Why Is My IP Address Flagged as a VPN or Proxy? How to Fix It

Netflix puts it like this, under error code E106: "You seem to be using a VPN or proxy. Please turn off any of these services and try again." (Netflix Help Center). In June 2024 an ISP posted to RIPE's anti-abuse list that customers on a whole /22 could not stream from Amazon Prime Video and Disney+, and saw this: "Your device is connected to the internet using a VPN or proxy service. Please disable it and try again." The operator had "confirmed that no VPN or proxy services are being used within our network" (RIPE anti-abuse-wg).

The hard part is that the site blocking you rarely built the flag. Most buy IP data from a vendor. The RIPE operator suspected the services' content delivery networks "(or third party blacklist providers)".

We are one of those vendors: GeoIPHub runs an IP intelligence API that labels addresses as VPN, proxy, Tor, relay or hosting. Below we run real flagged addresses through it and show which evidence fired on each, then sort the causes into what you can fix tonight and what only your ISP or the vendor can.

Why is my IP address flagged as a VPN or proxy?

Your IP address is flagged as a VPN or proxy because it matched at least one of about seven kinds of evidence. Our guide to how VPN and proxy detection works covers most of them in depth:

1. A provider's server list. The address is on a list of servers a VPN company publishes for its apps.
2. A protocol handshake. A scanner connected to the address and an OpenVPN, IKEv2/IPsec, PPTP, L2TP, SOCKS or HTTP proxy service answered.
3. A hosting network. The address belongs to a datacenter or cloud ASN or range. In GeoIPHub's API, no_ptr_datacenter adds that a hosting address has no reverse DNS name in our data.
4. Registry keywords. The WHOIS or RDAP record for the range mentions VPN or hosting terms.
5. Proxy lists and blocklists. A free-proxy list is proxy evidence. A spam or abuse list isn't, but some vendors fold it into the same flag.
6. The Tor exit list. The Tor Project publishes the addresses its exits use.
7. A privacy-relay range. Apple and other operators publish the egress addresses of relay services such as iCloud Private Relay.

These split into two groups, and the split decides who can fix the flag. Evidence of the first kind (a handshake, a proxy listener) is about something running on the connection. Evidence of the second kind (hosting range, shared address, history) is about the address or its network, and you can't change it from your sofa.

What each kind of flag looked like on seven real addresses

The evidence behind a flag tells you what kind it is. We looked up seven public addresses through the GeoIPHub API between 05:14:02 and 05:14:55 UTC on 26 October 2026. None of them is a home connection; each stands in for a cause you might hit.

One honest note: on the Tor exit and the Ahrefs crawler, no_ptr_datacenter is a gap in our stored reverse DNS. Both addresses resolve with dig -x today.

Here is the Mullvad lookup, trimmed, with values unedited. The field definitions explain every key:

vpn_confidence is not a probability that the address is a VPN. It records which path named the provider: 95 for the provider's own list, 90 for a resolved server hostname, 85 for our table of VPN-run networks, 80 for a public server list. A value of 100 means our own probe found a VPN it couldn't name, as on a NordVPN server we checked today. The paths are explained in how a VPN provider is named from an IP.

Following 45.83.220.7 from evidence to action

45.83.220.7 sits in Mullvad's network (AS39351, 31173 Services AB) but is not on Mullvad's published list: the copy we fetched at 05:20 UTC today has .68, .69 and .70 from that /24, not .7. So the name comes from our network table, and no handshake fired. known_vpn_server adds 36 points and datacenter_ip adds 10, which makes 46: review, not block.

A site using this result would look closer, not refuse you. A VPN label, the evidence behind it and the action are three different things: the listed Mullvad server, whose list entry marks it as a WireGuard server (wireguard_open), scores more than double.

Three things that are not VPN flags

• Hosting is not a VPN. 45.33.32.156 is a cloud server with nothing on it that looks like a VPN, and it scores 10, allow. Here is what a datacenter IP address is and why the label alone doesn't block.
• Blocklisted is not a VPN. 5.39.1.230 is a verified Ahrefs crawler listed by Spamhaus ZEN. It returns is_vpn false and 35, review, from the listings, not from any VPN evidence.
• A relay is not a VPN. 104.28.46.99 is an iCloud Private Relay egress address. Apple asks sites to "consider treating these addresses like larger carrier-grade NAT or enterprise IP addresses" (Apple Developer). We return is_relay, score it 9 and cap any relay at 60, so it never reaches block. Here is why a relay IP is not a VPN IP.

Why is my IP flagged as a VPN when I'm not using one?

An IP gets flagged as a VPN without one usually because of the address you were given, not anything you run. These are the common causes, with what each looks like in a lookup:

• Your ISP's range is classed as hosting. A small UK building ISP told a customer on BleepingComputer's forum that "some service providers will class certain AS/IP's as Data Centres." It also sold hosting and leased lines. GeoIPHub takes hosting from about 850 curated hosting ASNs plus official ranges from 10 cloud providers. In a lookup: is_hosting true and datacenter_ip, with no handshake method. Alone that scores low: 45.33.32.156 sits at 10.
• You share a CGNAT address. Carriers put many customers behind one public address. RFC 6598 reserves 100.64.0.0/10 for the link between carrier NAT and customer equipment. As IPinfo puts it, "If your connection uses CGNAT, you are already sharing a single public IP with multiple people and devices" (IPinfo Community). In a lookup: is_cgnat true, and a score held at 50 or under unless the address carries VPN, proxy, Tor, botnet or abuse evidence of its own.
• An app on your network is renting out your connection. IPinfo's post lists proxyware, residential-proxy SDKs bundled in apps, free VPN or proxy apps, and malware. GeoIPHub does not run residential-proxy detection of its own. In a lookup: if your address is on a third-party list of addresses seen proxying in the last day, our API shows is_proxy true with the method proxy_observed_third_party; otherwise a flag of this kind comes from vendors that track proxy pools, IPinfo among them.
• The address has history. ISPs recycle addresses. If an earlier subscriber ran a proxy or sent spam, lists may still carry the address after it reached you. In a lookup: known_spammer, abusive_listed or proxy_observed_third_party (datacenter_blocklisted if the range is also classed as hosting).
• You are on a work VPN, iCloud Private Relay, Cloudflare WARP or a cloud browser. These really do relay your traffic, so the flag is correct, even if unwelcome. In a lookup: known_vpn_server, a handshake method such as openvpn_open or ipsec_open, or relay_ip. Turning the service off for that one site is the fix.

If the label you got is a risk number rather than a VPN label, that is a different question: here is what your IP fraud score means.

Why is my IP address flagged as an open proxy?

An IP address is flagged as an open proxy when a list or a probe saw a relay at it that anyone on the internet could use. Some Instagram users report being told their IP looks like an open proxy. We found no Meta help page that explains the check, so we can only describe what such a flag usually means.

Our scoring code weighs the two kinds of proxy evidence differently. A SOCKS or HTTP proxy our scanner confirmed by handshake (socks5_open, http_proxy_open) counts nearly twice as much as an address seen only on a third-party proxy list (proxy_observed_third_party). A comment in that code gives the reason: such addresses "are shared and rotate daily, so it is a reason to look closer, not the near-block weight of a proxy we verified."

Our proxy handshakes run on ports such as 1080, 3128 and 8080. Candidate addresses come from hosting networks, VPN providers' ranges and public free-proxy lists. We never sweep home connections in general, so a home address gets a proxy probe from us only if a public list already named it.

What to check if you get an open-proxy flag:

• Proxy settings and extensions. Look at the system proxy settings and every browser extension on each device.
• Router port forwards and remote management. Remove any forward you did not set, and turn off remote administration unless you need it.
• Router firmware. Install the latest version, which closes known holes.
• "Passive income" apps. Uninstall anything that pays you for sharing bandwidth, on every device in the home.
• Malware. Run a full scan on each computer.

On a Mac, this lists every program accepting connections, so an unknown listener on a proxy port stands out:

How do I check if my IP is flagged as a VPN?

Check the address the internet actually sees, with a lookup that shows its evidence, not just a yes or no. Four steps:

1. Open see your public IP and what it is flagged as. It looks up your own address and shows the VPN, proxy, Tor, relay and CGNAT flags, vpn_confidence, the fraud score, the recommended action and the detection methods that fired.
2. For a quick yes or no, check whether your IP is flagged as a VPN. To test any other address, look up any IP.
3. Compare your router's WAN address with your public IP. If the WAN address starts with 100.64 to 100.127 (inside 100.64.0.0/10), you are behind CGNAT. This check is the reliable one: a "No" for CGNAT in the tool doesn't rule it out. Netflix's own check is fast.com: select "Show more info" and compare the country beside "Client" with where you are.
4. If you are comfortable with a terminal, call the API directly and read meta.last_scanned, which our tools don't show yet:

Without a key, keep it to a handful: the 30th anonymous call in a minute already fails and locks you out for two hours.

The site that blocked you may use another vendor, and a clean result here doesn't clear you there. "Not detected" isn't "clean" on our side either: of two VPN servers we checked today, we missed a PIA server as a VPN (it scored 64 on a Barracuda listing instead) and caught a NordVPN server by its IPsec handshake without naming it.

How to fix a VPN or proxy flag yourself

You can remove any cause that runs on your own connection, but the flag itself stays until the vendor rescans and rebuilds its data. Steps 1 and 6 show a result straight away. Work down this list, retrying the blocked site after each step:

1. Turn off the VPN, iCloud Private Relay or proxy extension and retry. If the block disappears, the flag was correct and the fix is to exclude that site.
2. Remove proxyware and free VPN apps from every device on the network. One phone sharing bandwidth is enough to list the whole household's address.
3. Close router port forwards you didn't set and update the firmware. That removes an open listener a scanner could confirm.
4. Scan for malware. Botnets sell proxy access through infected machines.
5. Restart the router or ask your ISP for a new address. This only works where the ISP hands out a fresh one, and a new address can carry its own history.
6. Test on mobile data. If the site works there, the address is the cause, not your device or account.

What you can't fix yourself, and who can

You can't change how your address or its network is classed, and that is often the real cause of a VPN or proxy flag. The ASN or range classification, a shared CGNAT address, a relay's egress address and another vendor's database all sit outside your control.

Three parties can act. Your ISP owns the range and its registry records, and can ask vendors to reclassify it. The site that blocked you can allow you, or tell you which vendor it uses. The vendor can change its record. For the site's side, see how sites avoid blocking real customers on a VPN flag; for a high risk score, see how to bring a high score down.

How long does a VPN or proxy flag last?

A VPN or proxy flag lasts until the evidence changes and the vendor rebuilds its data, and most vendors don't publish a period. GeoIPHub's windows, from our scanner's code and configuration on 26 October 2026:

meta.last_scanned is the field to read. Our docs describe it as the time of the most recent scan; in our build it is when that address's record was last written. It is not the day a flag was first set. Don't use meta.last_classified_at for this: it is the time the response was built, so it always equals the moment you asked.

Other vendors run longer windows. IPinfo's residential-proxy figure "shows for how many days within the last 90 days your IP address was part of a residential proxy pool" (IPinfo Community), so a cleaned connection can take up to 90 days to read zero there. We watched a verdict move on a real address in how long an IP verdict lasts.

How to appeal a VPN or proxy flag

Ask the site that blocked you first, because it chose the vendor and can override it. Netflix's help page has you run fast.com and, if the client country and IP match your home connection, ask your ISP to contact Netflix customer service. Netflix also says "VPNs aren't supported for watching Live events on Netflix or if you're on an ad-supported experience."

If you know which vendor holds the flag, these are the routes we could confirm on 26 October 2026:

Whoever you write to, include the IP, the date and time with time zone, the exact error text and code, the site, and what you already ruled out. "Your data is wrong" gives a vendor nothing to check.

For network operators: how to get an IP range removed from VPN lists

If your IP range is flagged as a VPN, find out which vendor holds the flag, then send that vendor evidence about the range, not complaints. When the RIPE operator asked for help with his /22, Michele Neylon of Blacknight replied: "Been there. It's an absolute pain." (RIPE anti-abuse-wg). It is fixable, one vendor at a time.

Find the vendor. Ask the streaming service's network or partner contact which vendor it uses. Test a few sample addresses on the vendors' public lookup pages and note which ones flag them.

Send evidence the vendor can verify:

• The registry record. The RDAP or WHOIS entry showing the range's assignment and its use.
• A plain statement. The range carries end-user broadband, with no VPN, proxy or hosting service on it.
• Your abuse contact. Vendors see it as network.abuse_contact; keep it current, the same address people use to report an IP to its network's abuse contact.
• Dates. When the range was reassigned or bought, if it once belonged to a hosting or VPN company.
• Examples. A few affected addresses with the time each was flagged.

A geofeed (RFC 8805) carries location only, so on its own it won't clear a VPN label.

To start, open the what-is-my-ip tool, read which method fired, and go to what you can fix yourself or who can fix the rest. The method tells you whether the flag is right, and whose job it is to fix it.

Frequently Asked Questions

Why is my IP flagged as a VPN when I'm not using one?

Usually because of the address, not your devices. Your ISP's range may be classed as hosting, you may share a CGNAT address with many customers, an app may be renting out your connection as a proxy, or the address carries an earlier user's history. A lookup that lists its detection methods, like GeoIPHub's, shows which evidence fired, though no single vendor sees every cause.

How do I check if my IP is flagged as a VPN?

Open a what-is-my-ip page that runs a full lookup, such as GeoIPHub's, and read the VPN, proxy and relay flags and the detection methods. Other vendors can disagree, so if a specific site blocks you, ask which IP data vendor it uses.

Why is my IP address flagged as an open proxy?

Either a proxy list includes your address, or a scanner completed a proxy handshake on a port such as 1080, 3128 or 8080. In GeoIPHub's API a listing alone shows as proxy_observed_third_party. Check router port forwards, proxy settings and apps that share bandwidth, then ask your ISP for a new address if the listing persists.

What does Netflix error E106 mean?

Netflix shows E106 with the message "You seem to be using a VPN or proxy" when it believes your connection comes through one. Turn off any VPN, proxy or relay and retry. If you use none, Netflix's help page points you to fast.com and then to your ISP, since the address itself may be classed as a VPN or hosting address.

How long does a VPN or proxy flag last?

Until the evidence changes and the vendor rebuilds its data. Most vendors don't publish a period. In GeoIPHub's scanner, a handshake that can't be re-confirmed drops after 30 days, a provider-list name after 14 days off the list, and a third-party proxy listing on the next 6-hourly run after the address leaves that list; changes go live with the daily rebuild. IPinfo's residential-proxy figure looks back 90 days.

How does an ISP get its IP range removed from VPN lists?

Find out which vendor holds the flag, then send that vendor the registry record for the range, a plain statement that it carries end-user broadband, a current abuse contact, reassignment dates and a few affected addresses with timestamps. Expect to repeat this vendor by vendor.

Can I get my IP removed from a VPN list?

Ask the site that blocked you first, then the data vendor. IPQS takes reports through a form and says it reviews them within 24 to 48 hours; IPinfo asks your ISP to contact it. GeoIPHub has no self-serve dispute channel today.

Is iCloud Private Relay flagged as a VPN?

It shouldn't be. It is a relay, and Apple asks sites to treat its addresses like carrier-grade NAT. GeoIPHub's API returns is_relay rather than is_vpn for Apple's listed egress addresses, and caps a relay's score at 60, so the IP alone can never reach block.