Free tool

VPN Detection Test

Name: GeoIPHub API
Availability: InStock
Author: GeoIPHub

Check whether an IP address is a VPN exit, a proxy, or a privacy relay, and see which provider operates it when the evidence says so.

How it works

Verified, not guessed.

Most VPN checkers rely on static lists that go stale the moment a provider rotates its servers. GeoIPHub starts from the source: server lists pulled from the published APIs of 10 VPN providers: NordVPN, Mullvad, Surfshark, Private Internet Access, Windscribe, AirVPN, IVPN, PrivadoVPN, Riseup, and FastestVPN. When an exit matches, the response names the provider in detection.vpn_provider.

Before any IP is flagged, it is actively verified: real protocol handshakes on 25+ ports across 11 VPN and proxy protocols, including OpenVPN, WireGuard, IKEv2, PPTP, L2TP, Shadowsocks, SOCKS5, SOCKS4, and HTTP CONNECT. An IP that answers a WireGuard handshake is running WireGuard. That is evidence, not inference. Probes re-run every two days so verdicts stay current. WHOIS adds a third layer: RDAP records across all 5 regional registries are scanned for 46 VPN keywords.

The result is a verdict you can defend, with a vpn_confidence value from 0 to 100 attached to every answer.

Read how the detection engine works

Can it be detected?

Can you detect a VPN from an IP address?

Yes — not by seeing inside the tunnel, but by recognizing the exit. A VPN releases traffic onto the internet from a server, so the address you receive belongs to the VPN's infrastructure. That infrastructure is identifiable three ways, which is exactly what this test checks:

It is on a provider's own server list. VPN apps need somewhere to connect, so providers publish their endpoints. An IP in one of those lists is a confirmed exit — and the test names the provider when it can.
It sits on the wrong kind of network. VPN servers live in datacenter and hosting ranges, where real consumers essentially never browse from. A "home user" arriving from a hosting network is already anomalous.
It answers like a VPN. A machine that completes an OpenVPN or WireGuard handshake is running that protocol — the difference between a guess and proof.

To check your own connection, paste your current IP into the test above. For the full mechanics — and why no single one of these signals is enough on its own — see what a VPN is and how to detect it and how VPN and proxy detection actually works.

FAQ

Frequently asked questions

How does GeoIPHub know an IP is a VPN?

Three independent layers: server lists published by 10 VPN providers themselves, active protocol handshakes on 25+ ports across 11 VPN and proxy protocols, and WHOIS registration text scanned for 46 VPN keywords across all 5 regional internet registries. An IP is flagged only when the evidence supports it.

Will it tell me which VPN provider it is?

When the IP appears in one of the 10 tracked providers' own published server lists, yes, the response names it in detection.vpn_provider, for example "Detected: NordVPN server". Exits from untracked providers are still detected by protocol handshakes, just without attribution.

Is iCloud Private Relay treated as a VPN?

No. Apple iCloud Private Relay and Cloudflare WARP are privacy relays and are flagged separately in detection.is_relay, so you can write different policies for relays than for full VPN tunnels.

Should I block every VPN?

Usually not. A VPN flag is a signal, not a verdict. Plenty of legitimate users browse through VPNs. GeoIPHub feeds the flag into a 0–100 fraud score with a recommended action (allow, review, step_up, block), so you can challenge instead of block.

More free tools