# US 10,455,005 B2 · Detecting virtual private network usage > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,455,005 B2 - Document ID: US10455005B2 - Status: Granted - Kind: B2 - Application number: 15/718,663 - Filed: 2017-09-28 - Published: 2018-03-01 - Granted: 2019-10-22 - Earliest claimed: 2014-06-25 - Assignees: Comcast Cable Communications, LLC; NBCUniversal Media, LLC - Applicants: Comcast Cable Communications, LLC - Inventors: Robert Glenn Deen; Antony Tauber - Web page: https://patentgrep.com/patent/US10455005B2 ## CPC - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 43/0876: Network utilisation, e.g. volume of load or congestion level - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/52: specially adapted for the location of the user terminal - H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract According to some aspects described herein, a system may determine whether a network actor appears to be using an intermediary such as a VPN and/or proxy server. This may be accomplished by directing the network actor to request and/or access a network-segment identification resource which may, in some embodiments, be stored in another region of the global network. The system may include links and/or other identifiers pointing the network actor to one or more network-segment identification resources. The network actor may access the network-segment identification resources using the links or identifiers, and the system may use information about the request for the network-segment identification resource to determine whether the network actor is associated with multiple source addresses. ## Claims ### Claim 1 A system comprising: a first server configured to: receive a first request from a first source address for a content resource; provide a response to the first request, wherein the response comprises an identifier of a network-segment identification resource and is configured to cause a computing device associated with the first source address to access the network-segment identification resource using the identifier; detect a second request for the network-segment identification resource based on the identifier, wherein the second request is associated with a second source address; receive, from a second server associated with the network-segment identification resource, information indicating one or more attributes of the second request; and identify the computing device associated with the first source address as being associated with an intermediary based on a result of comparing one or more attributes of the first request to the one or more attributes of the second request; and the second server, configured to: receive the second request from the second source address; and provide, to the first server, the information indicating the one or more attributes of the second request. ### Claim 2 (depends on 1) The system of claim 1, wherein the first server is configured to identify the computing device as associated with virtual private network (VPN) use or proxy server use. ### Claim 3 (depends on 1) The system of claim 1, wherein the first server is further configured to: select the identifier from a pool of predetermined identifiers, wherein the selected identifier is assigned to be associated with the first request. ### Claim 4 (depends on 1) The system of claim 1, wherein the first server is further configured to: generate the identifier based on the first source address, wherein the identifier comprises a parameter generated based on the first source address. ### Claim 5 (depends on 1) The system of claim 1, wherein the network-segment identification resource comprises an image resource and the response to the first request comprises instructions operable to cause the computing device to retrieve the image resource using the identifier. ### Claim 6 (depends on 1) The system of claim 1, wherein the first server is configured to identify the computing device as associated with the intermediary based on determining that the first source address does not match the second source address. ### Claim 7 (depends on 1) The system of claim 1, wherein the first server is configured to query the second server to request the information indicating the one or more attributes of the second request. ### Claim 8 (depends on 1) The system of claim 1, wherein the first server is configured to detect the second request based on receiving notification of the second request from the server, and wherein the second server is further configured to notify the first server of the second request. ### Claim 9 (depends on 1) The system of claim 1, wherein the first server is further configured to: block access by the computing device to the content resource or related resources responsive to identifying the computing device as associated with the intermediary. ### Claim 10 (depends on 1) The system of claim 1, wherein the first server is configured to identify the computing device as associated with the intermediary based on determining a network distance between the first source address and the second source address. ### Claim 11 An apparatus comprising: at least one processor; and memory storing instructions that, when executed by the at least one processor, cause the apparatus to: receive a first request from a first source address for a content resource; provide a response to the first request, wherein the response comprises an identifier of a network-segment identification resource and is configured to cause a computing device associated with the first source address to access the network-segment identification resource using the identifier; detect a second request for the network-segment identification resource based on the identifier, wherein the second request is associated with a second source address; receive, from a server associated with the network-segment identification resource, information indicating one or more attributes of the second request; and identify the computing device associated with the first source address as being associated with an intermediary based on a result of comparing one or more attributes of the first request to the one or more attributes of the second request. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the instructions, when executed by the at least one processor, cause the apparatus to identify the computing device as associated with the intermediary by causing the apparatus to identify the computing device as associated with virtual private network (VPN) use or proxy server use. ### Claim 13 (depends on 11) The apparatus of claim 11, wherein the instructions, when executed by the at least one processor, further cause the apparatus to: generate the identifier based on the first source address, wherein the identifier comprises a parameter generated based on the first source address. ### Claim 14 (depends on 11) The apparatus of claim 11, wherein the instructions, when executed by the at least one processor, cause the apparatus to identify the computing device as associated with the intermediary based on determining that the first source address does not match the second source address. ### Claim 15 (depends on 11) The apparatus of claim 11, wherein the instructions, when executed by the at least one processor, cause the apparatus to query the server to request the information indicating the one or more attributes of the second request. ### Claim 16 (depends on 11) The apparatus of claim 11, wherein the instructions, when executed by the at least one processor, cause the apparatus to detect the second request based on receiving notification of the second request from the server. ### Claim 17 (depends on 11) The apparatus of claim 11, wherein the instructions, when executed by the at least one processor, further cause the apparatus to: block access by the computing device to the content resource or related resources responsive to identifying the computing device as associated with the intermediary. ### Claim 18 At least one non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform steps comprising: receiving, by a first server, a first request from a first source address for a content resource; providing a response to the first request, wherein the response comprises an identifier of a network-segment identification resource and is configured to cause a computing device associated with the first source address to access the network-segment identification resource using the identifier; detecting a second request for the network-segment identification resource based on the identifier, wherein the second request is associated with a second source address; receiving, by the first server and from a second server associated with the network-segment identification resource, information indicating one or more attributes of the second request; and identifying the computing device associated with the first source address as being associated with an intermediary based on a result of comparing one or more attributes of the first request to the one or more attributes of the second request. ### Claim 19 An apparatus comprising: at least one processor; and memory storing instructions that, when executed by the at least one processor, cause the apparatus to: receive a first request from a first source address for a content resource; provide a response to the first request, wherein the response comprises instructions configured to cause a computing device associated with the first source address to access a network-segment identification resource and retrieve first location-specific information; receive, from the first source address, the first location-specific information associated with the network-segment identification resource; determine expected location-specific information based on the first source address; and identify the first source address as being associated with an intermediary based on determining that the received first location-specific information does not match the expected location-specific information. ### Claim 20 (depends on 19) The apparatus of claim 19, wherein the instructions, when executed by the at least one processor, cause the apparatus to identify the first source address as associated with the intermediary by causing the apparatus to identify the computing device as associated with virtual private network (VPN) use or proxy server use. ### Claim 21 (depends on 19) The apparatus of claim 19, wherein the received first location-specific information is based on a second source address used to access the network-segment identification resource. ### Claim 22 (depends on 19) The apparatus of claim 19, wherein the network-segment identification resource is located in a different internet protocol (IP) address block from the content resource. ### Claim 23 (depends on 19) The apparatus of claim 19, wherein the instructions, when executed by the at least one processor, further cause the apparatus to: determine a location based on the first location-specific information; and select content to provide to the first source address based on the determined location. ### Claim 24 (depends on 23) The apparatus of claim 23, wherein selecting content based on the determined location comprises selecting a content language based on the determined location. ### Claim 25 At least one non-transitory computer-readable medium storing instructions that, when executed by at least one processor, cause the at least one processor to perform steps comprising: receiving, by a first server, a first request from a first source address for a content resource; providing a response to the first request, wherein the response comprises instructions configured to cause a computing device associated with the first source address to access a network-segment identification resource and retrieve first location-specific information; receiving, from the first source address, the first location-specific information associated with the network-segment identification resource; determining expected location-specific information based on the first source address; and identifying the first source address as being associated with an intermediary based on determining that the received first location-specific information does not match the expected location-specific information.