What does a missing field mean?

Absent means unknown, never false — a field we did not answer is simply not in the response, so read it as unknown. A flag that is present always answers, and its detail object comes back empty when nothing matched.

How fresh is the data?

Every dataset publishes its own cadence and last-updated date, and all eight rebuilt today. Tor IP, for example, refreshes daily.

Can I run detection without calling the API?

Yes. With the db.download scope every licensed dataset downloads as csvgz or mmdb. The endpoint answers 302 with a time-limited link to object storage, and poll metadata first if you only want to fetch when the build changed.

Are private and reserved addresses billed?

Not through an SDK: every official client answers private, loopback, link-local, documentation and multicast ranges, including 6to4 and Teredo, without a request. Sent to the API directly, they count against a keyless or Free plan allowance and cost nothing on a paid plan.

How do I tell a rate limit from a spent allowance?

Both arrive as HTTP 429, and Retry-After is the only difference. Present means a transient rate limit, so retrying works and the SDKs retry for you. Absent means an allowance is spent — raise your overage limit or wait for the window to roll over.

Accurate VPN detection,
with evidence.

Identify IPs as VPN, residential proxy, hosting server, Tor node, CDN or relay — with all the evidence.

Get a free API key Read the docsNo payment needed · 50,000 lookups per month

GETapi.vpndetection.io/

One API, every signal.

Get all our data in a single request. SDKs available in every major programming language and framework.

is_vpn

Commercial VPN infrastructure, with the operator named — over 2,200 providers tracked.

is_hosting

Hosting or cloud provider, attributed to the company that runs the range.

is_tor

Tor node. Rebuilt every day, so the answer is never stale.

is_cdn

CDN edge — so you stop scoring your own delivery network as a threat.

is_relay

Privacy relay egress, such as iCloud Private Relay.

is_resproxy

Seen in a residential proxy pool, with hits and days-seen across a rolling 90-day window.

is_dcproxy

Seen in a datacenter proxy pool, with the same persistence detail.

is_mobproxy

Seen in a mobile proxy pool riding carrier-assigned space.

import os
from vpndetection import VPNDetection
 
client = VPNDetection(os.environ["VPNDETECTION_API_KEY"])
 
result = client.lookup("45.83.91.1")
print(result.is_vpn)            # True
print(result.vpn.provider)      # 'mullvad'
print(result.hosting.provider)  # 'm247'

lookup.pypip install vpndetection

Also available for .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

Full databases, updated daily.

Full databases available directly, doing your lookups on-premise. Shipped as downloadable CSVGZ and MMDB files.

Full catalog →

start_ip	end_ip	provider	confidence	last_seen
216.131.87.112	216.131.87.127	ipvanish	high	2026-09-08
208.85.18.71	208.85.18.71	tunnelbear	high	2026-09-07
187.13.129.184	187.13.129.187	nordvpn	high	2026-09-07
172.235.240.0	172.235.240.11	metrovpn_net	medium	2026-09-04
95.170.13.20	95.170.13.23	pingvpn_pingsecure	low	2026-06-16

vpn_ip_v1

Entries

17,850,007

Refresh

Daily

CSVGZ

120 MB

MMDB

130 MB

Flags say what. Evidence says why.

Every flag arrives with the operator behind it, how strongly it is supported, when it was last observed — and for proxy pools, how persistent the address has been.

provider

Which operator the address belongs to, as a stable id you can key rules off.

confidence

How strongly the observation is supported — high, medium or low.

last_seen

The most recent day the address was observed in this role.

first_seen

How far back the sighting goes inside the dataset's time window.

hits

How many times the address turned up in the pool during the window.

hits_days_pct

The share of days it appeared on — persistence, not a one-off.

providers_num

How many distinct providers resold the same address.

45.83.91.1

Two signals, both corroborated

Commercial VPNhigh confidence

provider

mullvad

method

scan

last_seen

2026-09-02

Hosting and cloudhigh confidence

provider

m247

last_seen

2026-09-02

Pool persistence63% of days · 42 hits · 2 networks

An address seen on 63% of the last 90 days is a standing pool member. One sighting on one day is noise — and you can tell them apart before you decide.

Accurate coverage, wide tracking.

All major VPN and proxy providers are covered deeply and accurately.

144M

anonymous IPs

824M

hosting IPs

2.8K

providers

Daily

update frequency

NordVPN

Proton VPN

ExpressVPN

Surfshark

Mullvad

CyberGhost

Private Internet Access

Windscribe

IPVanish

TunnelBear

hide.me

PureVPN

Hotspot Shield

VyprVPN

Mozilla VPN

Norton VPN

PsiphonVPN Gate

Bright Data

Oxylabs

Decodo

IPRoyal

SOAX

Webshare

Rayobyte

DataImpulse

Proxy-Cheap

PacketStream

Infatica

ProxyEmpire

Massive

Shifter

Zyte

Pay for the depth you need.

Choose yearly and get 2 months freeFull pricing →

Starter

$15.83/mo

$190.00 billed yearly · save $38.00

250,000 requests per month

$0.09 per 1,000 after that

VPN detection

Provider and last seen

Hosting, Tor, relay and CDN

Flags only

Residential, datacenter and mobile proxies

Database downloads

Priority support

ScaleMost popular

$82.50/mo

$990.00 billed yearly · save $198.00

2,000,000 requests per month

$0.07 per 1,000 after that

VPN detection

Provider and last seen

Hosting, Tor, relay and CDN

+ provider, confidence, last seen

Residential, datacenter and mobile proxies

Flags only

Database downloads

Priority support

Max

$165.83/mo

$1,990.00 billed yearly · save $398.00

5,000,000 requests per month

$0.05 per 1,000 after that

VPN detection

+ confidence and detection method

Hosting, Tor, relay and CDN

+ provider, confidence, last seen

Residential, datacenter and mobile proxies

+ provider, first and last seen, hit counts

Database downloads

Priority support

Enterprise

Custom

Annual, priced to your volume

Custom request volume

Negotiated overage rate

VPN detection

+ confidence and detection method

Hosting, Tor, relay and CDN

+ provider, confidence, last seen

Residential, datacenter and mobile proxies

+ provider, first and last seen, hit counts

Database downloads

Bundled, licensed per dataset

Priority support

Named contact and agreed response times

Contact sales

No loose ends.

Read the docs →API reference →Email support →

On this page

Do I need an API key to start?

Not to try it — an unauthenticated request still answers ip and is_vpn under a small daily allowance. Signing up is free and lifts you to 50,000 lookups a month.

00 · No key

Start without signing up.

Paste it into a terminal — no account needed. 1k daily allowance per user, answering ip and is_vpn.

curl "https://api.vpndetection.io/45.83.91.1"

{
  "ip": "45.83.91.1",
  "is_vpn": true
}

01 · Free key

Sign up and get 50,000 requests a month.

No card, no sales call — the key is issued on signup.

Every request flags VPN IPs.

Upgrade only when you outgrow the allowance.

Get a free API key See pricing

Accurate VPN detection,with evidence.

One API, every signal.

Full databases, updated daily.

Flags say what. Evidence says why.

45.83.91.1

Accurate coverage, wide tracking.

Pay for the depth you need.

No loose ends.

Do I need an API key to start?

What does a missing field mean?

How fresh is the data?

Can I run detection without calling the API?

Are private and reserved addresses billed?

How do I tell a rate limit from a spent allowance?

Start without signing up.

Sign up and get 50,000 requests a month.

Accurate VPN detection,
with evidence.