If you’ve ever tried watching Netflix using a VPN, you’re likely familiar with some of the issues surrounding VPNs and streaming. Netflix, Hulu, Amazon Prime, and many other streaming services don’t want you to access their content with a VPN and will either restrict what you can watch or block you entirely. So how do they even know that you’re using a VPN?

How Services Can Spot VPNs

The only ones in a position to answer that question definitively are the streaming services themselves, and they, unsurprisingly, didn’t reply to our messages. However, among VPN providers, there are some educated guesses as to the how and why of their connections getting blocked.

Most VPN providers agree that streaming services block specific IP addresses—the set of numbers that shows your location in the real world— associated with VPNs. According to Daniel Markuson, cybersecurity expert at NordVPN, “streaming services check incoming requests and the IP addresses they’re coming from, then they match these IPs to those known to belong to VPN services.”

There are several ways in which this list of VPN-associated IP addresses could be created. Most VPN services we reached out to agree that there’s a good possibility they’re using special IP databases like IP2Location and IPQualityScore, which track which IP addresses are used by VPNs or proxies.

Residential vs. VPN IPs

This is because not all IP addresses are created equal. Some of them are associated with the homes of regular people and are thus called “residential.” Others are associated with companies or with hosting providers—-or even with proxies and VPN services.

In an email, Dimitar Dobrev, director of VPNArea, explains it like this: “if an IP address is owned by an ISP like Verizon, it would usually count as residential and it will not be in a database. If it is owned by a hosting provider, it will most likely be used for hosting and that would be the kind of IP that finds itself in those special proxy/VPN databases.”

How these databases classify these IP addresses is a bit of a mystery, however. They themselves claim to use special algorithms, while Mr. Dobrev suspects that they likely mine public IP registrars for them. Whatever the case may be, it’s proving effective against people trying to use a VPN for streaming.

Identifying VPN Traffic

All the VPN services we approached also thought it unlikely that streaming services rely solely on these databases, there’s a good chance that they analyze their traffic using their own methods and so figure out if an IP address is suspect. It could be as simple as seeing that several different user accounts are simultaneously using the same IP address—a highly unlikely occurrence under normal circumstances—and then flagging that IP address.

There could be more going on, though Mr. Dobrev thinks it unlikely: “I’m pretty certain they don’t analyze the traffic in-depth as that would require them having some access to such traffic somewhat upstream and I’m fairly sure it would be illegal.”

However, that’s not to say that streaming services are content with merely creating or buying lists and dutifully checking incoming IPs against them. Staff at another top-tier VPN—who wished to remain anonymous to avoid the wrath of Netflix—also pointed out two other ways in which streaming services could possibly identify VPN traffic other than tracking IPs or upstream analysis.

Checking DNS Server Information

When using a VPN, you’re not just spoofing your IP address, you’re also changing your DNS server information, the system that connects domain names to IP addresses. However, according to our source, a streaming platform could potentially override a user’s current DNS settings, which would reveal where they’re actually connecting from.

Though it’s unclear exactly how a streaming platform could do this—one possibility is by forcing DNS over HTTPS in the service’s app rather than on a website—the result is always the same: the service knows where you really are and could block access.

GPS Data Collection

Another option is that streaming services could possibly use the GPS information collected from their mobile apps or your browser (if you’ve allowed location access) and check if it matches with your IP address. For example, if your phone’s GPS information shows you’re connecting via a U.S.-based IP address but your GPS data shows you’re in the UK, you’d get blocked.

It seems a little out there and a little dystopian, but it’s definitely a possibility: for example, TechNadu suspects that Hulu is using GPS information to double-check your location. The legality of using this method is up in the air, too, but we have a feeling that if this is happening (and there’s little hard proof), it might be an issue anywhere location tracking has been forbidden.

Staying Ahead of Netflix

However they do it, the fact is that many streaming services invest a lot of effort into blocking users who use a VPN. For their part, VPNs are doing what they can to get past these measures, creating a tug of war where one side is always trying to get one over on the other.

Right now, you can stream with a VPN fairly well, but there’s no guarantee that will still be the case tomorrow. Though we’re not sure how they do it, there’s no doubt streaming platforms are bent on making sure you don’t use a VPN.

While the game of cat and mouse continues, it’s worth noting that some VPNs are better at getting around streaming service restrictions than others.