Earlier quoted context omitted.
I've noticed this is quite popular among the kings of cargo-cult security: banking websites. I can only hope the proliferation of VPN-gating is more contained compared to the recent (banking-led) upswing in Android root-checks. This type of security theater can be easily bypassed by any determined attacker and thus only serves to deter honest users.
> This type of security theater can be easily bypassed by any determined attacker and thus only serves to deter honest users. To play devil's advocate, the large amount of attackers aren't really determined. They're just fishing for easy targets. If you check the logs on a VPS you'll see an endless stream of people trying to exploit things like Wordpress 24/7 on your brand new VPS that has nothing but a html landing…
The rise of the copy-paste attacker: https://en.wikipedia.org/wiki/Script_kiddie