What is Network Intelligence, and how is it different from Device Intelligence?

Network Intelligence is the connection-side capability that combines IP intelligence, the connection fingerprint, and the real IP behind a mask, returning anonymity signals like VPN, proxy, Tor, Privacy Relay, and datacenter. Device Intelligence is the device-side capability that builds a persistent identifier from the hardware, browser, and operating system. ShieldLabs runs them as a pair and returns both the identifiers and the network signals in one API response on the first visit, where a disagreement between the device and the connection is itself one of the strongest evasion signals.

How does ShieldLabs detect a proxy or VPN?

ShieldLabs detects a proxy or VPN by reading several independent layers of the connection and returning a named anonymity signal instead of a single yes-or-no flag: the IP is checked against live reputation databases, inconsistencies are caught between the device, the OS, and the browser, and an active check looks for the real IP behind the mask. ShieldLabs flags a connection as masked when those checks agree, which produces up to 99% accuracy with a low false-positive rate, and returns the anonymity signal and a 0 to 100 risk score in one response.

Do you actually see the real IP behind a VPN or proxy?

In many cases, yes. Beyond the IP-reputation and connection-fingerprint layers, an active connection check reveals the originating IP behind an anonymizing connection. ShieldLabs treats the real IP as direct evidence of a mask when it surfaces, and when the real IP cannot be reached, that silence is itself a signal that raises the score rather than passing quietly.

Can residential proxies and rotating IPs beat the detection?

Residential proxies are the hardest case, and ShieldLabs does not claim they are trivial, which is exactly why no single layer is trusted on its own. A pure IP-database lookup misses residential and freshly rotated IPs that look clean, so the passive connection fingerprint and the active real-IP check catch what a reputation list alone cannot. ShieldLabs says up to 99% accuracy, not 100%, includes residential-proxy detection on the self-serve tier, and always shows which network layers fired so a threshold can be tuned.

Can you tell a datacenter proxy from a residential one?

Yes. Proxy server detection reports the connection type instead of collapsing it into one flat flag, so ShieldLabs flags a datacenter proxy directly because the IP belongs to a known hosting provider, while a residential proxy routes through a real consumer IP that looks clean to a blocklist. ShieldLabs identifies the residential case through the connection fingerprint and the active real-IP check rather than a reputation lookup, so a datacenter proxy at checkout can be treated differently from a residential proxy on a logged-in session.

Will this block all real VPN users?

No. ShieldLabs identifies anonymized connections and never blocks anything: it returns a VPN, proxy, Tor, or datacenter anonymity signal plus a risk score with Details, and the team writes the rules. A logged-in customer on a corporate VPN can be allowed while a fresh signup on a datacenter proxy is flagged. ShieldLabs bases the VPN signal on more than a single blocklist, and reports Privacy Relay separately, so legitimate VPN and privacy-conscious users are far less likely to be mislabeled.

How is this more accurate than a simple VPN or proxy blocklist?

A blocklist or GeoIP database is a single point of truth that goes stale and produces false positives, so ShieldLabs treats it as one input among several, alongside a passive connection fingerprint and an active real-IP check. The VPN signal fires when those checks agree, which produces up to 99% accuracy with a low false-positive rate. ShieldLabs hands back every signal with explainable Details showing why it fired, rather than a feed the team has to operationalize and a black-box flag it has to trust.

What does the Network Intelligence API return for each connection?

The Network Intelligence API covers VPN detection, proxy detection, Tor detection, datacenter, and Privacy Relay, returning a named anonymity signal for every connection plus a network fingerprinting result that reads the network-side operating system. The same call doubles as an IP geolocation API and an IP reputation API, so ShieldLabs returns location, reputation, and the masking verdict in one REST response with a 0 to 100 risk score instead of stitching together several vendors, the same depth that powers proxy and VPN detection.

Network Intelligence

Detect any level of anonymity with IP intelligence

Catch every VPN, proxy, and masked connection in your traffic, with ready-made anonymity signals and up to 99% accuracy

Start Free

ShieldLabs Network Intelligence resolves a connection through IP reputation, connection fingerprint, and an active real-IP check into a single proxy signal

Prevent fraud at the source

Cut the abuse that rides in on masked connections

Stop blocking real customers

Tell genuine privacy-tool users apart from fraudulent traffic

No clean IP slips past

Catch the masked connections a static blocklist waves straight through

Cut your data costs

Skip the IP-data stack you'd otherwise buy and maintain yourself

Spot every kind of masking

Read across every network layer, on every visit, so nothing masked slips through

Accurate detection

Anonymous proxy detection plus VPN, Tor, Privacy Relay, datacenter, and IP reputation, at up to 99% accuracy

Detection of any anonymity

The inconsistencies a mask leaves across the IP, the network, the device, the OS, and the browser

Real IP behind the mask

The true connection that anonymized traffic is hiding

True location

Where a visitor really is, not where a mask says, with location spoofing caught

More than just an IP lookup

Accurate Identification

Identify returning visitors and users across sessions, cleared cookies, incognito mode, and rotated IP

Anonymity Signals

Detection of VPN, proxy, Tor, anti-detect browser, IP reputation and other anonymity signals on every visit, with up to 99% accuracy

Risk Score

A ready-to-use score reflecting the risk of each visit, with the weight of every signal behind it

Ready-Made Patterns

Detection of the hidden connections between accounts that may signal multi-accounting, account farms, and more

Real-Time Analytics

See how much of your traffic is masked, with an overall quality score and a breakdown of the sources sending your visits

Catch the fraud hiding in every connection

Proxy and VPN-masked fraud

Flag checkout traffic routed through a proxy or VPN, even when the IP looks clean

Account takeover from a new network

Surface logins arriving on a masked or out-of-pattern connection

Residential-proxy multi-accounting

Expose repeat signups hiding behind rotating residential proxies

Location spoofing in payments

Catch the IP and timezone mismatch behind a faked location

Start detecting any level of masking in 5 minutes

Easily integrate into any signup, login, or checkout flow

1
Create your account
Get 5,000 free identifications
2
Install the snippet
It identifies every visitor and returns their anonymity signals and a risk score
3
Check your traffic quality
See how much of your traffic is masked, with an overall traffic score
4
Use the API and Webhooks
Apply the risk score and anonymity signals in your rules to stop fraud and abuse