A click from a datacenter IP address is a genuinely strong signal that no human was involved. A click from a VPN is not. Most click-fraud tools present these as the same finding, and acting on that conflation is how advertisers end up blocking real, paying customers — a mistake with no error message and no complaint, because the people you blocked simply never see you again.
What a datacenter IP actually tells you
Datacenter address ranges belong to hosting providers — the infrastructure that runs servers, not the connections people browse from. AWS, Google Cloud, Azure, DigitalOcean and the rest publish these ranges, which is why they are identifiable at all.
Ordinary consumers do not browse from a datacenter. Their traffic comes from a home broadband line or a mobile carrier. So when a form submission arrives from a hosting range, the realistic explanations are a scraper, a monitoring service, an automation script, or a proxy service reselling server capacity as "anonymous browsing".
This is why datacenter origin is one of the few signals strong enough to act on with reasonable confidence — and it is a large part of what your provider's own invalid-traffic filtering is already catching before you are billed.
Why VPNs are a completely different case
A commercial VPN also routes traffic through infrastructure, which is why naive detection lumps it in with datacenter traffic. But the person at the other end is real, and their reasons are ordinary:
- Corporate networks. Anyone working remotely for a company with a VPN policy appears to browse from their employer's network. In B2B this is not an edge case; it is a meaningful slice of your best prospects.
- Privacy-conscious individuals. VPN use is mainstream now, sold on television, and entirely legal.
- Public Wi-Fi habits. People switch a VPN on at airports and cafés precisely because they were told to.
- Perfectly normal Indian mobile usage. Carrier-grade NAT and operator-level proxying already make mobile traffic look shared and indirect before any VPN is involved.
Block VPN traffic wholesale and you have excluded a slice of your most valuable audience — professionals, remote workers, corporate buyers — to stop a category of fraud that mostly is not arriving that way.
The asymmetry that should govern this decision. Letting one bot through costs you the price of a click. Blocking one genuine buyer costs you the deal, permanently, and you will never know it happened. Those two errors are not equivalent, so the threshold for blocking should not be symmetric either.
How to use the signal properly
Treat network origin as one input among several rather than a verdict on its own. In practice that means three tiers:
- Datacenter origin plus behavioural signals — a hosting-range address that also submitted the form in under two seconds, or filled a hidden honeypot field. Act on this. Two independent signals agreeing is close to conclusive, and neither has an innocent explanation.
- Datacenter origin alone — worth flagging for a human to look at, not worth auto-rejecting. Monitoring tools and legitimate integrations live here.
- VPN origin alone — not actionable. Record it, ignore it, do not let it influence anything.
Where the detection itself is unreliable
Worth knowing before you trust any tool's classification, including ours:
IP-to-network databases go stale. Address ranges are reassigned. A range that was a hosting provider last year may be a residential ISP now.
Residential proxy services exist specifically to defeat this. They route automated traffic through real home connections, often on compromised devices. Traffic from these looks perfectly residential, which means the sophisticated end of the problem is invisible to network-based detection entirely.
That second point is the important one. Network origin catches the unsophisticated attempts. It will not catch anyone who cared enough to spend money on avoiding it, which is precisely the group worth worrying about.
What holds up when the signal does not
Behavioural checks do not care where the traffic came from. A submission completed faster than a human can type was not typed by a human, whether it arrived from AWS, a VPN, or a phone in the next street. A hidden field that only an automated script would fill is equally decisive from any address.
And the measure that outlasts all of it: report real outcomes back to your ad platform. Traffic that never becomes a customer — datacenter, VPN, residential proxy or otherwise — stops attracting budget once your bidding is optimising toward customers rather than form fills. See sending offline conversions to Google Ads. It requires no classification to be correct, which is its main advantage over every method above.