Proxy Detected? Find What Fired

The five sources of the warning

Sites rarely detect a proxy directly. They read signals that a direct connection would not produce and add them up. Knowing which kind of signal triggered the message tells you where to look.

IP classification

Every public address belongs to a network with an autonomous system number and an owner. Commercial databases add labels. MaxMind's Anonymous IP database, for example, has separate flags for anonymous VPN providers, hosting providers, public proxies, Tor exit nodes and suspected residential proxies. Many sites buy one of these feeds and block or challenge whole categories. Streaming services are the best-known case: Netflix's help article describes an error telling the viewer that a VPN or proxy appears to be in use, and asks them to switch such services off.

Leaks

WebRTC, the browser technology behind video calls, gathers network addresses to set up peer connections. RFC 8828 defines four handling modes, from enumerating every interface to forcing traffic through the configured proxy, and browsers choose a default somewhere in the middle. If WebRTC uses a route that bypasses your proxy, a page script can learn an address the proxy was meant to hide. DNS has the same problem: if your system resolves names through your home ISP while the traffic leaves through a proxy, the resolver and the exit disagree.

Added headers

Some proxies announce themselves. The Via header, defined in RFC 9110, records intermediaries; X-Forwarded-For, documented on MDN, carries the original client address; and Forwarded, from RFC 7239, standardizes both. A proxy can only insert these into requests it can read, which means plain HTTP or a proxy that decrypts HTTPS.

Mismatches

The browser reports its time zone through Intl.DateTimeFormat().resolvedOptions().timeZone (see MDN) and its languages through the Accept-Language header. When those say Lisbon and the IP says Chicago, a site does not need any database to suspect a proxy. Lower-level mismatches work the same way: the TCP packets of a proxy host can carry another operating system's defaults than the browser claims, which our TCP/IP fingerprinting guide explains.

Reputation

An address shared by many users inherits all of their behavior. If it was recently used for credential stuffing, scraping at volume or mass sign-ups, risk systems remember. Reputation is the one source you cannot fix from your own machine.

Diagnose in order

Run every check from the same browser profile and network path that produced the warning. Checking from a different browser proves nothing about the one that failed.

1. Identify the exit. Open What is my IP and note the address and country, then look up its network with the ASN lookup. A hosting company or a known VPN brand as the network owner explains a block on its own.
2. Check for a second address. Run the WebRTC leak test and the DNS leak test. Any address or resolver location that is not your exit is a leak.
3. Look at what the site receives. For plain HTTP, request a header echo through the proxy and look for Via, X-Forwarded-For or Forwarded. For HTTPS through an HTTP CONNECT or SOCKS5 proxy, the proxy cannot see or change your headers, so skip ahead.
4. Compare location signals. In the browser console, run Intl.DateTimeFormat().resolvedOptions().timeZone and navigator.languages. Compare them with the exit country from step 1.
5. Check the address's history. The IP reputation check shows public blocklist entries and abuse signals. Our guide to reading IP reputation explains which results matter and which are noise.

A quick way to see whether a proxy alters plain HTTP headers, with your own connection details in place of the placeholders:

curl -s -x http://PROXY_HOST:PROXY_PORT -U 'YOUR_PROXY_USERNAME:YOUR_PROXY_PASSWORD' http://httpbin.org/headers
curl -s -x http://PROXY_HOST:PROXY_PORT -U 'YOUR_PROXY_USERNAME:YOUR_PROXY_PASSWORD' https://httpbin.org/headers

The first request is plain HTTP, so any header the proxy adds appears in the echoed list. The second goes through a CONNECT tunnel, and the list should contain only what curl itself sent. If the HTTPS output shows Via or X-Forwarded-For, the proxy is decrypting your traffic, which is a much bigger problem than detection.

Fixes per source

Once you know which source fired, the fix is usually short.

IP classification

Change the kind of exit, not the browser. A hosting or VPN range stays a hosting or VPN range. A mobile carrier address is labeled as that carrier's network, the same label a phone on that network gets. If your use case depends on looking like a mobile visitor, use a carrier line; Coronium's mobile proxies are physical devices with their own SIM, rented to one customer per line.

Leaks

• WebRTC: in Chrome and Edge, use a policy or extension that restricts WebRTC to the proxied route; in Firefox, the media.peerconnection.ice.proxy_only preference forces it through the proxy. Antidetect browsers expose a WebRTC setting per profile; set it to follow the proxy.
• DNS: with SOCKS5, make the client resolve names through the proxy (socks5h:// in curl and many libraries). With a system-wide VPN or OpenVPN profile, confirm the DNS servers in use belong to the tunnel. Our DNS leak guide has per-system steps.
• Then rerun both tests until they show only the exit.

Added headers

Prefer HTTPS everywhere, which a relay cannot annotate. If a plain HTTP request must go through a proxy that adds headers, configure the proxy to stop (most allow it) or use one that does not. Coronium lines relay traffic over HTTP and SOCKS5 without inspecting HTTPS.

Mismatches

Set the browser profile to the exit's country: time zone, language list and locale. If you use the line for one country, keep one profile per country rather than editing settings back and forth. At the TCP layer, some lines offer an OS fingerprint setting that makes the line's packets match your browser's operating system.

Reputation

Stop the activity that created the history, slow down, and give one account one address. A dedicated line has the history of one customer; a shared exit has everyone's.

When the IP itself is the problem

Sometimes every client check comes back clean and the warning stays. Then the address is the problem, either because of its category or its recent past.

Signs that point at the address rather than your setup:

• A fresh browser profile with no extensions gets the same message within the first request.
• The same profile works on a different exit of the same type in the same country.
• The reputation check shows recent abuse reports or blocklist entries for the address.

On a Coronium line you can change the address yourself from the dashboard, through the API, with a rotation link or on a timer with a 60-second minimum. Remember that a rotation link rotates on every GET request, including link previews in chat apps, so do not paste it where a preview bot can open it. If a device keeps returning poor addresses, request a replacement: up to 2 replacements per rolling 24 hours, with new credentials and possibly a different carrier.

Some warnings are policy, not detection quality. A streaming service that blocks all VPN and proxy categories for licensing reasons will not change its mind because an address is clean. Read the service's terms before assuming the setup is broken. For broader context on what mobile addresses can and cannot avoid, see how websites detect proxies.

Frequently asked questions