The answer to that question is pretty easy now a days. The answer is Technology. There are many companies out there that compile and sell VPN Provider Data. IPQualityScore is just one such company.
IPQualityScore maintains the most accurate database of VPN providers, including new servers and nodes that are added each day. By querying our API or processing a list of IP addresses, it’s very easy to accurately check if an IP addresses belong to a VPN provider. The VPN IP address can also be analyzed for risk analysis, location, and behavior history and similar data.
Do you want to test your current VPN provider and see what your VPN / Tor score is?