Threatmetrix is a fraud prevention SaaS aimed at preventing fraud. Their company website states:
ThreatMetrix is also uniquely able to uncover hackers and fraudsters trying to cover their true location by hiding behind VPN servers. ThreatMetrix has developed a unique VPN detection capability that:
- Captures additional TCP/IP packet header attributes
- Analyzes the network connection type from an originating device, such as Ethernet, 3G, WiFi, VPN and others
- Enables new sets of policies and alerts for fraud prevention
- Distinguishes between normal IPs and VPN based IP addresses
I am interested in understanding: how is it possible to identify a user is using a VPN from the packet headers? How is it possible to detect the network connection type from originating device?