[ ANONYMITY DETECTION ]

See through
every tunnel

Identify VPNs, Tor exits, proxies and privacy relays in real time. Multiple independent signals converge into a single confidence score per IP address.

185.65.134.101vpndatacenterGET · 200 OK

is_vpntrue

is_proxyfalse

is_torfalse

is_icloud_relayfalse

is_anonymoustrue

is_datacentertrue

is_known_attackerfalse

is_known_abuserfalse

is_threatfalse

is_bogonfalse

scores.vpn_score97

scores.proxy_score4

scores.threat_score2

scores.trust_score18

{
  "ip": "185.65.134.101",
  "threat": {
    "is_tor": false,
    "is_vpn": true,
    "is_icloud_relay": false,
    "is_proxy": false,
    "is_datacenter": true,
    "is_anonymous": true,
    "is_known_attacker": false,
    "is_known_abuser": false,
    "is_threat": false,
    "is_bogon": false,
    "blocklists": [],
    "scores": {
      "vpn_score": 97,
      "proxy_score": 4,
      "threat_score": 2,
      "trust_score": 18
    }
  }
}

the response's threat object — with every plan

200+ Providers

18 Protocols

5 Signals

<40ms Response

Coverage

▸ is_vpn: true — vpn_score: 97 datacenter exit · Amsterdam, NL · trust_score: 18

[ 01 — SIGNALS ]

Multiple layers of detection

Each signal operates independently. When combined, they create a detection surface that's nearly impossible to evade across all vectors simultaneously.

01 — Internet Scanning

Active port and protocol fingerprinting

We continuously scan the entire IPv4 address space probing for open VPN and proxy ports. When we find an open port, we complete the full protocol handshake to confirm it's running VPN software — not just a coincidentally open port.

+ OpenVPN (UDP 1194, TCP 443), WireGuard (UDP 51820), IKEv2/IPSec

+ SOCKS4/5, HTTP CONNECT, Shadowsocks, V2Ray protocol detection

+ Full handshake validation eliminates false positives from open ports

+ Scans run continuously

02 — Network Lease Detection

Identifying infrastructure leased for anonymization

VPN providers lease IP space from hosting companies and cloud providers. We map the supply chain: which ASNs lease blocks to which downstream operators, and which of those downstream operators are known VPN or proxy services.

+ Tracks IP block assignments from RIRs through hosting providers to VPN operators

+ Detects when a hosting provider sub-leases ranges to anonymization services

03 — Behavioral Analysis

Traffic patterns reveal anonymized connections

VPN servers exhibit distinctive traffic patterns: hundreds of concurrent users from the same IP, connection multiplexing, and characteristic geo-impossibility patterns. We analyze aggregate behavioral signals without inspecting individual user traffic.

+ Multi-user detection: disproportionate session counts per IP

+ Geo-impossibility: same IP appears in incompatible geographies simultaneously

+ Time-of-day spread: VPN IPs show uniform 24-hour usage patterns unlike residential IPs

+ Protocol entropy analysis on aggregate connection metadata

04 — Per-Prefix Historical Context

Historical reputation at the network block level

We maintain rolling 12-month behavioral profiles for every announced prefix. When a VPN provider acquires new IP space, the prefix history detects the transition from legitimate hosting to anonymization infrastructure within hours.

+ 12-month rolling window per prefix with daily snapshots

+ Detects regime changes: hosting to VPN, ISP to residential proxy

+ Cross-references prefix history with WHOIS ownership changes

05 — BGP Observation

Routing table intelligence at global scale

We ingest data from BGP route collectors worldwide to observe how IP prefixes are announced. VPN providers exhibit distinctive BGP patterns including prefix announcements from known VPN ASNs.

+ Real-time BGP feed ingestion

[ 04 — Attributes ]

One call, complete classification

Every lookup carries the anonymity flags and the scores behind them. No separate endpoint; the VPN flag and the scores are part of Business and above.

Flags5 fields · threat

booleanthreat.is_vpn

Whether the address is an exit node of a commercial VPN service. About 2.6M addresses, refreshed daily.

booleanthreat.is_proxy

Whether the address is a known proxy: HTTP, HTTPS, SSL, SOCKS, CONNECT and transparent proxies.

booleanthreat.is_tor

Whether the address belongs to a node on the Tor network.

booleanthreat.is_icloud_relay

Whether the address belongs to Apple’s iCloud Private Relay.

booleanthreat.is_anonymous

True when either is_tor or is_proxy is true.

Hosting2 fields

booleanthreat.is_datacenter

Whether the address belongs to a datacenter, including every cloud provider. A strong hint of automated traffic.

stringasn.type

The usage type of the network: hosting, isp, cdn, business, edu, gov or mil.

Scores2 fields · threat.scores

numberthreat.scores.vpn_score

The probability, 0 to 100, that the address is the exit node of a commercial VPN.

numberthreat.scores.proxy_score

The probability, 0 to 100, that the address is a proxy.

[ 05 — USE CASES ]

Why teams detect VPNs

Fraud prevention

Flag transactions from anonymized IPs before they clear. Add VPN and proxy detection as a risk signal alongside device fingerprinting and velocity checks.

Content licensing

Enforce geographic content restrictions required by licensing agreements. Detect when users circumvent region locks via VPN or proxy.

Account security

Trigger step-up authentication when a login originates from a VPN. Protect high-value accounts without blocking all VPN users outright.

Ad verification

Filter invalid traffic from bots and click farms hiding behind proxies. Improve campaign ROI by ensuring ads reach real users in real locations.

Compliance & sanctions

Detect circumvention of geographic sanctions or export controls. Meet regulatory requirements for know-your-customer workflows.

Pricing integrity

Prevent price arbitrage where users switch VPN locations to exploit regional pricing differences on subscriptions and e-commerce.

See through
every tunnel

Multiple layers of detection

Active port and protocol fingerprinting

Identifying infrastructure leased for anonymization

Traffic patterns reveal anonymized connections

Historical reputation at the network block level

Routing table intelligence at global scale

Measured precision, not marketing claims

200+ providers tracked continuously

One call, complete classification

Flags5 fields · threat

Hosting2 fields

Scores2 fields · threat.scores

Why teams detect VPNs

Fraud prevention

Content licensing

Account security

Ad verification

Compliance & sanctions

Pricing integrity

VPN detection from Business

Product

Developers

Resources

Company

Legal

See throughevery tunnel

Multiple layers of detection

Active port and protocol fingerprinting

Identifying infrastructure leased for anonymization

Traffic patterns reveal anonymized connections

Historical reputation at the network block level

Routing table intelligence at global scale

Measured precision, not marketing claims

200+ providers tracked continuously

One call, complete classification

Flags5 fields · threat

Hosting2 fields

Scores2 fields · threat.scores

Why teams detect VPNs

Fraud prevention

Content licensing

Account security

Ad verification

Compliance & sanctions

Pricing integrity

VPN detection from Business

See through
every tunnel