Why sites keep asking you to verify you are human

The check is not looking at you but at the address your request came from. Below: our measurement, and what you can change about it.

Why the challenges multiply

At home your address belongs to your provider and is used by two or three people. When traffic leaves through a server, the address at the exit is shared: dozens of people may sit behind it at the same moment. To a site that looks like suspiciously many requests from one point, so it switches on the safety net and asks whether there is a human behind the screen.

The second signal is whose address it is. Addresses come as home, mobile or server ones, and that is public information: every network has an owner. A datacentre address is visible at once, and some sites refuse such addresses outright — no explanation, no challenge to pass.

What matters is that neither signal is about the country. That is why switching location may change nothing: a different address, but just as shared and just as much a server one.

What our measurement showed

On 22 September 2026 we requested the front pages of twelve sites from four of our own addresses: the Netherlands, Poland, Germany, Russia — the machines the app leaves the network through. The three European addresses answered identically, so they share one column.

The point of the table is that the columns match. Four addresses in four different countries got the same answer from the marketplaces. So the refusal was not about the country: the Russian address did not help, even though it is an address in Russia. In the whole table exactly one difference showed up — Reddit, which answered the European addresses and refused the Russian one.

We got a similar result a week earlier, on 16 September 2026, while measuring something else entirely — a Russian address from abroad. The same three sites refused all three addresses then. A repeat a week later is no longer a coincidence.

Three answers that are easy to confuse

• A challenge. A “verify you are human” or “Just a moment” page. This is not a refusal: the site is willing to let you in, it just wants to see a browser. It usually passes in a couple of seconds.
• A refusal aimed at the address. A short page saying something like “access restricted” or “a problem with the IP”, and no button at all. There is nothing to pass: the decision was made before you arrived.
• A country refusal. “Not available in your region”, “country … not supported”. That one is about the country, and it has its own article.

Telling them apart matters because only the third one is “cured”, and only by changing the country you leave from. The first two are about the address.

What you can do

1. Keep out of the tunnel what does not need it. Mayak has a “RU Apps” preset on the main screen: with it, Russian services go straight out and the site sees your usual address. The list comes from our server and updates itself; as of 8 August 2026 it held 1285 rules. If you are in Russia, the preset may have switched itself on at first launch — that is by design.
2. Pass the challenge in a browser, not in an app. The challenge page is shown to browsers; inside a shop’s app you will usually never see it — the app will simply say something went wrong.
3. Changing country changes the address. Reconnecting to the same country does not: each of our exits has its own fixed address. A different location is a different address, and sometimes that is enough.
4. Turn it off for a minute. A boring but honest option: if you need that one site right now, it is cheaper to disconnect, do the thing, and connect again.

What we do not suggest is hunting for “ways to beat the check”. They break the same day, and the usual price is your account.

What we tested

• The tool. curl over IPv4 with a mobile browser’s header, on 22 September 2026; the front pages of twelve sites, ten of them in the table. Two pages — ya.ru and vk.com — answered with an ordinary redirect, and we left them out rather than pass a redirect off as a refusal.
• The vantage points. Four of our own servers: the Netherlands, Poland, Germany, Russia. All four addresses belong to datacentres.
• Repeatability. It matched our earlier measurement of 16 September 2026 on Avito, Wildberries and Ozon — a week apart, the same result.

What we do not know

• What your browser will see. curl is not a browser: with neither JavaScript nor cookies it never passes a challenge. Our “refused” sometimes means only “a check a human would have passed”.
• Why the challenge was shown to you. Site rules are closed. We see the answer, not the reason, and we will not guess at it.
• The shops’ apps. We measured pages on the web, not the Avito, Ozon or Wildberries apps. How those behave we did not test.
• Home and mobile addresses. We have none to measure from, so this instrument cannot compare “at home” with “through the tunnel”.

Short answers

Why does a search engine keep asking me to verify I am human? Because the check is tied to the address, not to you. A shared address sends many requests, and the site plays it safe.

Did Mayak give me away? No. A site does not know which app you use; it sees the address, and that the address is a server one.

Will switching country help? Against a challenge — your luck may vary: the address will be different, but just as shared. Against a country refusal — yes, that is the only thing a country decides.

Why did the Russian address not help with Avito? Because the refusal was not about the country: the address is Russian but it is a server address. In the measurement it got the same answer as the European ones.

How do I open a Russian shop without the fuss? Keep Russian services outside the tunnel with the “RU Apps” preset, or disconnect for a minute.

Everything opens for me except one site. That happens: every site decides on its own. There is no general outage behind it.

Is it the VPN that causes these checks? Not by itself: the checks follow the address. Any shared datacentre address — a VPN exit, a proxy or a cloud server — collects them more often than a home line does.

And if the page does not load at all? That is the third case — the network, not the site. It is covered in “connected but no internet”.