GATE 07 · VPN DETECTOR
Is this IP a VPN, proxy or datacenter?
Quick answer: The VPN detector estimates whether an IP address belongs to a VPN, proxy, hosting company or Tor. It checks your own address, or one you paste in, against hosting and VPN networks, the Tor exit list and the address's reverse DNS name. VPNs on ordinary home addresses cannot be detected this way.
Checking…
IP geolocation by DB-IP (CC BY 4.0). Location is approximate and often points to your provider's nearest hub, not your address.
Checks your own address, or any IP you paste in, against three signals: hosting and VPN networks, the Tor exit list, and the address's reverse DNS name.
The result is an estimate. Everything is checked on our own server with a local database and list, and no paid detection service is used. Commercial VPNs that run on ordinary home or mobile addresses cannot be detected this way. Private and reserved addresses are not checked.
What this detector checks
A VPN or proxy hides your own address behind one that belongs to the service. Websites cannot see that directly, but they can look at who owns the address they do see. This tool does the same: it takes an IP address, finds the network it belongs to, and looks for three signs that the address is a server rather than an ordinary home or mobile connection.
By default it checks your own address, the one this page sees when it loads. You can also paste any IPv4 or IPv6 address. All of the checks run on our own server, using a local database and a local list. No paid detection service is used, and the address is not sent to another company.
The three signals
- Hosting or VPN network. We keep a list of well-known cloud, hosting and VPN-infrastructure networks, such as Amazon, Google, Hetzner, OVH, M247 and others, and compare the address's network with it. The list is built from public knowledge and is not complete.
- Tor exit list. The Tor Project publishes the addresses of its exit nodes. We download that list regularly and check whether the address is on it.
- Reverse DNS name. Many server addresses have a name that gives them away, such as one containing vpn, proxy or vps, while home connections often have names that mention dsl, cable or dhcp. We look the name up with a short timeout and treat it as a hint, never as proof.
How to read the verdict
- Likely VPN/hosting: the address belongs to a hosting, cloud or VPN network. Many VPNs and proxies run there, but so do ordinary servers and company systems.
- Tor exit node: the address is on the official Tor exit list.
- Looks like a home/mobile connection: no server signal was found, and the network looks like an internet provider.
- Unclear: there was no strong signal either way.
What it cannot detect
This is an estimate, not a guarantee. Some commercial VPNs and proxy services deliberately use addresses that belong to ordinary home or mobile customers, and a check like this one cannot tell them apart from real households. A single address can also be shared by many people, or change hands over time. Detection services that sell this data use much larger and more frequently updated lists, and even they get it wrong sometimes.
If you want to know whether your own VPN is leaking, run the full border check, the WebRTC leak test and the DNS leak test as well. They look at different things.
Frequently asked questions
Is the result proof that someone is using a VPN?
No. It only says what kind of network the address belongs to. A hosting address is common for VPNs and proxies, but it can also be a server, a company gateway or a cloud service. An address that looks like a home connection can still be a VPN or proxy.
Why does my VPN show as a home connection?
Some VPN and proxy services route traffic through addresses that belong to ordinary internet providers. They look like normal homes to every check that relies on the network owner, including this one, so they cannot be detected this way.
What is a Tor exit node?
Tor sends your traffic through several relays, and the last relay, the exit node, is the one websites see. The Tor Project publishes the list of exit addresses so websites can recognise them. This tool checks that list.
Why is a Google or Amazon address flagged?
Those companies run huge cloud platforms, and the address is registered to a hosting or cloud network rather than to a household. For example, Google's public DNS service shows up as hosting because it runs on Google's own network.
Does this tool store the addresses I check?
No results are saved. The address is part of the request, so it appears in our normal web server log for about two weeks, as described on the privacy page. Our server also asks DNS for the address's reverse DNS name.
How often is the data updated?
The Tor exit list is refreshed every hour. The network location database is refreshed monthly. The list of hosting and VPN networks is edited by hand when we notice changes.