8 Popular VPNs Through a Detection System's Eyes

You Paid for Invisibility

Five bucks a month. A little padlock icon. A green badge that reads Protected. You crack open your browser, dead sure your traffic flows through an encrypted tunnel somewhere in Zurich. Invisible, you reckon.

Here's what we see.

Your first TCP SYN lands with an MTU of 1420. WireGuard. IP sits in M247's datacenter in Bucharest. DNS resolver lives in Finland while the exit node sits in Romania. Edge RTT clocks in at 23ms for an address that claims to be across the ocean. WebRTC STUN handed back an srflx candidate carrying your home IPv4 address. Six signals. You haven't loaded the page yet.

WHOX doesn't sell VPNs. WHOX doesn't earn affiliate kickbacks. WHOX is the system websites use to spot you. What follows shows what the other side picks up when you flip on one of eight well-known VPN services.

TL;DR: All eight VPNs get flagged through datacenter IP, WHOX check A03. Mullvad and Ivpn are the toughest to catch with layered detection. NordVPN and Surfshark block leaks well, yet their IP ranges are mapped everywhere. CyberGhost is the most readable of the bunch. No VPN shields you from TunnelVision, CVE-2024-3661, or Port Shadow, PETS 2024. None hide the MTU fingerprint of their protocol. A VPN isn't an invisibility cloak. More like a raincoat. Fine for drizzle. Useless against X-rays.

How WHOX Spots VPNs

VPN detection doesn't flip like a switch. No single field screams VPN. Detection works like stacking evidence on a scale.

MTU = 1420? Could be a VPN. Could be some quirky router setup. Weight: 0.4.

MTU = 1420 plus the IP belongs to a datacenter? Weight: 0.7.

MTU = 1420 plus datacenter plus DNS resolver in another country plus Edge RTT that doesn't match geolocation plus a JA4 hash typical of a Linux box while the User-Agent says Windows? Weight: 0.95.

WHOX stacks 20+ signals across the A axis for anonymizers and the C axis for consistency. Each signal adds or strips weight. Final Trust Score is a weighted probability. Passing one test means nothing.

Core checks tied to VPN detection:

Code	What it checks
A02	VPN detection, composite
A03	Datacenter IP
A05	JA4/JA3 TLS fingerprint
A06	MTU/TTL tunnel pattern
A07	Edge RTT
A09	WebRTC leak
A10	DNS resolver country
A11	IPv6 leak through VPN
A31	VPN protocol: WireGuard, OpenVPN, etc.
A38	DNSBL blacklist
C07	DNS country ≠ IP geo
C09	TTL and MTU and RTT anomaly

What We Test: 7 Leak Types

1. MTU Fingerprint: A06, A31 WireGuard = 1420. OpenVPN = 1400-1420. IPSec/IKEv2 = 1438. Bare metal = 1500. Server reads this off the very first SYN packet, before the page starts to load. More on what fires before JS runs —

2. IP and Reputation: A02, A03, A38 Does the IP belong to a datacenter? Listed in a DNSBL? How many other VPN users share that same address?

3. DNS Leaks: A10, C07, A13, A22 Resolver in one country, exit IP in another. Classic tell. DoH auto-translation and DoT leak too. Why DoH won't save you —

4. WebRTC Leaks: A09 Host, srflx, and relay candidates in SDP. One srflx candidate carrying your real IP and the VPN is worthless. Full WebRTC leak breakdown —

5. IPv6 Leaks: A11 VPN tunnel runs IPv4. Your machine has IPv6. IPv6 requests skip the tunnel and go straight out. 20% of VPNs tested by TheBestVPN.com leaked this way.

6. TLS/HTTP Fingerprints: A05, A18, A71, C12 JA4 hash, H2 SETTINGS frame, HTTP header order. A VPN doesn't touch your browser's TLS fingerprint, yet the VPN node's server setup sometimes shifts values that shouldn't change. Server-side signals —

7. Network Consistency: A07, C09 12ms Edge RTT to an IP claiming to be in Australia. TTL doesn't match the claimed OS. MTU plus TTL plus RTT together paint a picture the VPN can't control.

The 8 VPNs: Results

	NordVPN	ExpressVPN	Mullvad	Surfshark	ProtonVPN	Ivpn	CyberGhost	PIA
Protocols	NordLynx/WG, OpenVPN	Lightway, OpenVPN	WireGuard, OpenVPN	WireGuard, OpenVPN, IKEv2	WireGuard, OpenVPN, Stealth	WireGuard, OpenVPN	WireGuard, OpenVPN, IKEv2	WireGuard, OpenVPN
Kill switch	Good: app and system	Good	Excellent, always-on	Good	Good, permanent option	Excellent, firewall-based	Fair	Good, advanced
IPv6	Blocks	Blocks	Blocks	Blocks	Blocks	Blocks	Blocks	Blocks
DNS leak	Own DNS	Own DNS	Own DNS	Own DNS	Own DNS	Own DNS	Own DNS	Own DNS
WebRTC	Manual setup	Manual setup	Blocks on desktop	Manual setup	Manual setup	Blocks	Manual setup	Manual setup
Split tunneling	Yes, DNS leak risk	Yes, confirmed DNS leak	No	Yes via Bypasser	Yes	No	Yes via Smart Rules	Yes, per-app
MTU resistance	No	Partial via Lightway	No	No	No	No	No	No
DC IP detection	Easy	Easy	Medium	Easy	Medium	Medium	Easy	Easy
TunnelVision	Vulnerable	Vulnerable	Partial on Linux	Vulnerable	Partial on Linux	Partial on Linux	Vulnerable	Vulnerable
Port Shadow	Vulnerable	Vulnerable	Firewall rules	Vulnerable	Vulnerable	Firewall rules	Vulnerable	Vulnerable
Audit	Deloitte 2024	Cure53 2022, KPMG 2023	Cure53 2024	Deloitte 2023	Securitum 2024	Cure53 2023	Deloitte 2022	Deloitte 2022
WHOX detection	Medium	Medium	Hard	Medium	Medium	Hard	Easy	Medium

Deep Dive: What Stands Out

NordVPN

Market leader, with all the weight that brings and all the scrutiny it invites. NordLynx wraps WireGuard in double NAT, making it harder to match traffic flows between users on the same server. Kill switch is solid, both app-level and system-level modes. DNS leaks get stopped by their own resolvers. NordVPN's IP ranges live in every database on the planet, though. A03 fires every single time. MTU 1420 gives away WireGuard through A06. Split tunneling on Windows opens DNS gaps that C07 catches without breaking a sweat: some lookups go through the tunnel, others slip out to the ISP resolver. Deloitte's 2024 audit covered the no-logs policy, not the client code. For everyday users, NordVPN plugs the obvious holes. For WHOX, it's a mid-tier target. Known IP, readable MTU, yet we don't see WebRTC or IPv6 leaks.

ExpressVPN

Lightway is a custom protocol built on wolfSSL. Lighter and faster than OpenVPN, yet less widespread, which by itself can flag on DPI. Lightway's MTU drifts slightly from stock WireGuard, making A06 a bit trickier though far from beaten. Two audits on file: Cure53 in 2022 for the browser extension, with Lightway itself audited by Cure53 in 2021, and KPMG in 2023 for no-logs. Here's the kicker, though. ExpressVPN's split tunneling on Windows had a confirmed DNS leak. Queries slipped out to the ISP resolver while split tunneling was on. Disclosed in February 2024. Site sees an exit IP in Germany while the DNS resolver sits in New Jersey. WHOX catches this through A10 plus C07 on autopilot. ExpressVPN became the textbook case for why split tunneling breeds DNS chaos.

Mullvad

Only VPN on this list that tangles up WHOX across several axes at once. Pay with crypto or cold cash in an envelope. No accounts. Just a 16-digit number. No email needed. Cure53 ran an audit in 2024: zero critical findings, called out as high security level. Quantum-resistant WireGuard settings ship by default through post-quantum key exchange. Experimental QUIC scrambling muddies protocol fingerprinting. No split tunneling, and that's a strength, not a gap. One call wipes out a whole class of DNS leaks. On Linux, Mullvad uses network namespaces, giving you real TunnelVision shelter instead of the theatrical kind. Firewall rules for Port Shadow too. One of only two providers on this list to say so openly. MTU 1420 still shows through A06. IP is still a datacenter hit on A03. But everything that can be locked down is locked down.

Surfshark

Best bang for the buck in the lineup. Kill switch works. IPv6 blocked. Unlimited devices on a single plan, unique among these eight. IP ranges are easy to spot on A03, though, even more so after the backend merger with NordVPN since both belong to Nord Security. Bypasser, their split tunneling tool, carries the same DNS mismatch risks as everyone else. WebRTC blocking needs manual browser tweaks with nothing baked in. Deloitte's 2023 audit covered server infrastructure, not client code. For WHOX, a standard mid-range opponent. IP gives it away, yet there are no outright leaks.

ProtonVPN

Swiss home base, fully open-source clients across the board, and a Securitum 2024 audit. Stealth protocol wraps WireGuard in TLS to dodge DPI. Ties straight to the University of Michigan study at USENIX Security 2022, which showed 85%+ accuracy fingerprinting OpenVPN traffic. Paper took home both the Distinguished Paper prize and the Internet Defense Prize. Stealth is ProtonVPN's answer. Network namespaces on Linux give real TunnelVision cover. Free tier pulls millions of users onto a thin server pool, and those shared IPs land in DNSBLs more often, tripping A38. Paid servers run cleaner. Secure Core does double-hop through Switzerland, Iceland, and Sweden, adding confidentiality. WHOX check A33 flags double-hop as its own signal, though.

Ivpn

Small outfit based in Gibraltar. No marketing blitz. No YouTube deals. No affiliate programs. Firewall-based kill switch is one of the best in this test, blocking traffic before the VPN link comes up, not after it drops. No split tunneling, by choice, which kills a whole class of leaks in one stroke. WebRTC blocked natively on desktop. Firewall rules for Port Shadow too. Alongside Mullvad, the only two out of eight. Cure53 audited them in 2023. Fewer servers means a tighter IP footprint, less familiar to bulk databases. WHOX A03 still sees the datacenter, though. For folks who know their threat model, Ivpn is one of the two strongest picks on this list.

CyberGhost

9,800+ servers across 100 countries. Big number. Dazzles right up until you work out they're stock instances in well-known datacenters: M247, Leaseweb, Datacamp. A03 fires on the spot. Kill switch on mobile is shaky, with documented leak cases during network handoffs. Deloitte's 2022 audit is the oldest in the bunch, covering only no-logs. Smart Rules for split tunneling lack real DNS isolation. NoSpy servers in Romania are a branding play. Same datacenters under the hood. Easiest catch for WHOX out of all eight, no contest.

PIA, Private Internet Access

Fully open-source client. Whole codebase lives on GitHub for anyone to dig through. Advanced kill switch with firewall rules. Per-app split tunneling on Android and Windows. Deep settings for power users: manual encryption picks like AES-128 or AES-256, port forwarding, and MACE, their built-in DNS ad blocker. PIA's IPs have sat in databases since before VPNs went mainstream, though. A03 is rock solid. MTU 1420, WireGuard by default. WebRTC needs manual blocking. Owned by Kape Technologies, formerly Crossrider, which started as an adware outfit. A fact every user weighs for themselves.

Three Attacks Your VPN Can't Stop

1. TunnelVision, CVE-2024-3661

May 2024. Leviathan Security Group. A trick that's been sitting there since 2002. Twenty-two years nobody bothered to look.

An attacker on your local network, the coffee shop, the hotel lobby, the airport lounge, the coworking space, sends a DHCP option 121 that rewrites your OS routing table. All your traffic leaves the VPN tunnel. Not some. Not just DNS. Every last packet.

Your VPN client still reads Connected ✓. Kill switch never trips because the VPN link never dropped. Tunnel is up. Traffic just isn't going through it. Padlock is lying to your face. Green badge is lying to your face. You reckon you're shielded while sending everything over an open wire.

Hits Windows, Linux, macOS, iOS. Only Android walks away clean since it ignores DHCP option 121. Every other OS is wide open. VPNalyzer from NDSS 2022 by the University of Michigan flagged similar previously unreported shortcomings in VPN clients a full two years before TunnelVision went public.

Only real fix: network namespaces on Linux, laid out in the WireGuard docs. Mullvad, ProtonVPN, and Ivpn back this on Linux. On Windows, macOS, iOS: all eight VPNs fall. Every single one.

2. Port Shadow, PETS 2024

Citizen Lab showed this at PETS 2024. An attacker hooks into the same VPN server you're on. A regular paying customer. Same five bucks. One server, 5,000 strangers. One of them isn't who they claim to be.

By meddling with the server's NAT tables, the attacker wedges in as an in-path router between you and the VPN server. What they can pull off: grab your connections, reroute your traffic, feed you fake DNS answers, port-scan your machine, strip away your identity. Tool you bought for privacy just became the way in. You paid to get hacked.

Hits OpenVPN, WireGuard, and OpenConnect on Linux and FreeBSD. No software patch exists. Only firewall rules on the provider's end can blunt it. Out of eight VPNs, only Mullvad and Ivpn have said openly that they run firewall mitigation. Other six? Silence.

3. Protocol Fingerprinting

Three papers from three different schools. One takeaway.

University of Michigan, USENIX Security 2022: over 85% of OpenVPN connections fingerprinted by DPI with near-zero false positives. Won both the Distinguished Paper prize and the Internet Defense Prize. Your ISP knows you're on a VPN before you load a single page. A Chinese or Iranian censor knows too. OpenVPN scrambling through XOR patches and Stunnel gets sidestepped because DPI reads packet patterns, not content.

Stanford, FOCI 2024: TCP behavior inside the encrypted tunnel gives away VPN use through traffic analysis. Encryption hides content, not patterns. Encapsulated TCP acts differently from native TCP. Packet sizes, timings, retransmissions. An observer sees this from outside the tunnel without decrypting a thing.

MADWeb/NDSS 2025, the Snitch paper: active VPN spotting through IP geolocation plus RTT measurements. Server-side, real-time, no client help, no prior data gathering. Server fires off a request, times the RTT, checks it against the IP's geolocation. Your IP says Sydney while RTT is 15ms? You're not in Sydney. WHOX runs the same kind of logic through A07.

What Actually Works

Straight answer: it hinges on who you're hiding from.

From your ISP or a censor: A VPN works. Encrypted tunnel hides what you send. Protocol gets fingerprinted by DPI? Switch to Stealth from ProtonVPN or Mullvad's QUIC scrambling. Your ISP still sees the link to the VPN server itself, though.

From sites with basic checks: A VPN works. Swaps your IP and geolocation. Site only looks at IP? Any VPN on this list does the job.

From serious anti-fraud like WHOX: A VPN alone falls short. A03 for datacenter plus A06 for MTU plus C07 for DNS mismatch plus A07 for RTT gap equals detection. A VPN fixes one thing, your IP, while spinning up fresh anomalies.

Hands-on checklist:

Kill split tunneling. Yes, it's a hassle. Your DNS won't leak, though.
Run WireGuard. Faster, steadier than OpenVPN. Live with the MTU trade-off.
Block IPv6 at the OS level. Don't lean on your VPN client for this.
Block WebRTC in your browser: about:config > media.peerconnection.enabled = false.
On public Wi-Fi: TunnelVision is real. Use mobile data or Linux with network namespaces.
Test yourself: Run the WHOX test —

FAQ

Does a VPN with residential IPs dodge the datacenter flag? Partly. A03 won't fire. Residential IPs cost more, run slower, and often belong to botnets, though. A38 from DNSBL may light up instead.

Does double VPN, or double-hop, help? Against site-level detection, no. A03, A06, C09 work the same way. WHOX even has a dedicated check: A33 for double-hop VPN. Double-hop strengthens confidentiality, not anonymity from a website.

My VPN passed ipleak.net. Isn't that enough? ipleak.net checks 3 to 5 things. WHOX checks 126+. Like testing a lock by wiggling the handle. Sure, it held. Burglar comes through the window, though.

Which VPN do you back? We don't back VPNs. We build the system that catches them. Need a VPN for channel encryption? Any of the first six in the table will do. Reckon a VPN will make you invisible to a serious detection system? Read this piece again.

VPN plus antidetect browser: solved? Harder to catch, not impossible. Antidetect handles browser fingerprints, VPN handles IP. MTU, RTT, TLS behavior, and server-side signals stick around, though. Antidetect browsers get their own breakdown.