, and Tor in your traffic today.

Get Started