Can online casinos detect a VPN?
Yes, online casinos can often detect a VPN: the player's IP address can be matched against VPN provider lists, the public Tor exit list and the networks of hosting companies, and the browser's time zone can be compared with the IP's country. Detection isn't perfect, so the better question for an operator is what to do with a VPN sign-up once you've spotted it.
Last updated
How the detection works
Every sign-up arrives from an IP address, and a lot is known about IP addresses:
- VPN provider lists. Commercial VPNs run their servers on known address ranges. Lists of those ranges are compiled and refreshed, and a match is a strong signal.
- The Tor exit list. The Tor Project publishes the addresses of its exit relays, so Tor traffic is the easiest to recognise.
- Network ownership. Every IP belongs to a network (an autonomous system, or ASN) with a registered owner. If the owner is a hosting or cloud company, the visitor is on a server, not a home connection. Many cheap VPNs and proxies run there.
- Time zone versus IP country. A browser reports its time zone. A browser set to one country's time zone, connecting from an IP in another, suggests a borrowed location.
Where detection falls short
Be honest with yourself about the gaps, so you don't over-trust a clean result:
- Residential proxies route traffic through ordinary home connections and look like a normal broadband customer. See what a residential proxy is.
- New VPN servers take time to show up in lists.
- IPv6 coverage in VPN lists is thinner than for IPv4.
- Privacy features such as iCloud Private Relay hide an ordinary user's IP without any intent to cheat.
So a clean IP doesn't prove a clean sign-up, and a flagged IP doesn't prove fraud.
What to do with a VPN sign-up
Separate two different questions.
Is the player allowed to play from where they are? That is a licensing question. If your licence restricts which countries you can serve, your geolocation and blocking rules follow from it, and a VPN doesn't change that. Check your licence conditions.
Is this a fraud risk? Many VPN users are privacy-minded, travelling, or on a work laptop. Blocking all of them loses real customers. A better default is to let the sign-up proceed to a hold: the account waits for a look, and if you approve it, the player verifies their identity before any bonus or payout. Combine the IP with the rest of the sign-up. A VPN plus a repeat Gmail inbox is a very different case from a VPN plus a long-standing personal address.
How InlineShield handles VPN, Tor and datacenter sign-ups
For every sign-up, InlineShield looks up the IP address (location and network owner from DB-IP data, Tor exits from the public list) and checks the browser's time zone against the IP's country. With the default rules:
| Signal | Default handling |
|---|---|
| VPN provider IP | Held for review; switchable in Settings › Rules |
| Datacenter or hosting IP | Adds risk and holds; switchable |
| Time zone doesn't fit the IP country | Held for review; switchable |
| Tor exit node | A heavy risk weight: held at least, blocked with other signals |
When your team approves a sign-up held for a VPN, datacenter IP or time-zone mismatch, the signup.approved webhook recommends require_kyc. Apple's published iCloud Private Relay ranges are removed from the VPN list, though Relay traffic that leaves through Cloudflare's network can still be held as a datacenter IP. If a value can't be worked out, such as an unknown IP country, it never holds a sign-up. Details on VPN, Tor and datacenter detection; for the gaming context, see online casino bonus abuse.
Frequently asked questions
Is using a VPN at an online casino illegal?
Using a VPN is legal in most places, but casinos' terms often forbid using one to get round location restrictions, and winnings can be withheld if that happens.
Should casinos block all VPN users?
Only where the licence demands it. For fraud purposes, a hold with an early identity check keeps the honest VPN users.
Do you use device fingerprinting to find VPN users?
No. InlineShield works from the IP address, the browser's own signals and the sign-up details, without device fingerprinting.
Can I check an IP address now?
Yes, with the free IP risk checker. It shows whether an IP is a VPN, Tor exit or datacenter, with its network and country.
Screen your next sign-up for free
The Free plan includes 1,000 screenings a month. Create an account, add your keys and see real verdicts on your own traffic. No card, no sales call, no setup fee.