> They must be buying a database of IP address locations and VPN addresses from somebody.

There are services that can detect most commercial VPN services, e.g. https://focsec.com