How do websites detect and block VPN IP addresses?

Because your VPN's exit IP is on a list. Not necessarily your VPN's fault, and not necessarily permanent, but a list somewhere has it, and the site checking it doesn't care why.

Here's the mechanism. Companies like MaxMind, IPQualityScore and IP2Location run IP intelligence databases that classify addresses: residential, mobile, datacenter, "known VPN/proxy". They build this by watching traffic patterns, buying hosting-provider IP ranges, and crowdsourcing reports from sites that got hit by abuse from a given address. A site that wants to block VPN traffic doesn't need to detect the protocol at all. It just queries one of these APIs against the connecting IP and gets a yes/no back in milliseconds.

This is why the same VPN can work on one site and get blocked on another five minutes later: they're not running the same check. A campus wifi filter, a streaming catalogue's licensing block, and a forum's anti-spam rule can all be pulling from different blocklist vendors with different update frequencies.

Why a commercial VPN gets caught and a personal server often doesn't

A VPN provider selling to thousands of people reuses a small number of IP ranges across all of them. That's efficient for the provider and terrible for evasion: every one of those addresses gets used by enough people, often for the exact abuse (scraping, spam, chargebacks) that IP intelligence vendors are built to catch, that the whole range ends up flagged as "VPN/hosting" within weeks of going live. Rent a fresh VPS instead and point WireGuard at it yourself, and for a while you're not on anyone's list, because nobody else is sharing that address with you.

It's not a permanent advantage. The same hosting providers datacenter-IP databases track are exactly where personal VPS boxes live too, and a popular enough personal setup gets picked up eventually. It's a race between how fast you rotate and how fast the vendor's crawler finds you, not a real exemption.

Where this stops being useful advice

IP reputation and traffic fingerprinting are different problems, and conflating them is where a lot of "just self-host it" advice falls apart. IP-list blocking only cares what address you're coming from. Deep packet inspection cares what your traffic looks like on the wire, TLS handshake shape, packet timing, whether the protocol pattern matches known VPN signatures, regardless of whose IP is sending it. A country-level censor doing DPI on WireGuard's handshake will flag your brand-new personal VPS exactly as fast as a commercial provider's, because the detection never looked at the IP reputation list in the first place.

So the honest answer to "how do I avoid this" splits in two:

• If the block is IP-reputation based (a streaming catalogue, a corporate proxy, a forum), a fresh or rotating IP genuinely helps, until it doesn't.
• If the block is protocol-fingerprinting based (campus DPI, national censorship), the IP was never the problem. The traffic shape was.

Pangea's five transports (VLESS + Reality, Cloak, Shadowsocks, Hysteria2, NaiveProxy) are built for the second kind of block, not the first: VLESS + Reality borrows a real site's TLS handshake so DPI sees what looks like an ordinary visit to that site, and NaiveProxy mimics real Chromium TLS and HTTP/2 for the same reason. Neither one launders your exit IP's reputation. If a service has specifically blocklisted our hub's address, that's a different fight, and no transport disguise fixes an IP already on a list.

What actually helps against IP-reputation blocking is not claiming a magic clean address, it's not making the fleet's size or locations the selling point at all, because a bigger public list of IPs is a bigger target for exactly this kind of blocklist. Read the source if you want to check what the client sends before you trust any of this: it's GPLv3 on GitHub.

If you want to test whether your specific block is IP-based or fingerprint-based before paying for anything, the five-day free trial (no card needed) is enough to try more than one transport against the same network and see which one, if any, gets through. See pricing.