In the coming days, we’re rolling out an accuracy improvement to how we detect VPNs on residential and other non-hosting IP addresses.
The issue
Part of our VPN detection relies on internet-wide scans that check whether known VPN ports are open on an IP address. When a scan finds this on a handful of addresses within the same network block, common with ISP-issued routers that have VPN features built in, we would sometimes extend the VPN tag to neighboring addresses in that block, even ones we had no direct evidence for.
This occasionally mislabeled addresses that had nothing to do with a VPN, such as a home or small business sharing a network with a router that happened to expose a VPN port.
The change
We’re tightening this so a VPN tag is only applied where we have direct evidence for that specific address, rather than inferring it from nearby IPs.
This affects only low-confidence, scan-based inference on non-hosting networks. VPNs detected through stronger signals, or hosted on data center infrastructure, are unaffected.
What to expect
As a result, the number of VPN-tagged IPs in the Privacy dataset will drop meaningfully (roughly 20-25%), while total dataset size is essentially unchanged. This is a deliberate reduction in false positives, not a loss of detection capability.
It’s the first step in an ongoing effort to improve precision in our VPN classification, with more refinements planned.
If you track VPN counts over time, expect to see this drop reflected once the change ships.
We view this as a net improvement in data quality, and are happy to answer any questions about the methodology.