VPN & Proxy Detector
Check whether an IP address is a VPN, proxy, Tor exit, or datacenter, with the signals behind the verdict.
Detecting your connection…
About the VPN & Proxy Detector
The VPN and proxy detector takes an IP address and tells you whether it looks like a regular residential connection or something else: a commercial VPN, an open or anonymising proxy, a Tor exit node, or a datacenter host. It loads with your own public IP filled in, so you can check how your connection appears to a website in one click, then look up any other address you need to investigate.
Each check returns a plain verdict (clean, suspicious, likely VPN, or VPN detected) alongside a score and confidence, the network the IP belongs to (its ASN and organisation), and, when one is identified, the VPN provider name. Most usefully, it shows the individual signals behind the verdict, so you can see exactly which checks fired rather than trusting a single opaque label. That transparency matters when you are disputing a false positive or deciding how much weight to put on the result.
Use it to understand why a sign-up or checkout was flagged, to vet an IP from your server logs, to confirm your own VPN is actually masking your network, or to triage suspicious traffic. Detection is a probability, not a certainty: privacy-respecting relays such as Apple iCloud Private Relay and Cloudflare WARP behave differently from traditional VPNs, and a clean verdict is not a guarantee of trust. The detection runs against the IPLogs service, which queries multiple intelligence sources; the IP you enter is sent there to be classified and is not linked to you.
Reach developers and designers who use these tools every day. Privacy-first, no trackers.
Frequently asked questions
What do the verdicts mean?
Clean means the IP looks like an ordinary residential or business connection. Suspicious means some signals fired but the evidence is mixed. Likely VPN means the balance of signals points to a VPN or proxy. VPN detected means the IP is strongly identified as one, often with a named provider.
How accurate is it?
Detection combines many independent sources, so it is reliable for well-known commercial VPNs and datacenter ranges, but it is a probability rather than proof. New or self-hosted VPNs can read as clean, and shared residential ranges can occasionally look suspicious. The signal list lets you judge the evidence yourself.
Does it work on IPv6?
Yes. Both IPv4 and IPv6 public addresses are supported. Private and reserved addresses are rejected because reputation only makes sense for routable public IPs.
Why was my own connection flagged as a VPN?
If you are on a commercial VPN, a cloud or hosting provider, or certain privacy relays, your traffic exits from an address that detection associates with those services. The signal list shows which source made the call, which is what you would cite when asking a site to allowlist you.
Does this run in my browser?
No. The check runs on our server, which queries the IPLogs detection service. The IP you enter is sent there to be classified, and IPLogs records the verdict for accuracy. The result is not stored by toolhq and is not linked to you.