Privacy Check
Detect VPN, proxy or Tor exit nodes for any IP address.
About this tool
A privacy check classifies an IP address by the kind of network it belongs to: ordinary residential ISP, mobile carrier, hosting/datacentre, known VPN provider, public proxy, or a Tor exit relay. Each category is computed from a different signal — ASN type, reverse DNS pattern, presence in the Tor consensus, hits against published VPN egress lists — and the verdict is a weighted combination of all of them.
For Tor we read the official check.torproject.org exit list and refresh it hourly. For VPN providers we use the upstream commercial dataset that tracks the public exit IPs of the major paid services. Hosting and proxy classifications rely on ASN metadata: cloud/datacentre ASNs are inherently suspicious for end-user traffic, and any IP advertising open proxy ports lands on the proxy list. Residential is the default when none of the above match.
When to use this tool
- Account-creation fraud checks. Flag signups from datacentre IPs — real users almost never sign up from AWS.
- Bypass detection. Identify geo-restriction circumvention before honouring a country-gated feature.
- Forum and comment moderation. A new account posting from a Tor exit deserves the same treatment as a brand-new email from a disposable provider.
- Pre-payment risk scoring. Combine with billing-address country and IP geolocation country for a simple three-signal rule.
How to interpret the verdict
A "clean" residential verdict does not guarantee a real human (botnets run on residential IPs too) — it just means none of the known privacy signals triggered. A "VPN" or "Tor" verdict is high-confidence: someone is deliberately hiding their origin. "Hosting" is the most context-dependent category — legitimate API traffic, monitoring agents, and web scrapers all share this label. Use the per-signal breakdown to make the final call.Frequently asked questions
How fresh is the Tor exit list?
check.torproject.org. The list itself updates every few minutes as relays come and go, so our worst-case staleness is about an hour. A "Tor exit" verdict means the IP appeared in at least one recent consensus — a near-certain signal the user is on Tor.