Screening Players For VPNs

Introduction

Example player tried to join the server with a VPN but was disallowed, with an error message indicating to contact Staff if they believe this was a mistake.

Sometimes players will open a Discord Staff Support ticket claiming they have been flagged incorrectly by our VPN/proxy detection service, this guide will show you how to screen these players to determine whether they were flagged incorrectly (false positive) or if they are indeed trying to evade detection.

How to screen a player

In order to determine the liklihood of a player using a VPN or proxy, we check for two things:

• The quality of the IP address
• The Internet Service Provider (ISP)

Below are the steps you should follow to ascertain the two criteria.

Step 1. Fetch the player's IP address

Example player Technofied was flagged for trying to use a VPN or proxy to join the server.

Ask for the player's username if they haven't provided it already. Then, in #antivpn on the Staff Discord server, search for the player's username.

• In this example, player Technofied is the example player
• Technofied's IP address is shown as 104.28.254.140

Step 2. Check the IP address Quality

Next, navigate to the following website address, replacing IP-ADDREESS-HERE with the IP address you found in Step 1.

• https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/IP-ADDRESS-HERE
• Using the prior example, the URL would be https://www.ipqualityscore.com/free-ip-lookup-proxy-vpn-test/lookup/104.28.254.140

Example Player's IP Address returning a Fraud Score of 99 out of 100.

Visiting the website, you can see whether the IP address:

• Is a VPN
• Is a Proxy
• Is Fraudulent

We can see for IP address 104.28.254.140, that it returned an extremely significant Fraud Score of 99. This indicates that the IP address is very likely to originate from a VPN or Proxy.

Step 3. Check the IP address Internet Service Provider (ISP)

Example Player's IP address returning its Internet Service Provider and approximate geolocation data.

Next, navigate to the following website address, replacing IP-ADDREESS-HERE with the IP address you found in Step 1.

• https://whatismyipaddress.com/ip/IP-ADDRESS-HERE

Using the prior example, the URL would be https://whatismyipaddress.com/ip/104.28.254.140

Visiting the website, you can see the origins of the IP address, we are specifically looking at the ISP.

We can see for IP address 104.28.254.140, that the website returned the ISP of Cloudflare Inc.

The Google search result when searching for "Cloudflare Inc".

Googling Cloudflare Inc, we can see that it is NOT a typical Residential Internet Provider, rather a corporate internet services firm.

• This again indicates the player is using a VPN or Proxy
• When Googling an ISP, you are looking to see if they provide household (residential) customers with internet
• If they mostly provide corporate internet services, it is likely the IP address belongs/is in use by a VPN or Proxy Provider

Step 4. Making a determination

Now that you have checked the IP address' quality and Internet Service Provider (ISP), we need to decide whether the player was falsely flagged or not.

In doing so, you should aim to answer the two questions:

• Does the IP address of the player have a good reputation? (Low/no Fraud Score)
• Does the IP address of the player come from a reputable residential Internet Service Provider? (not from a Datacenter, corporate internet provider, etc.)

In the example case of player Technofied, their IP address:

• Has a very problematic reputation, with a Fraud Score of 99
• Belongs to a known corporate services internet firm (who also offers a known VPN - called Cloudflare WARP!)

Sometimes it won't be clear if a person is using a VPN or proxy, or you may want a second opinion. Feel free to ask Technofied (funnily enough) at any time for assistance.

• Sometimes IP addresses may have a terrible reputation but come from a known residential ISP
  • This is very common in developing countries, such as India or Vietnam where large blocks of IP addresses are abused frequently
  • Generally, in this scenario, provided the player originates from a developing country - they are likely not using a VPN
  • If the player originates in a developed country (i.e. United States of America), this is very rare but still possible. You may need to consult Technofied who will look for other indicators to determine whether the IP address may belong to a VPN/proxy service or not
• Sometimes IP addresses have an excellent reputation, but do not come from a residential ISP
  • In these cases, you are looking for whether the IP is blatantly not residential, that is, it originates from a datacenter or obvious corporate firm
  • If the IP address is very clearly corporate/non-residential, you can conclude the player is using a VPN/proxy service still - this is because sometimes some VPN providers take care in acquiring reputable IP address blocks
  • If this is unclear, feel free to ask Technofied again, who will look for other indicators to determine whether the IP address may belong to a VPN/proxy service or not

IMPORTANT

For over 99% of players, they will never be flagged by our VPN/proxy detection service, this means the portion of players we do flag are incredibly small out of the unique players we get on a day to day basis!

As such, do not rush a decision! We prefer being on the safer side, especially as those players who tend to use alternative accounts and proxies tend to have been deported or banned from our server for serious offences.

This system is in place to keep our community safe, and ultimately we won't always get it correct and may falsely flag players, but it is the trade off we make always, for the interests of our wider community.