Privacy Check
Detect VPN, proxy or Tor exit nodes for any IP address.
This IP is on a hosting / datacenter ASN (cloudflare) — likely a server, VPN exit, or proxy, not a residential connection.
- Hosting ASN
What does each field mean?
Field reference
VPN
Detection based on CIDR ranges published by major VPN operators (NordVPN, ExpressVPN, ProtonVPN, Mullvad, etc.). Heuristic: small false-positive rate, but emerging providers may be missed for a few weeks after launch.
Tor
Tor publishes the live list of exit relays at <code>check.torproject.org</code>. Detection is exact: if listed, the IP is a Tor exit right now; if delisted, it may still have been an exit hours ago.
Hosting / datacenter
Detected via ASN classification — AWS, Google Cloud, Azure, DigitalOcean, OVH, Hetzner all return "hosting". A real user typically connects from a consumer ISP; a hosting IP often indicates a bot, scraper, or proxy server.
Confidence
Aggregate score based on the strength of every signal: exact list match (high), ASN heuristic (medium), reverse-DNS pattern (low). Use as a rule-of-thumb, not a binary boolean — true production decisions should rely on multiple data sources.
Signals
Lists each rule that fired (ASN matches a hosting AS; reverse-DNS contains "vpn"; CIDR is on a known VPN range; exit-node listed by Tor) along with the contribution to the final confidence score.
Verdict
Plain-English summary of the strongest signal. "Clean" doesn't prove residential IP — only "no anonymizer detected". "Mixed" means multiple categories fired (e.g., a VPN that's also a hosting IP) and you should inspect the signals list.
Organization
WHOIS organization name. A name like "Comcast Cable" or "Vodafone" → consumer ISP. A name like "Amazon Technologies" or "Hetzner Online" → datacenter. A name like "M247" or "Datacamp Limited" → frequently used by VPN providers.
ASN
See "ASN" under Whois IP. We classify ASNs into ISP / hosting / academic / VPN / Tor-exit categories using public datasets and our own observations.
About this tool
A privacy check classifies an IP address by the kind of network it belongs to: ordinary residential ISP, mobile carrier, hosting/datacentre, known VPN provider, public proxy, or a Tor exit relay. Each category is computed from a different signal — ASN type, reverse DNS pattern, presence in the Tor consensus, hits against published VPN egress lists — and the verdict is a weighted combination of all of them.
For Tor we read the official check.torproject.org exit list and refresh it hourly. For VPN providers we use the upstream commercial dataset that tracks the public exit IPs of the major paid services. Hosting and proxy classifications rely on ASN metadata: cloud/datacentre ASNs are inherently suspicious for end-user traffic, and any IP advertising open proxy ports lands on the proxy list. Residential is the default when none of the above match.
When to use this tool
- Account-creation fraud checks. Flag signups from datacentre IPs — real users almost never sign up from AWS.
- Bypass detection. Identify geo-restriction circumvention before honouring a country-gated feature.
- Forum and comment moderation. A new account posting from a Tor exit deserves the same treatment as a brand-new email from a disposable provider.
- Pre-payment risk scoring. Combine with billing-address country and IP geolocation country for a simple three-signal rule.
How to interpret the verdict
A "clean" residential verdict does not guarantee a real human (botnets run on residential IPs too) — it just means none of the known privacy signals triggered. A "VPN" or "Tor" verdict is high-confidence: someone is deliberately hiding their origin. "Hosting" is the most context-dependent category — legitimate API traffic, monitoring agents, and web scrapers all share this label. Use the per-signal breakdown to make the final call.Frequently asked questions
How fresh is the Tor exit list?
check.torproject.org. The list itself updates every few minutes as relays come and go, so our worst-case staleness is about an hour. A "Tor exit" verdict means the IP appeared in at least one recent consensus — a near-certain signal the user is on Tor.