VPN, proxy, or Tor? Know the difference.
Different routes, different context. Why network indicators belong in separate buckets, and how to weigh them without mistaking privacy for intent.
The network section separates VPN, proxy, and Tor indicators instead of putting them into a single “bad traffic” category. This gives your policy room to consider how the session actually behaves.
Do not confuse privacy with intent.
Someone may be protecting their privacy or using an organization’s network. A connection indicator does not tell you why they chose it. The demo’s VPN check says as much: on its own, a tunnelled connection is context, not a verdict.
Combine the evidence.
A privacy indicator alongside typical account activity should be considered differently from automation, environment tampering, and repeated incentive claims. Keep those reasons visible to the person reviewing the decision.
Keep unknowns explicit.
The source and freshness of network intelligence, as well as detection coverage, need to be defined in your production product. A result that is unavailable should remain unavailable, not be presented as a clean bill of health.
Conceptual policy guidance. No live network lookup runs on this page.
