Can a VPN be detected if the IP is not on any list?

Often, yes. A browser timezone or language that does not fit the IP country, or a WebRTC leak, can reveal it. Residential proxies are harder and need device and behaviour signals.

Why did the offerwall reverse conversions I already paid?

Networks check traffic after the fact. If a conversion came from a VPN or a country the advertiser did not target, it gets reversed. Checking at offer click and holding cashouts for new accounts reduces how much you pay for those.

Is iCloud Private Relay a VPN?

It hides the IP like a VPN, but it keeps the user in their own region and is used by ordinary people. Treat it as low risk and rely on other signals.

How to stop VPN fraud on your offerwall without blocking real users

Q: Should I block all VPN users on my GPT site?

Usually not. Block Tor and datacenter traffic at the offer wall, ask consumer VPN users to switch off before doing offers, and review VPN use at cashout. Blanket bans cost you honest users.

VPN traffic is the most common reason offerwall networks complain about a publisher. This guide explains why users do it, how to tell the dangerous traffic from the harmless kind, and where in your funnel to act.

Short answer

Do not ban every VPN user: block Tor and datacenter IPs at the offer wall, ask consumer VPN users to switch off before doing offers, and review VPN use at cashout. VPNs and proxies are exposed by comparing the IP with the browser timezone, language and WebRTC data, at every step where money moves.

High risk: Tor, datacenter or hosting IPs, and residential proxies.
Low risk: Privacy relays such as iCloud Private Relay, and corporate VPNs.
Not a VPN: CGNAT on mobile data: never block on it alone.
Most useful check: A browser timezone that does not match the IP country.
Where geo fraud happens: The offer click: hide high-paying walls while a VPN is on.

Why offerwall users hide behind VPNs

Offers pay very different amounts depending on the country. An app install that pays a few cents in one market can pay several dollars in the United States or the United Kingdom, because the advertiser is paying for users in that market. A VPN lets a user pretend to be in the high-paying country.

The advertiser does not want those users. When the network checks the traffic, it reverses the conversions, and you have usually already credited the user. Repeat it often enough and the network lowers your payouts, limits the offers you see or removes your site.

Not all VPN traffic is equal

Treating every hidden IP the same way leads to either too many false positives or too little protection. It helps to split the traffic into types and decide on each one.

Type	What it is	Risk on a rewards site	Sensible default
Tor	Anonymity network with public exit nodes	High	Block offers and cashouts
Datacenter or hosting IP	Cloud servers, cheap VPS, most VPN servers	High	Block offers, review cashouts
Consumer VPN app	Paid or free VPN on a phone or PC	Medium to high	Hide offers until it is off
Residential proxy	Traffic routed through real home connections	High, hard to see	Rely on device and behaviour
Privacy relays	Built-in browser or OS privacy features	Low	Allow, watch other signals
Corporate VPN	Employees on a company network	Low	Allow, watch other signals
CGNAT on mobile data	Many customers behind one carrier IP	Not a VPN	Never block on this alone

Signals that expose a VPN or proxy

IP lists are the starting point, not the whole answer. The best results come from comparing what the network says with what the browser says.

Hosting ASN. The IP belongs to a hosting provider rather than a consumer internet provider. Real users rarely browse from a data center.
Known VPN and Tor lists. Public Tor exit lists and VPN server ranges catch the easy cases.
Timezone mismatch. The browser says Asia while the IP says New York. This is one of the most useful signals because users rarely think to change it.
Language mismatch. A browser set only to a language that is uncommon in the IP country is worth a second look.
WebRTC leaks. Some VPN setups leak the real IP through WebRTC, revealing a different country.
Country changes. An account created in one country that cashes out from another, or hops between countries daily.

Where to check: every step, not only signup

Many sites check the IP once at signup and never again. Farmers know this: they sign up clean and switch the VPN on later. Check at each step where money moves.

Signup. Catch Tor and datacenter IPs and log the country the account starts in.
Offer click. This is where geo fraud happens. Checking here lets you hide offer walls from VPN users instead of paying for conversions the network will reverse.
Conversion. When the postback arrives, compare the conversion with the account history. A conversion from a different country than the click is a warning sign.
Cashout. The last and most important check. Look at the whole account, not only the current IP.

Keep the result of each check with the event. When a network questions a batch of conversions, you can show which clicks came through a VPN and what you did about them. That history is also what lets you spot an account that signs up clean and only switches the VPN on for offers.

A VPN policy that does not hurt real users

Plenty of honest users run a VPN out of habit. The goal is to stop VPN earnings, not to punish people for privacy. A good policy is clear, predictable and explained on the page.

Ask, do not ban. Show a friendly message such as: turn off your VPN to see offers. Most honest users comply and the fraud simply stops paying.
Block Tor and datacenter IPs at the offer wall. They are rarely legitimate for offer completion.
Review consumer VPN use at cashout instead of banning automatically. Look at whether the earnings came while the VPN was on.
Allowlist when needed. A known good user on a corporate VPN should not be punished every week.
Write it in your terms. State that earnings made through a VPN or proxy can be reversed. It makes denials easier to explain.

Residential proxies: the hard case

Residential proxies route traffic through real home connections, often from people who installed an app that shares their bandwidth. The IP belongs to a normal internet provider, so IP reputation services frequently see nothing wrong.

What still works is everything that is not the IP. The device does not change when the proxy does. The browser timezone often does not match. The accounts cash out to related addresses and complete offers at similar speeds. That is why device and behaviour checks matter more every year.

Many accounts, one device, each arriving from a different home IP in the same country.
IP country changes between the offer click and the conversion of the same offer.
Offer timing that is identical across accounts, down to the minute.

How CashoutGuard automates it

CashoutGuard checks the network on every event you send: signup, login, offer click, conversion and cashout. Each result lists the reasons in plain codes you can act on.

ip_tor, ip_vpn and ip_datacenter for known anonymity networks and hosting providers.
timezone_mismatch and webrtc_ip_leak for browsers that disagree with their IP.
country_changed for accounts that move between countries.
Device, payout address and offer speed signals for the residential proxy cases IP lists miss.

Rules let you apply the policy above without code: make a reason always send users to review (for example ip_datacenter), switch one off, or change its weight, and give cashouts a lower block threshold than signups. Start in shadow mode, see how many of your cashouts would be affected, then enforce. The docs show the full list of reason codes.

2026-10-01