VPN & proxy detection
Shows traffic-light signals whether an IP carries indications of VPN, Tor, relay, satellite or hosting — plus abuse score and risk. Signals, not forensic certainty.
How this tool works
This check evaluates the network attributes of an IP and shows clear traffic-light signals for whether there are indications of a VPN, a Tor exit node, an iCloud Private Relay, a satellite link or a hosting/data-center IP. It is complemented by connection type, abuse score, risk rating plus ASN, provider and country. Detection is based on known address ranges and routing properties — it provides signals of anonymization, not a forensically certain statement. With an empty field you check your own IP, otherwise any public address.
Typical use cases
- On fraud suspicion at checkout, detect whether an order IP shows anonymizing attributes
- Flag login attempts from Tor or VPN networks for an additional review
- Classify support tickets: does the request come from a residential line or a hosting network?
- Sanity-check your own VPN connection — is it detected as anonymizing?
- Review abuse score and risk of a conspicuous IP before manual measures
Frequently asked questions
How reliable is VPN detection?
It provides signals, not certainty. Detection relies on known VPN/hosting ranges and routing patterns. New or private VPN endpoints can stay undetected, and some corporate IPs resemble hosting networks. Use the result as one signal among several, not as the sole basis for a decision.
What is iCloud Private Relay?
A service by Apple that routes web traffic through two relays so the original IP and coarse location are obscured. It is flagged here as "relay" — users of this service are typically not attackers but privacy-conscious individuals.
Does the tool distinguish VPN and Tor?
Yes. VPN, Tor exit node, relay, satellite and hosting are reported separately as distinct flags, because they carry different risk and trust implications.
May I block users because of a VPN flag?
That is a business and legal decision, not a technical one. Many legitimate users run VPNs for privacy. We recommend using VPN signals at most for additional verification steps rather than blanket blocking.
Are my inputs stored?
No. IPs you enter are processed in memory and not stored for tracking purposes. The page sets no cookies; our own cookieless reach measurement records no values you enter.
What does the risk rating mean?
The risk rating condenses the individual signals (anonymizing networks, hosting, abuse score) into a coarse level. It is a guideline value and does not replace your own fraud or security analysis.
Related tools
Continuous monitoring vs. one-shot?
XICTRAQ monitors uptime, SSL, security headers, GDPR and performance 24/7. Free plan, no credit card.