VPN/Proxy Detection
Accurately identify connections routed through VPNs, proxies, Tor exit nodes, and hosting infrastructure. Go beyond simple blacklists with behavioral analysis and provider fingerprinting.
$ curl https://api.iptruth.com/ip/104.28.203.1 { "ip": "104.28.203.1", "is_vpn": true, "is_proxy": false, "is_tor": false, "is_residential_proxy": false, "vpn_provider": "Cloudflare WARP", "proxy_type": null, "detection_method": "infrastructure_fingerprint", "network": { "asn": 13335, "as_name": "CLOUDFLARENET" }, "classification": { "usage_type": "commercial_vpn" } }
VPN Provider Identification
Identify connections from 200+ commercial VPN providers including NordVPN, ExpressVPN, Surfshark, and more with provider-level classification.
Proxy Classification
Distinguish between HTTP proxies, SOCKS proxies, residential proxies, and datacenter proxies with behavioral analysis and network fingerprinting.
Tor Detection
Track Tor exit nodes and relay IPs with hourly updates from the Tor network consensus. Detect both direct and bridge-based Tor connections.
How It Works
IPTruth combines four detection methods for comprehensive coverage: active probing tests network behavior against known VPN and proxy signatures; behavioral analysis identifies traffic patterns characteristic of tunneled connections; infrastructure fingerprinting matches IP ranges against known VPN and proxy provider networks; and provider database matching cross-references a continuously updated catalog of 200+ commercial VPN services.
Our system distinguishes commercial VPNs (NordVPN, ExpressVPN) from corporate VPNs and enterprise proxies, so you can enforce different policies for privacy tools versus legitimate business infrastructure. Residential proxy detection identifies IPs that route traffic through real residential connections -- a growing vector for fraud that evades traditional datacenter-based detection.
Tor detection tracks exit nodes, relays, and bridge nodes with hourly updates from the Tor network consensus, covering both direct connections and obfuscated bridge-based access.
Use Cases
Fraud Prevention
Block fraudulent transactions originating from anonymizing services used to mask true location and identity.
Content Licensing
Enforce geographic content restrictions by detecting VPN-based geo-spoofing attempts that circumvent licensing agreements.
Price Integrity
Prevent price arbitrage by identifying users who hide their true location to exploit regional pricing differences.
Account Security
Flag suspicious login attempts from VPNs or proxies that deviate from a user's normal access patterns.
Ready to get started?
Start with 1,000 free lookups per day. No credit card required.