How VPN Detection Works: ASNs and Blocklists
VPN detection works by deciding whether an IP address belongs to a network that is known to relay traffic for other people, using two main sources: the address's Autonomous System Number (ASN), which shows who operates the network, and blocklists of known VPN, proxy and Tor exit addresses. Neither source is complete, so detection is a probability estimate rather than a proof.
The reason this is possible at all is that a VPN exit has to live somewhere. Commercial VPN services rent servers in data centers and announce address space from a handful of networks, and those addresses behave differently from a home broadband connection. Detection tries to recognize that footprint.
Signal one: ASN attribution
Every public IP address sits inside a block announced by an Autonomous System, identified by an ASN. The ASN lookup returns the registered owner, organization and country for a number such as AS15169, and the main IP lookup returns the same asn and organization with every address. If the organization is a hosting company, a cloud platform or a CDN, the address is unlikely to be a person at home, and ipto exposes this as is_datacenter. If it is a consumer ISP, the address is probably a household or mobile subscriber. The background is covered in what an ASN is.
ASN evidence is strong for the common case, where a VPN provider runs servers in rented racks, but it has two weaknesses. Plenty of non-VPN traffic also comes from data centers: scripts, monitoring services, legitimate corporate egress, and cloud-hosted apps. And a VPN that exits through a consumer ISP leaves no data-center footprint at all. So the ASN is a prior, not a conclusion.
Signal two: published lists
The second source is lists of addresses already identified as VPN endpoints, proxies or Tor relays. Tor is the easiest case because the network publishes its relays openly, but exit lists change quickly, as discussed in why a static Tor exit list goes stale. For commercial VPNs, lists are assembled from observation and provider data, and they need frequent refresh because providers rotate and add servers constantly. On ipto the VPN, Tor and abuse feeds refresh every 6 hours and the IP and ASN datasets refresh daily, and the results appear as is_vpn, is_tor and is_abuser on the IP lookup. You can also browse the underlying threat feeds directly.
List evidence is more specific than ASN evidence, since an address on a list was individually identified. But it lags behind: a server added this morning may not be on any list until the next refresh, and lists can retain addresses that have since been reassigned to ordinary customers.
Combining the signals
The two sources complement one another. An address that is in a hosting ASN and on an exit list is a high-confidence VPN or proxy. An address that is only in a hosting ASN is worth treating cautiously but not automatically as a VPN. An address that matches a list but sits in a consumer ASN may be a stale entry or a residential exit. Running an address through the VPN, Tor and proxy checker shows which lists matched and which network the address belongs to, so you can see the evidence rather than only a yes or no.
Where detection misses
Be explicit about the blind spots when you design around the result:
- New or rotated servers can go undetected until feeds catch up.
- Residential proxies route through real home connections and look like ordinary users. ipto does not detect them; see residential proxy detection for why that is hard.
- IPv6: the VPN, Tor and abuse flags currently cover IPv4 ranges, so an IPv6 address returns false for them rather than a guess, even though ASN, organization and location still work.
- Self-hosted VPNs on a personal server in a small provider's range may never appear on any list.
Treat a negative result as "not known to be a VPN", not "definitely direct".
Using the result sensibly
Most VPN users are legitimate: employees on corporate tunnels, travelers, people who care about privacy. A flag works best as a risk input that triggers a proportionate response such as an extra verification step, a lower trust score or a manual review for high-value actions, not an automatic block. The patterns for this are in reducing false positives in VPN detection, and the fraud score checker shows how the IP signals can be combined with email, phone and User-Agent evidence into a single 0 to 100 score.
To try it, call GET https://ipto.to/v1/ip/:ip with addresses from your own logs (free, no signup, 1,000 requests per day) and inspect the flags next to the ASN. The response schema is in the API documentation.