IP-based detection involves analyzing the DNS queries made by a user to identify VPN or proxy usage by matching with a blacklist of known VPN or proxy DNS servers.