Not All Roads Lead to Rome: How VPN Selection Alters What We Measure and Infer about Web Infrastructure

2026-05-28

AI Summary

This study challenges the common assumption in network measurement that commercial VPN services within a country are interchangeable observation points, demonstrating that different providers can introduce significant measurement bias. Through a systematic comparison of four major VPN providers across 14 countries—employing large-scale browser automation, custom DNS probing, CDN replica identification, and BGP routing analysis—the work quantifies intra-national discrepancies attributable to VPN choice for the first time. The observed biases primarily stem from ISP-operated DNS interception, CDN routing policies based on egress networks, and underlying peering differences. To address this, the authors propose a three-layer attribution framework encompassing vantage point identity, domain name resolution, and replica selection. These findings contest the interchangeability hypothesis and advocate for standardized reporting practices in VPN-based network measurements.

Abstract

Web-measurement studies treat commercial VPNs as interchangeable vantage points within a country, assuming that any VPN in a particular country is as good as any other. We show that this assumption does not hold: the same country measured through different VPN providers yields materially different conclusions about where endpoints sit, who hosts them, and which physical replicas serve them. Using large-scale browser-based measurements across fourteen countries and four major VPN providers, complemented by targeted DNS and replica-selection probes, we examine sources of this variability across three layers of the VPN-to-endpoint path: vantage identity, name resolution, and replica selection. We find that the variability is driven primarily by layers below the client: commercial VPN providers operate their own in-country DNS infrastructure, often intercepting queries regardless of client configuration; CDNs steer on the exit network, sending identical queries to different replicas; and peering paths route identical DNS answers to different physical facilities. We distill these findings into a set of reporting practices for VPN-based Web measurement.

Problem

• VPN
• web measurement
• CDN
• DNS
• replica selection

Innovation

• VPN-based measurement
• DNS interception
• CDN replica selection
• vantage point variability
• web infrastructure inference