Netflix likely spotted the behavior through one of the many other heuristics that can identify this, such as: - Lower packet TTL than gateway - Lower packet M

Netflix likely spotted the behavior through one of the many other heuristics that can identify this, such as: - Lower packet TTL than gateway - Lower packet MTU than gateway - Much higher latency than gateway - WAN IP listening on well-known VPN ports for PPTP/IPsec/etc - Ongoing sessions that suddenly teleported to a Chinese WAN IP when the VPN connection dropped - Incorrect DNS configurations or stale caches that point toward inappropriate CDN edge nodes - System time zone (via JavaScript or native app) not matching source region - Unusual system language preferences for the region - One of the hundreds of leaky data points revealed by Android devices and other native apps