Depends which half of the problem you mean. Datacenter proxies are easy, an ASN lookup catches most of them and any IP reputation service will do it. Residential proxies are the ones that hurt, and no IP list will reliably catch those because the addresses are real consumer connections.
For residential you stop looking at the IP and look at behaviour instead, device fingerprint reuse across accounts, checkout velocity, billing country against BIN country, shipping address that matches nothing else on the profile. The other thing is that hard blocking every VPN will cost you real customers, plenty of people shop with one on by default. What is your actual loss looking like, chargebacks or promo abuse?
