VPN Traffic: Suspicious or Just Someone at Work?

We recently received a marketing email from an IP intelligence provider. Its message was familiar: your logs contain addresses that look perfectly normal, but some of that clean traffic is actually coming through VPNs.

Cue the dramatic music.

Knowing that an address belongs to a VPN, proxy, or datacenter can be useful. It tells you that the IP address visible to your server may not be the user’s original address. Many unrelated people may share that address, its location may be less certain, and its history may belong to several different users.

What it does not tell you is whether the request is malicious.

The person behind a datacenter VPN address might be testing stolen payment cards. They might also be an accountant on a company laptop, an iPhone owner using a privacy feature, a developer connected to the office, or someone who simply does not want every network between the sofa and your website building a browsing profile.

The same uncertainty exists outside a datacenter. The passenger beside you on a bus could be a hacker. A cybercriminal could be staying in the next room and using the same hotel Wi-Fi. Curiously, we receive very few newsletters urging everyone to monitor buses and hotels with extreme suspicion. Sharing infrastructure with a bad actor does not make the other passengers, guests, or VPN users suspicious by association.

So, should VPN traffic frighten you? Usually not. It provides context, not a panic button.

This article does not discuss using VPNs to work around internet censorship. That subject involves different legal, safety, and regional considerations and is outside our scope here.

VPNs are already normal

There is no perfect worldwide count of VPN users. Surveys use different definitions, countries, age groups, and sampling methods. Some respondents count a corporate tunnel, some count a privacy service, and others use a relay built into a browser without thinking of it as a VPN at all.

Even conservative figures show that VPN use is not unusual. A 2025 survey of 1,009 US adults found that 32% currently used a VPN. Seventeen percent of all respondents used one exclusively for personal reasons, while others used one for work or for both purposes. The researchers also note an entertaining limitation: their survey platform did not allow access through a VPN, which may have caused VPN users to be undercounted.

One survey is not a global census, and the exact percentage will vary by market. The useful conclusion is simpler: many ordinary customers use VPNs for routine work and browsing. Treating every one of them as hostile creates false positives by design.

VPN and relay technology is also built into familiar products used by millions of non-specialists. Many users do not think of it as “using a VPN.” They open an application or browser, switch on a safer or more private mode, and continue with their day.

Cloudflare WARP can encrypt and route device traffic through Cloudflare’s network. Its consumer client is easy to enable, and Cloudflare explicitly says WARP is designed for a more private and robust connection, not anonymity or pretending to be in another country.

Opera includes a free browser VPN that changes the address websites see and requires no separate extension. On some platforms and modes it is more precisely a browser proxy because it protects browser traffic rather than every application on the device. Your IP intelligence feed may still describe the resulting request as VPN, proxy, hosting, or anonymized traffic.

Apple’s case is especially useful for website operators. iCloud Private Relay is not a conventional, device-wide VPN. It protects Safari browsing, DNS queries, and some related traffic through two separate relays, preventing one party from seeing both the user and the destination. The website sees a temporary relay address instead of the original client address.

Apple’s guidance for web servers says that traditional IP-based fraud detection may need adjustment to avoid affecting legitimate users. It recommends treating relay addresses more like carrier-grade NAT or large enterprise addresses because several users may share one IP. That is remarkably direct advice from the company operating the privacy service: the shared exit address is context, not identity.

We see the same pattern from the infrastructure side. Customers use VDS instances as private and corporate VPN endpoints. Traffic leaving one of those servers has a datacenter address because the VPN runs in a datacenter. That describes the server’s location, not the intentions of the people connected through it.

The corporate VPN never clocks out

For many employees, a VPN is not an app they remember to start at an airport. It is part of the managed device configuration.

Corporate tunnels protect connections to internal systems, apply access policies, route traffic through company security controls, and give remote devices access to resources that are not exposed directly to the internet. NIST’s guide to enterprise telework and remote access describes encrypted tunnels as a standard way to protect the confidentiality and integrity of traffic between a client and a VPN gateway.

The connection can also be automatic. Microsoft’s Always On VPN can connect when the user signs in, the network changes, or the screen turns on. Administrators can trigger a tunnel for selected applications or company domains, or route broader device traffic through it. The employee may not know which path a browser request followed, and generally should not need to know.

This is not an obscure edge case. The UK government’s Cyber Security Breaches Survey 2025/26 found that 36% of surveyed businesses had a rule or control involving VPN use for staff connecting remotely, up from 31% in the previous survey.

If an employee visits your shop during lunch, your logs may show the exit address of a corporate gateway in a datacenter. Blocking it because it is not a residential ISP does not defeat a criminal mastermind. It prevents someone from ordering a keyboard before the next meeting.

Personal VPNs have left the nerd cave

People also keep personal VPNs enabled during completely uneventful days. They use them on home broadband, mobile networks, shared Wi-Fi, hotels, trains, offices, and university networks. Travel is a common reason, but it is hardly the only one.

A VPN encrypts traffic between the device and the VPN endpoint. This reduces what the local network and internet provider can learn from that part of the path. It also replaces the source address seen by websites with the VPN exit address. For users, that can mean less IP-based tracking, less precise location exposure, safer use of networks they do not manage, and consistent access to company, home, or subscription resources while moving between networks.

Most web traffic already uses HTTPS, which protects the content exchanged with a website. That is essential, but it does not make the surrounding network metadata disappear. A properly configured full-tunnel VPN adds protection for the path to its gateway and hides the destination from the local access network. It is another layer, not magic invisibility paint.

This is also where “a VPN makes the user not the product” needs a careful footnote. A trustworthy VPN can reduce the opportunity for an ISP, Wi-Fi operator, or other local intermediary to profile a user’s activity. It does not remove trust from the system. It moves some of that trust to the VPN operator. Users still need to choose a provider with a credible privacy model, sensible data handling, secure software, and a business model that does not turn “free privacy” into an unusually creative contradiction.

A large public VPN service may itself be in a position to profile users, depending on its architecture, policies, and logging. In practice, people often entrust much of their digital life to an application they found in an app store after reading three reviews and admiring the shield-shaped icon. Reputation, independent audits, open-source clients, ownership, and a clear privacy policy matter.

An even more controlled option is to run your own VPN, for example on a small ITLDC NVMe VDS. You choose the VPN software, configuration, updates, access rules, and logging. There is no public VPN operator acting as a black box between your device and the internet, and your exit address is not shared with thousands of strangers.

Self-hosting does not remove every party from the trust model. The tunnel between your device and the VDS is encrypted, and the hosting provider does not operate the VPN service or receive its tunnel keys. Once traffic leaves the VPN endpoint, HTTPS and other end-to-end encryption still protect its content. Routing metadata and any traffic sent without end-to-end encryption may remain visible on the onward path, just as they would from any internet connection. A self-hosted VPN gives you meaningful control, not a special exemption from how networks work.

What the label knows, and what it does not

An IP intelligence result such as vpn=true, hosting=true, or privacy_service=true can tell you something useful about the network path. Before treating it as a special danger, however, consider carrier-grade NAT, or CGNAT. Mobile operators and broadband providers have used it for years to place many customers behind a smaller pool of public IPv4 addresses.

From a website’s point of view, most of the supposed warning signs look familiar. With either a shared VPN exit or CGNAT:

• the visible address may represent many unrelated users rather than one person or device;
• IP geolocation may be approximate or represent the gateway location;
• IP-based history may describe other people who used the same address;
• the address assigned to a particular user may change.

These are real limitations. They weaken the IP address as a stable identifier, whether the shared infrastructure belongs to a VPN company, a mobile carrier, or a broadband provider. Yet mobile networks are rarely advertised as the source of all internet misery, and their customers do not automatically receive a black mark for appearing behind CGNAT.

A VPN label still identifies a different type of network path, and that distinction can matter in a wider risk model. It does not change the basic logic: a shared address is weak evidence about an individual user. It is not evidence of fraud.

The opposite assumption is equally dangerous. A residential address is not a certificate of good behaviour. Compromised home routers, malware, residential proxy networks, carrier-grade NAT, and ordinary dishonest users all exist. Traffic from student accommodation can be perfectly harmless, but the word residential does not bless every packet with youthful innocence.

IP categories are observations and estimates about infrastructure. Intent has to be inferred from behaviour and context.

The datacenter is not the villain

VPN detection is valuable when it corrects an assumption: the address in your logs may identify a shared exit service, not the person making the request. Trouble begins when that useful fact is promoted into a verdict.

Ordinary people use personal VPNs for privacy and safer networking. Employees use corporate tunnels that connect automatically. Apple, Cloudflare, Opera, and many other familiar companies make relays or VPN-like protection inexpensive, free, or nearly invisible to the user. Datacenter-origin traffic is therefore part of the normal internet, not a separate lane reserved for attackers.

Blanket blocking VPN or datacenter traffic is usually foolish. It does not provide meaningful security by itself: somebody planning abuse can use a residential proxy, a compromised device, or an ordinary ISP address. What it can do very effectively is shrink your audience by rejecting employees, privacy-conscious customers, and people who enabled a protection feature without even knowing that their traffic would leave through a relay.

Behavioural analysis is a different matter. It looks at what a visitor actually does, not whether an IP database attached a frightening label to the network path.

A VPN can hide a user’s home address. It cannot tell you whether they came to buy your product or steal it. Fortunately, that is what the rest of your security system is for.