Check whether an IP address is a datacenter/hosting IP, belongs to a known VPN range, is a residential or open proxy exit, or is a Tor exit node. Defaults to your own IP.
Analyzing your IP address:
Local lists: Tor exits updated 2026-08-01, VPN ranges updated 2026-08-01, proxy exits updated 2026-08-01. Nothing is sent to external services.
Need this in your app? One API for VPN/proxy/datacenter detection, geolocation & ASN data.
Get the APIPaste any IPv4 or IPv6 address into the field above and press Analyze — or leave it empty to test your own connection. The detector runs four independent checks (datacenter ASN, commercial VPN range, open/residential proxy exit, Tor exit node) and returns a plain verdict with the evidence behind it: the announcing autonomous system, the registered country, and exactly which lists matched. Everything runs against locally cached datasets, so it is free, unlimited, and requires no signup.
There is no flag in an IP packet that says "this is a VPN". Detection works by asking a more answerable question: does this address belong to infrastructure, or has it been seen relaying someone else's traffic? This tool combines four signals, each derived from a free, public dataset cached on our servers.
| Signal | Data source | What it catches | What it misses |
|---|---|---|---|
| Datacenter / hosting | Global BGP table + curated list of 50+ cloud, hosting & CDN ASNs | Commercial VPN endpoints, bots, and scrapers on rented servers | Self-hosted VPNs on small, unlisted hosts |
| Known VPN range | X4BNet VPN list (10,745 CIDR ranges) | Egress ranges of major commercial VPN providers | New or niche VPN providers not yet listed |
| Proxy exit | Live open-proxy trackers (5,887 exits, last 30 days) | Open SOCKS/HTTPS exits, including residential proxies observed relaying traffic | Rotating residential pool IPs never seen by trackers |
| Tor exit node | Tor Project official exit list (1,386 exits) | Every public Tor exit relay — authoritative by design | Practically nothing; exit relays are public |
The datacenter check looks up which autonomous system announces the IP in the global BGP table, then matches that ASN against a curated list of cloud, hosting, CDN, and VPN-infrastructure operators. This is the strongest single signal: virtually every commercial VPN endpoint, scraper, and bot runs on rented servers inside these networks, because nobody sells VPN service from a residential broadband line at scale.
The VPN range check matches the address against the open-source X4BNet VPN list (10,745 CIDR ranges, updated 2026-08-01), which tracks the egress ranges of major commercial VPN providers. The Tor check uses the Tor Project's own exit list (1,386 exits, updated 2026-08-01) — authoritative, since exit relays are public by design.
Residential proxies are the hard case: they route traffic through real consumer ISP addresses — home broadband and mobile lines — precisely so that ASN-based checks see nothing unusual. The proxy exit check closes part of that gap. It matches the address against live open-proxy trackers (5,887 SOCKS/HTTPS exits observed in the last 30 days, updated 2026-08-01). When a hit lands on consumer ISP space rather than in a datacenter, the tool reports it as a residential proxy exit — the address looks like a home connection but has verifiably relayed third-party traffic. About three in four proxy exits in the dataset sit on ISP space, which is exactly why they are worth a dedicated signal. The unavoidable caveat: commercial residential proxy networks rotate through pools of millions of addresses, so only exits that trackers have actually observed can be flagged.
Typical uses: deciding whether a login attempt deserves extra verification, spotting residential proxy traffic behind credential-stuffing or scraping activity, filtering datacenter traffic out of analytics, debugging why a site geo-blocks you (your "residential" connection may egress via CGNAT in a datacenter), and validating proxy vendor claims. Treat the result as evidence, not proof — combine it with behavioral signals before blocking anyone.
Four independent checks run against locally cached datasets. Datacenter: the IP's ASN is matched against a curated list of 50+ cloud and hosting providers (AWS, Google Cloud, Hetzner, OVH, DigitalOcean, M247, and others) — VPN servers are almost always rented in these networks. VPN: the IP is matched against an open-source list of roughly 11,000 CIDR ranges used by commercial VPN services. Proxy: the IP is matched against live open-proxy trackers that record SOCKS and HTTPS proxy exits observed in the last 30 days. Tor: the IP is compared with the Tor Project's official exit node list, refreshed with each deployment.
A residential proxy routes traffic through an IP address that belongs to a consumer ISP — a home broadband or mobile line — so it looks like an ordinary visitor rather than a server. Because the ASN is a regular ISP, datacenter and VPN checks miss it. This tool detects the cases that are detectable at the IP level: when an address on consumer ISP space has been observed relaying third-party traffic as an open SOCKS or HTTPS proxy, it is flagged as a residential proxy exit. Roughly three in four proxy exits we track sit in consumer ISP space, not in datacenters.
Yes. No IP-based detector is perfect: small or self-hosted VPNs (a WireGuard server on an unlisted VPS) may only trigger the datacenter flag, and paid residential proxy networks rotate through millions of consumer addresses, only some of which have been observed relaying traffic. An IP is flagged only when it appears in a tracked dataset, so absence of flags means no known indicators — not a guarantee.
For commercial VPNs, accuracy is high: their servers sit in hosting and cloud networks that are easy to enumerate, so the datacenter and VPN-range checks catch virtually all of them. The two known failure modes are false positives from CGNAT and iCloud Private Relay (real people whose traffic egresses through infrastructure IPs) and false negatives from residential proxies whose exit addresses have not yet been observed relaying traffic. That is why this tool reports each signal separately, with its data source and update date, instead of a single opaque score.
At the IP level, the only reliable evidence is observation: an address on consumer ISP space that has been seen relaying third-party traffic as an open SOCKS or HTTPS proxy — which is exactly what this tool's proxy exit check reports. Production anti-fraud systems layer more signals on top: TCP/TLS fingerprint mismatches (a "home" IP whose traffic looks like a Linux server), round-trip times inconsistent with the claimed location, session behavior, and how many distinct accounts an address touches. IP reputation is the first filter, not the whole answer.
Some ISPs route customer traffic through CGNAT or cloud-hosted security gateways, and services like Apple iCloud Private Relay egress through CDN networks (which we classify as infrastructure). If your connection goes through any of these, the egress IP genuinely belongs to a datacenter ASN even though you're at home.
No. The analysis runs server-side against local datasets, nothing is forwarded to third-party APIs, and results are not persisted. The page is also marked non-cacheable so your result is never served to another visitor.
Free tools for network engineers — no signup, no rate-limit walls.