HomeAPI DocsBlogContact
Log InGet Started
VPN & Proxy Detection — United States

Detect VPN, Proxy & Bot Traffic from United States

Sentinel scores every visitor's network in real time — flagging VPN exit nodes, residential proxies, datacenter ASNs, and headless browsers originating from the United States. Free API. Under 40ms. No CAPTCHAs.

< 40msResponse time globally
195+Countries covered
Free1,000 req/hr, no credit card
400+Device + network signals

Why United States traffic needs special scrutiny

Datacenter ASN concentration

United States is high concentration of datacenter ASNs (AWS, Google Cloud, DigitalOcean) routinely used for credential stuffing and trial abuse.

Residential proxy resale

Consumer ISP ranges in United States are routinely sold through residential proxy networks like ShadowNode and Bright Data. These IPs look real but rotate every few minutes — a clear bot signature once you know what to look for.

VPN exit-node clustering

The same handful of hosting providers dominate VPN exit nodes in United States. Sentinel maintains live mappings of these ranges so a new IP from a known VPN ASN is flagged within seconds of going live.

Antidetect browser usage

Multi-accounting fraud against US-targeted SaaS, fintech, and e-commerce increasingly uses Kameleo, GoLogin, or AdsPower to spoof device fingerprints. Sentinel scores these at the device layer, not the IP layer.

What Sentinel detects for United States traffic

  • Every major VPN provider's US exit nodes (NordVPN, ExpressVPN, ProtonVPN, Mullvad, Surfshark, and 40+ more)
  • Residential proxy networks reselling consumer US IPs (ShadowNode, Bright Data, Smartproxy, Oxylabs)
  • Datacenter ASNs commonly used for automation (AWS, GCP, Azure, OVH, Hetzner, DigitalOcean, Vultr, Linode)
  • Tor exit nodes and known anonymous relays advertising US geolocations
  • Headless browsers (Puppeteer, Playwright, Selenium) and antidetect tooling driving sessions from United States
  • Country-spoofing — when a session claims to be in United States but the network telemetry says otherwise

One API call. Bearer token. Done.

// Score any session — country-level signals included
const r = await fetch('https://sntlhq.com/v1/evaluate', {
  method: 'POST',
  headers: { 'Authorization': 'Bearer sk_live_...' },
  body: JSON.stringify({ token: sentinelToken })
});
const { decision, country, network } = await r.json();
if (country === 'US' && network.vpn) blockOrChallenge();
Fraud Brief Once a month · no spam · unsubscribe anytime
Get the new VPN, proxy & bot patterns we see each month
Short, technical breakdowns of what fraudsters changed last month — written for engineers, not marketers.

Stop US VPN, proxy & bot fraud today

Free tier. 1,000 API requests per hour. No credit card. Detects VPN, residential proxy, datacenter, and bot traffic from United States and 195 other countries.

Stop fraud before it hides — try Sentinel free. 1,000 API requests per hour, no credit card.