Detecting virtual private network usage

An apparatus comprising:

• at least one processor;
• and
• memory storing instructions that, when executed by the at least one processor, cause the apparatus to:
• receive a first request from a first source address for a content resource;
• provide a response to the first request, wherein the response comprises an identifier of a network-segment identification resource and is configured to cause a computing device associated with the first source address to access the network-segment identification resource using the identifier;
• detect a second request for the network-segment identification resource based on the identifier, wherein the second request is associated with a second source address;
• receive, from a server associated with the network-segment identification resource, information indicating one or more attributes of the second request;
• and
• identify the computing device associated with the first source address as being associated with an intermediary based on a result of comparing one or more attributes of the first request to the one or more attributes of the second request.

At least one non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform steps comprising:

• receiving, by a first server, a first request from a first source address for a content resource;
• providing a response to the first request, wherein the response comprises an identifier of a network-segment identification resource and is configured to cause a computing device associated with the first source address to access the network-segment identification resource using the identifier;
• detecting a second request for the network-segment identification resource based on the identifier, wherein the second request is associated with a second source address;
• receiving, by the first server and from a second server associated with the network-segment identification resource, information indicating one or more attributes of the second request;
• and
• identifying the computing device associated with the first source address as being associated with an intermediary based on a result of comparing one or more attributes of the first request to the one or more attributes of the second request.

An apparatus comprising:

• at least one processor;
• and
• memory storing instructions that, when executed by the at least one processor, cause the apparatus to:
• receive a first request from a first source address for a content resource;
• provide a response to the first request, wherein the response comprises instructions configured to cause a computing device associated with the first source address to access a network-segment identification resource and retrieve first location-specific information;
• receive, from the first source address, the first location-specific information associated with the network-segment identification resource;
• determine expected location-specific information based on the first source address;
• and
• identify the first source address as being associated with an intermediary based on determining that the received first location-specific information does not match the expected location-specific information.

At least one non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform steps comprising:

• receiving, by a first server, a first request from a first source address for a content resource;
• providing a response to the first request, wherein the response comprises instructions configured to cause a computing device associated with the first source address to access a network-segment identification resource and retrieve first location-specific information;
• receiving, from the first source address, the first location-specific information associated with the network-segment identification resource;
• determining expected location-specific information based on the first source address;
• and
• identifying the first source address as being associated with an intermediary based on determining that the received first location-specific information does not match the expected location-specific information.