How are proxy IPs discovered and identified by websites?

<p style="line-height: 2;"><span style="font-size: 16px;">In daily online activities, many people use </span><a href="https://www.b2proxy.com/" target="_blank"><span style="color: rgb(9, 109, 217); font-size: 16px;">proxy IPs</span></a><span style="color: rgb(9, 109, 217); font-size: 16px;"> </span><span style="font-size: 16px;">to protect their real identities or to access the internet freely. However, websites can often determine whether a visitor is using a proxy and may even obtain their true geographic location. What technical methods do websites use to detect proxy IPs?</span></p><p style="line-height: 2;"><br></p><p style="line-height: 2;"><span style="font-size: 24px;"><strong>I. HTTP Header Analysis</strong></span></p><p style="line-height: 2;"><span style="font-size: 16px;">HTTP request headers contain a wealth of client information. When a user accesses a website through a proxy server, some proxy software adds specific fields to the request headers. The most common include X-Forwarded-For (which records the client's real IP address and the proxy chain), Via (which identifies the proxy servers the request has passed through), and Forwarded (an RFC standard field that provides original IP and other information). By simply checking for the presence of these fields, a web server can preliminarily determine whether the request has gone through a proxy.</span></p><p style="line-height: 2;"><br></p><p style="line-height: 2;"><span style="font-size: 24px;"><strong>II. IP Blacklists and Geolocation Verification</strong></span></p><p style="line-height: 2;"><span style="font-size: 16px;">Many security companies maintain large proxy IP databases that list known VPN, data center, </span><a href="https://www.b2proxy.com/pricing/residential-proxies" target="_blank"><span style="color: rgb(9, 109, 217); font-size: 16px;">residential proxy</span></a><span style="color: rgb(9, 109, 217); font-size: 16px;"> </span><span style="font-size: 16px;">and proxy server IP addresses worldwide. The website compares the visitor's egress IP against these databases. If the IP is blacklisted, it is flagged as a proxy. At the same time, websites also verify the IP's geolocation information: if the IP's recorded location clearly does not match the user's claimed location, or if there is a "teleportation" across distant regions within a very short period, it will also trigger a risk alert.</span></p><p style="line-height: 2;"><br></p><p style="line-height: 2;"><span style="font-size: 24px;"><strong>III. WebRTC and DNS Leak Detection</strong></span></p><p style="line-height: 2;"><span style="font-size: 16px;">This is one of the most overlooked detection methods. WebRTC (Web Real-Time Communication) is a built‑in browser feature that supports peer‑to‑peer applications like video chats. To establish efficient connections, WebRTC may bypass proxy settings and communicate directly with STUN servers, thereby exposing the user's real local IP address and public IP. A website only needs to embed a short piece of JavaScript code to trigger this detection. Additionally, if the proxy is misconfigured, DNS requests may not go through the proxy tunnel but be sent directly to the local ISP's DNS server, revealing the user's true location.</span></p><p style="line-height: 2;"><br></p><p style="line-height: 2;"><span style="font-size: 24px;"><strong>IV. Port Scanning and Behavioral Analysis</strong></span></p><p style="line-height: 2;"><span style="font-size: 16px;">Proxy servers typically listen on specific ports — for example, HTTP proxies often use ports 8080 or 3128, while SOCKS proxies use port 1080. Websites can scan a client's open ports to detect the presence of a proxy. Moreover, by analyzing behavioral patterns such as request frequency, click intervals, and access paths, anomalies can be identified. If a certain IP makes an unusually high number of requests in a very short time, or if the requests are too regular (e.g., visiting at fixed intervals), clearly not resembling normal human behavior, it will be flagged as a proxy or bot.</span></p><p style="line-height: 2;"><br></p><p style="line-height: 2;"><span style="font-size: 24px;"><strong>V. Browser Fingerprinting</strong></span></p><p style="line-height: 2;"><span style="font-size: 16px;">Browsers expose a large amount of system information, including time zone, language, Canvas rendering differences, WebGL characteristics, and font lists. This information can be combined into a unique signature, allowing a website to identify the same device even if the IP address changes. For example, if the time zone is set to Beijing Time but the IP shows a location in the United States, such a discrepancy is easily caught by the system.</span></p><p style="line-height: 2;"><br></p><p style="line-height: 2;"><span style="font-size: 24px;"><strong>Summary</strong></span></p><p style="line-height: 2;"><span style="font-size: 16px;">Websites do not rely on a single technique to detect proxy IPs. Instead, they use a combination of methods — </span><a href="https://www.b2proxy.com/faq" target="_blank"><span style="color: rgb(9, 109, 217); font-size: 16px;">HTTP</span></a><span style="color: rgb(9, 109, 217); font-size: 16px;"> </span><span style="font-size: 16px;">header analysis, IP blacklists, geolocation verification, WebRTC/DNS leak detection, port scanning, behavioral analysis, and more — for multi‑dimensional cross‑validation. Understanding these detection mechanisms helps us better comprehend the logic behind online security and, while staying compliant, optimize our own network usage strategies.</span></p>