VPN service
Attribute an exit to the commercial or privacy service observed using it.
Commercial VPN and tunnel context
Identify VPN exits without relying on datacenter lists.
VPN traffic can exit through cloud servers, leased ISP space, residential addresses, or infrastructure shared across several brands. Synthient returns the observed VPN provider and supporting network fields so your team can apply a policy appropriate to the service and action.
The detection gap
Why address-only rules fall short.
A hosting ASN is not the same thing as a VPN, and many VPNs deliberately mix infrastructure types. Generic datacenter rules create false positives while missing services that use residential or ISP ranges.
Infrastructure type
Separate hosted, ISP, residential, mobile, Tor, and other network footprints.
Ownership research
Use documented operator, jurisdiction, acquisition, and related-brand findings when verified.
Observation time
Know whether an exit was seen recently enough for the decision in front of you.
Implementation
Use evidence where the decision happens.
Use the API to enforce geography-sensitive access, review suspicious authentication, or add context to fraud scoring. Keep the VPN result separate from maliciousness: a privacy tool may be legitimate, while the surrounding account and behavior evidence determines the response.
Operational outcomes
- Distinguish VPN services from ordinary cloud hosting
- Recognize residential and ISP VPN exits
- Apply service-specific policy
- Explain decisions with ownership and recency context
Questions
What teams ask before integrating.
Does a VPN match mean the user is malicious?
No. A VPN match identifies the network relationship. Use it with account, device, location, authentication, and behavioral evidence.
Can the API detect VPN exits on residential networks?
Synthient supports mixed infrastructure classifications and can report residential or ISP context when the observed evidence supports it.