Skip to content

Is this IP a VPN, proxy or Tor exit?

Check any address — or your own — against provider flags, hosting ranges and the Tor exit list.

Runs on our server; the query is not stored.

What it looks at#

There is no single flag on an IP address that says "this is a VPN". The verdict is assembled from several signals, and each one is imperfect on its own.

  • Provider flags. The IP intelligence provider reports whether the address is a known VPN, proxy, hosting or mobile address.
  • The Tor exit list. The Tor network publishes the addresses of its exit relays, so Tor is the one case that can be checked against an authoritative list.
  • The network itself. The ASN and connection type of the address show whether it sits in a residential ISP, a mobile carrier or a data centre. Almost all commercial VPNs run from data centres.

How to read the verdict#

The three verdicts
VerdictMeaning
MaskedThe address belongs to a VPN, proxy, Tor exit or data-centre network
Not maskedIt looks like an ordinary consumer connection
No verdictThe provider used for this lookup does not report masking flags, so the tool declines to guess

What a "not masked" result does and does not prove#

It means no signal matched. It does not mean nobody is hiding behind the address. New VPN ranges take time to be listed. Residential proxy networks route traffic through real home connections precisely so that they look ordinary. A VPN you run yourself on a small server can go unlisted for a long time. Treat "masked" as informative and "not masked" as unproven.

Why anyone checks#

  • Site owners use the same signals for fraud scoring, rate limiting and enforcing content licences.
  • VPN users check that a service they pay for actually looks like a VPN, and that the address it gives them is not shared with abuse. Pair this with the leak test.
  • Anyone reading a log wants to know whether a strange address is a person or a server.