IP & Network

Privacy Check

Detect VPN, proxy or Tor exit nodes for any IP address.

About this tool

A privacy check classifies an IP address by the kind of network it belongs to: ordinary residential ISP, mobile carrier, hosting/datacentre, known VPN provider, public proxy, or a Tor exit relay. Each category is computed from a different signal — ASN type, reverse DNS pattern, presence in the Tor consensus, hits against published VPN egress lists — and the verdict is a weighted combination of all of them.

For Tor we read the official check.torproject.org exit list and refresh it hourly. For VPN providers we use the upstream commercial dataset that tracks the public exit IPs of the major paid services. Hosting and proxy classifications rely on ASN metadata: cloud/datacentre ASNs are inherently suspicious for end-user traffic, and any IP advertising open proxy ports lands on the proxy list. Residential is the default when none of the above match.

When to use this tool

  • Account-creation fraud checks. Flag signups from datacentre IPs — real users almost never sign up from AWS.
  • Bypass detection. Identify geo-restriction circumvention before honouring a country-gated feature.
  • Forum and comment moderation. A new account posting from a Tor exit deserves the same treatment as a brand-new email from a disposable provider.
  • Pre-payment risk scoring. Combine with billing-address country and IP geolocation country for a simple three-signal rule.

How to interpret the verdict

A "clean" residential verdict does not guarantee a real human (botnets run on residential IPs too) — it just means none of the known privacy signals triggered. A "VPN" or "Tor" verdict is high-confidence: someone is deliberately hiding their origin. "Hosting" is the most context-dependent category — legitimate API traffic, monitoring agents, and web scrapers all share this label. Use the per-signal breakdown to make the final call.

Frequently asked questions

How fresh is the Tor exit list?

We re-download the official Tor exit list every hour from check.torproject.org. The list itself updates every few minutes as relays come and go, so our worst-case staleness is about an hour. A "Tor exit" verdict means the IP appeared in at least one recent consensus — a near-certain signal the user is on Tor.

Can a VPN beat this tool?

Some can. Major commercial VPNs (NordVPN, ExpressVPN, Surfshark, ProtonVPN) are well-mapped and detected reliably. Smaller or self-hosted VPNs on residential IPs (a Mullvad-style "residential VPN" or a personal WireGuard on a home server) will pass as residential — there is no public list to check them against. No IP-based system catches 100%; pair with device fingerprinting for sensitive flows.

Why does my own IP show as a VPN when I am not using one?

A few cases trigger false positives: your ISP recently bought a CIDR block that a VPN provider previously used; you are on CGN sharing an IP with someone who runs a VPN; your home router has a VPN client always-on. Run the IP Whois lookup to see what organization currently owns the block — if it is an ISP, the verdict is a leftover from the previous owner and should self-correct in a few days.

Is "hosting" always bad?

No — it is just a strong hint that the IP is not an end-user. Legitimate uses include API integrations, monitoring agents, headless screenshot services, search-engine crawlers and developer testing. The right reaction depends on context: for a banking signup, "hosting" is a hard block; for a public API, it is fine; for a comments form, it is worth pairing with rate-limiting and captcha.