The problem Your VPN client shows a green "Connected" toggle.
That's a marketing claim, not a proof.
A tunnel can be up while DNS leaks, IPv6 bypasses the route, or your "anonymous" egress sits in a datacenter that any service can fingerprint.
How ActiveVPN works The scan collects five groups of signals: Network interfaces — checks psutil.net_if_addrs() against patterns like tun, tap, utun, wg, ipsec, tailscale, zerotier.
Processes — iterates running processes and matches them against known VPN/Tor binaries using exact/CLI-token matching (this removed a lot of naive-substring false positives, e.g. "vpn" matching random apps).
External IP — queries ip-api.com, ipinfo.io, and ipapi.co in a failover chain for IP, ISP, country, hosting, and proxy flags.
DNS — calls edns.ip-api.com to find the resolver IP your DNS queries actually go through.
IPv4/IPv6 — fetches both via ipify to spot IPv6 leaks around an IPv4-only tunnel.
Verdict scoring Each signal has a weight (interface 50, VPN process 40, Tor 35, hosting 25, proxy 30).
The sum, capped at 100, maps to: 0-19 CLEAN 20-39 SUSPICIOUS 40-74 LIKELY VPN/PROXY 75-100 VPN DETECTED Extras worth mentioning Kill switch: sudo activevpn --kill / --kill-force.
Watch mode: activevpn --watch 30 with on_change callbacks for VPN-drop alerts.
History & export: JSON/CSV/TXT from the platform data directory.
Exit codes (0/1/2) so you can wire it into CI.
Library API: import activevpn; result = activevpn.scan(); result.verdict.label.
Docker image + GitHub Pages docs + full pytest suite running on 3 OSes across Python 3.8 and 3.12.
Install pip install activevpn activevpn GitHub: https://github.com/rkriad585/ActiveVPN Docs: https://rkriad585.github.io/ActiveVPN