VPN & Proxy Checker

Check whether an IP address is a known VPN exit node, Tor relay, or proxy. Backed by the same threat-feed data as the live VPN & Tor database.

Enter an IP address above and press Check.

VPN and Tor detection here works the same way as the bulk threat-feed database: known VPN server ranges built from BGP routing analysis and active enumeration, plus the Tor Project's official exit-node list, refreshed every 6 hours. This is a single-IP check against the same data behind every /v1/ip/:ip response.

What gets checked

VPN
The IP falls in a known commercial VPN server range. Provider name is included in the full API response when the ASN is registered exclusively to that operator.
Tor
The IP is a current Tor exit node — able to send traffic to the open internet — per the official Tor Project bulk list.
Proxy
Flags known proxy exit points not already categorized as VPN or Tor. Coverage is lower than the other two categories.

FAQ

If you are connected to a VPN right now, your traffic exits from the VPN server's address — that is exactly what should be flagged. Disconnect and check again to see your real exit IP.
Yes, regularly. Detection is only as current as the last 6-hour refresh, so a brand-new server on a provider that just leased new IP space may not be flagged immediately.
No — this checks against known VPN, Tor, and proxy ranges. Sophisticated or residential proxy networks that do not register dedicated IP ranges can evade range-based detection entirely.

About this tool

This tool checks whether an IP address is a known VPN exit node, Tor relay or proxy. It returns a clear yes or no together with the evidence, including the network the address belongs to and the lists that matched.

How it works

Detection combines ipto's threat-feed data, which is refreshed regularly, with ASN attribution, so a match can come from a published exit-node list or from the address sitting in a network that primarily offers hosting or VPN services. Our blog explains the approach in more detail.

What to keep in mind

No list can be complete: new VPN endpoints appear constantly and some services rotate addresses faster than any feed can follow, so a negative result means "not known", not "definitely clean". Using a VPN is also entirely legitimate, so a positive result is a signal to weigh, not a reason to block on its own.

Common uses

Teams use it to add context to sign-ups and payments, to explain why a visitor's location looks wrong, to enforce region-based licensing sensibly, and to triage suspicious sessions alongside the fraud score.

Related: IP abuse checker · Fraud score checker · Threat feeds · IP lookup