Proxy and VPN signals change application risk when they appear together with something else: interception of the app’s own traffic, a tampered app or hooking, a location that contradicts the account, or a high-value flow such as a payout or credential change. On their own they mostly describe how a legitimate user connects. Otukan reports proxy, VPN and interception signals from inside your Android and iOS app, including Flutter and React Native apps, next to its runtime findings. Your backend weighs them against the flow at hand, and the app applies the response you set.
Signals and meaning
Routing and attack are different things. A proxy moves traffic; an attack reads or changes it. Otukan’s signals are grouped so your team can tell those apart.
| Signal | What it tells you | What it does not tell you |
|---|---|---|
| Device proxy configured | Traffic from the app is sent through a proxy set on the device | Whether the proxy belongs to an employer, a filter or an attacker |
| VPN active | The active network runs through a tunnel | Who operates the tunnel or why it is on |
| Interception indicators | Something is trying to sit between the app and your server | Nothing by itself about the user’s intent, though credentials are at risk |
| Routing with runtime findings | Network signals appear alongside hooking, debugging or a modified app | That a specific account is fraudulent, which your server decides |
Why routing alone is weak evidence
Attackers do use proxies and VPNs, but so do a great many ordinary people, and the tools are cheap for both. A rule that treats routing as guilt catches few attackers and many customers. The signal earns its weight when it lines up with something harder to explain away: a hooked app, a certificate the app should not trust, or an account suddenly acting from somewhere new.
Platform differences
On Android, an app can read the transport of the active network and the system proxy settings, so Otukan reports VPN and proxy use directly. On iOS, an app can read the system proxy configuration, while VPN information is more limited; Otukan reports the indicators available to an app there. Your backend receives the platform with each signal and should set thresholds per platform.
User context
A useful policy starts with the people who route traffic for good reasons.
Corporate VPNs
Staff and business customers often connect through an employer’s tunnel or managed proxy. For enterprise apps this is the normal state, and a policy that reacts to it creates support tickets instead of security.
Privacy tools
Many consumers use a VPN or privacy relay by habit. Treat that as a preference. Otukan’s observe mode shows how common it is among your real users before any rule is switched on.
Travel and roaming
Travellers appear in unexpected countries, move between hotel and airport networks and switch to a VPN to reach home services. A location mismatch with a trusted device and a clean runtime is a very different case from the same mismatch with a hooked app.
Policy
Combine network signals with the risk of the flow before you enforce anything.
- Start in observe. Record proxy, VPN and interception signals for your real users with no change to their experience.
- Rank your flows. Browsing, sign-in, payments, payouts and account changes carry different risk.
- Combine signals. Give routing weight only when it appears with interception, runtime tampering, a location mismatch or an unusual account pattern.
- Choose a response per flow. Warn or step up on sign-in, restrict payouts, and leave browsing untouched.
- Test legitimate networks. With your team, Otukan reproduces proxy and interception setups in an authorised lab, repeats the same journeys on corporate VPNs, privacy tools and roaming, then re-runs install, update, sign-in and the protected flow.
Where interception is the real concern, see man-in-the-middle prevention. Response design is covered on threat response. For a structured way to evaluate options, see the proxy and VPN risk solution guide.
For the full protection model, return to mobile app security. If your app is already live, you can request a free App Exposure Check of the public store release.