VPN & Proxy Detection
Flagged only after the protocol answers.
Most VPN detection is a lookup against someone else's list. GeoIPHub verifies: the scanner performs real protocol handshakes on 25+ ports across 11 VPN and proxy protocols, and cross-references server lists published by 10 VPN providers themselves — so when detection.is_vpn comes back true, there is evidence behind it, and detection.vpn_provider can tell you the operator by name.
- Active Handshake Verification
- 11 Protocols Probed
- Named Provider Attribution
- OpenVPN handshakeVerified
- WireGuard probeVerified
- NordVPN server listMatch
- WHOIS · 46 keywords3 hits
Active Handshake Verification
Before an IP is flagged, the scanner attempts real protocol handshakes on 25+ ports. A completed OpenVPN or WireGuard handshake is direct evidence — not an inference from a stale third-party list.
11 Protocols Probed
OpenVPN, WireGuard, IKEv2, PPTP, L2TP, Shadowsocks, SOCKS5, SOCKS4, HTTP CONNECT, and HTTP forward proxies — each identified by its own handshake, re-probed every 2 days.
Named Provider Attribution
Server lists are pulled from 10 VPN providers' own published APIs — NordVPN, Mullvad, Surfshark, Private Internet Access, Windscribe, AirVPN, IVPN, PrivadoVPN, Riseup, and FastestVPN. detection.vpn_provider returns the provider's name, not just a boolean.
ASN & WHOIS Signals
14 known VPN ASNs plus RDAP registration records from all 5 RIRs, analyzed against 46 VPN keywords. Infrastructure registered as VPN infrastructure rarely hides it in WHOIS.
Tor & Relay Detection
Tor exits come from the official Tor Project exit list, refreshed daily. iCloud Private Relay and Cloudflare WARP are detected separately as relays (detection.is_relay) — privacy relays are not VPNs, and the response keeps them distinct.
Scored, Not Just Boolean
Every lookup includes vpn_confidence (0–100) and proxy_score alongside the flags, and scoring.detection_methods names the exact signals that fired — so your thresholds rest on evidence you can read.
Free VPN detection API
Is there a free VPN detection API?
Yes. GeoIPHub's free tier includes 1,500 lookups per day with every data field — including the full detection group with vpn_provider attribution. One API key, no credit card. Without any key, anonymous requests are allowed at 30 lookups per minute.
How does GeoIPHub verify that an IP is a VPN?
By talking to it. The scanner performs real protocol handshakes on 25+ ports across 11 VPN and proxy protocols before an IP is flagged. That evidence is combined with server lists pulled from 10 VPN providers' own published APIs, 14 known VPN ASNs, and WHOIS records checked against 46 VPN keywords.
Can the API tell me which VPN provider an IP belongs to?
Yes. When an IP appears in a provider's own published server list, detection.vpn_provider names the provider — "NordVPN", "Mullvad", "Surfshark", and so on — instead of returning an anonymous boolean.
Ready to get started?
1,500 free requests per day. Every field included. No credit card required.