Free tool

VPN Detection Test

Name: GeoIPHub API
Availability: InStock
Author: GeoIPHub

Check whether an IP address is a VPN exit, a proxy, or a privacy relay, and see which provider operates it when the evidence says so.

How it works

Verified, not guessed.

Most VPN checkers rely on static lists that go stale the moment a provider rotates its servers. GeoIPHub starts from the source: server lists pulled from the published APIs of 10 VPN providers: NordVPN, Mullvad, Surfshark, Private Internet Access, Windscribe, AirVPN, IVPN, PrivadoVPN, Riseup, and FastestVPN. When an exit matches, the response names the provider in detection.vpn_provider.

Before any IP is flagged, it is actively verified: real protocol handshakes on 25+ ports across 11 VPN and proxy protocols, including OpenVPN, WireGuard, IKEv2, PPTP, L2TP, Shadowsocks, SOCKS5, SOCKS4, and HTTP CONNECT. An IP that answers a WireGuard handshake is running WireGuard. That is evidence, not inference. Probes re-run every two days so verdicts stay current. WHOIS adds a third layer: RDAP records across all 5 regional registries are scanned for 46 VPN keywords.

The result is a verdict you can defend, with a vpn_confidence value from 0 to 100 attached to every answer.

Read how the detection engine works

FAQ

Frequently asked questions

How does GeoIPHub know an IP is a VPN?

Three independent layers: server lists published by 10 VPN providers themselves, active protocol handshakes on 25+ ports across 11 VPN and proxy protocols, and WHOIS registration text scanned for 46 VPN keywords across all 5 regional internet registries. An IP is flagged only when the evidence supports it.

Will it tell me which VPN provider it is?

When the IP appears in one of the 10 tracked providers' own published server lists, yes, the response names it in detection.vpn_provider, for example "Detected: NordVPN server". Exits from untracked providers are still detected by protocol handshakes, just without attribution.

Is iCloud Private Relay treated as a VPN?

No. Apple iCloud Private Relay and Cloudflare WARP are privacy relays and are flagged separately in detection.is_relay, so you can write different policies for relays than for full VPN tunnels.

Should I block every VPN?

Usually not. A VPN flag is a signal, not a verdict. Plenty of legitimate users browse through VPNs. GeoIPHub feeds the flag into a 0–100 fraud score with a recommended action (allow, review, step_up, block), so you can challenge instead of block.

More free tools