Data center traffic: bots, VPNs, and how to tell
Almost every bot runs in a data center, but not everyone in a data center is a bot. The difference between a signal and a verdict is what keeps the scoring honest.
Last updated
Why the signal is strong
Automation needs cheap machines by the thousand, and cheap machines live in clouds. That is why a data center range match is a first class signal in the IP layer of detection rather than a supporting one: residential readers do not browse from server racks.
The humans who live there too
- Commercial VPN users: privacy conscious readers routing through the same clouds the bots rent.
- Corporate networks that send their browsing out through cloud proxies and security gateways.
- Apple iCloud Private Relay, which places a slice of Safari users behind shared relay addresses.
A signal is scored, not obeyed
One strong signal buys a suspected verdict, not a conviction. Confirmation needs corroboration: a client that never ran JavaScript, a webdriver flag, a session shape no person produces. The three class output exists so that distinction survives all the way into your report instead of collapsing into a binary.
Reading a data center heavy source
Some audiences legitimately skew toward VPNs: privacy focused readers, developers, corporate desks. So judge the source by its whole shape, not the single signal. If the same traffic also bounces at 100 percent and never runs JavaScript, the VPN explanation dies. If engagement looks human everywhere else, it probably is human, and the verdicts will say so.