Skip to content
VPNDetection

Every signal, on every plan.

Every paid plan returns all nine datasets with every field, plus where the address is and which network announces it. The plans differ only in the lookups they include.

Choose yearly and get 2 months free
Starter
250,000
lookups a month
$15.83/mo
$190.00 billed yearly · save $38.00
Then $0.09 per 1,000
ScaleMost popular
2,000,000
lookups a month
$82.50/mo
$990.00 billed yearly · save $198.00
Then $0.07 per 1,000
Max
5,000,000
lookups a month
$165.83/mo
$1,990.00 billed yearly · save $398.00
Then $0.05 per 1,000
Enterprise
5M+
lookups a month, priced to fit
Custom
Annual, priced to your volume
Database licenses bundledNamed contact, agreed response times, DPA
Free: 50,000 lookups a month
VPN, Tor and relay detection, plus the address's location and ASN. No card, issued the moment you sign up, and the same account downloads Tor IP and Relay IP for free.
Get a free API key

Every paid lookup answers all of this

Starter answers exactly what Max does. This is an illustration, with every object filled at once, which no real address is: 198.51.100.24 is a documentation address.

{
"ip": "198.51.100.24",
The address you asked about.
"is_vpn": true,
A commercial VPN exit. The operator is named in the vpn object.
"is_hosting": true,
Leased hosting or cloud space. Infrastructure, not anonymity on its own.
"is_relay": true,
A privacy relay, such as iCloud Private Relay, or an enterprise web gateway, such as Zscaler.
"is_tor": true,
A Tor node, from the public Tor set, rebuilt daily.
"is_cdn": true,
A content-delivery edge. Grouped with hosting, not with anonymity.
"is_resproxy": true,
Seen in a residential proxy pool over a rolling 90-day window.
"is_dcproxy": true,
Seen in a datacenter proxy pool over the same window.
"is_mobproxy": true,
Seen in a mobile proxy pool riding carrier-assigned space.
"is_pubproxy": true,
A public proxy anyone can connect through listens on the address or sends its traffic out from it, over the same window.
"vpn": {
Which VPN it is, and how sure we are.
"provider": "mullvad",
The operator this address belongs to, as a stable id you can key rules off.
"last_seen": "2026-10-19",
The most recent build in which we observed it.
"confidence": "high"
How strongly the observation is supported: high, medium or low.
},
"hosting": {
The hosting provider behind the address.
"provider": "m247",
"confidence": "high",
"last_seen": "2026-10-19"
},
"relay": {
The relay's or gateway's operator, in the same fields.
"provider": "apple_private_relay",
"confidence": "high",
"last_seen": "2026-10-19"
},
"tor": {
The same fields. Tor has no operator, so provider is empty.
"provider": "",
"confidence": "high",
"last_seen": "2026-10-19"
},
"cdn": {
The edge network's operator, in the same fields.
"provider": "gcore",
"confidence": "high",
"last_seen": "2026-10-19"
},
"resproxy": {
Who resells the address, and how often it turned up in 90 days.
"provider": "netnut",
"first_seen": "2026-07-23",
The first build inside the window in which we observed it.
"last_seen": "2026-10-18",
"hits": 8,
How many times the address was observed during the window.
"hits_days_pct": 6,
Share of days in the window on which the address appeared.
"providers_num": 7
How many distinct providers resold this address.
},
"dcproxy": {
The same fields, from a datacenter proxy pool.
"provider": "floppydata",
"first_seen": "2026-08-02",
"last_seen": "2026-10-17",
"hits": 13,
"hits_days_pct": 9,
"providers_num": 3
},
"mobproxy": {
The same fields, from a mobile proxy pool.
"provider": "dataimpulse",
"first_seen": "2026-09-14",
"last_seen": "2026-10-16",
"hits": 17,
"hits_days_pct": 12,
"providers_num": 2
},
"pubproxy": {
A public proxy's own record.
"entry": true,
Whether a public proxy listens on this address.
"exit": true,
Whether a public proxy's traffic leaves from this address.
"protocols": ["http", "socks5"],
What the proxies on this address speak: HTTP, HTTPS, SOCKS4 or SOCKS5.
"num_ports": 2,
How many ports a public proxy listens on at this address.
"num_proxies": 3,
How many public proxies' traffic leaves from this address.
"last_seen": "2026-10-19",
"last_usable": "2026-10-18"
The last day a request through a proxy on this address was answered.
},
"location": {
Where the address is, to the country.
"continent": "EU",
The continent, as a two-letter code and a name.
"continent_name": "Europe",
"country": "DE",
The ISO 3166 country, as a code and a name.
"country_name": "Germany",
"timezone": "Europe/Berlin",
The address's IANA timezone.
"currency_code": "EUR",
The country's currency.
"currency_name": "Euro",
"currency_symbol": "€",
"flag_emoji": "🇩🇪",
The country's flag, and its code points.
"flag_unicode": "U+1F1E9 U+1F1EA"
},
"asn": {
The network that announces the address.
"asn": 64500,
The AS number, 0 when no announcement covers the address.
"name": "Example Hosting GmbH",
Who runs the AS.
"domain": "example.net",
The AS operator's own domain.
"type": "hosting",
The kind of network: isp, hosting, education, government or business.
"prefix": "198.51.100.0/24"
The announced prefix that covers the address, the most specific when several do.
}
}

IPv4 and IPv6 · batches of 1,000 · 12 SDKs, a CLI and MCP

What each key returns

Three answers: no key, a free key and any paid plan. A field missing from an answer is not on that key, never a "no".

Feature
No key1,000 a day per address
Free key50,000 a month
Any paid plan250K to 5M a month
Anonymity
VPN flag
is_vpn: commercial VPN exits
VPN provider and evidence
vpn: the provider, the last day we saw it there and how sure we are
Tor
is_tor and tor: confidence and last seen
Privacy relays and web gateways
is_relay and relay: iCloud Private Relay, Zscaler and the like
Hosting and CDN
is_hosting and is_cdn, each with its provider, confidence and last seen
Residential, datacenter and mobile proxies
The flags, and who resells the address, when it was first and last seen, how often, and how many networks resell it
Public proxies
is_pubproxy, which end of a proxy the address is, its protocols and the last day one answered
Location and network
Location
location: continent, country, timezone, currency and flag
Network
asn: the announcing network's number, name, domain, type and prefix
Limits and databases
Lookups
Bogons sent to the API count without a key and on Free, and cost nothing on a paid plan
1,000 a day per address
50,000 a month, then stops
250K to 5M a month, then overage
Overage cap
Set your own in Billing, or $0 to stop at the quota
Support
Docs
Docs
Email
Tor IP, Relay IP and Relay Provider
Whole datasets as CSVGZ or MMDB, free under CC BY-SA 4.0
With an account
With an account
Every other database
VPN IP, the proxies, hosting and CDN, licensed per dataset
On Enterprise
Enterprise

Past 5M a month, or the databases themselves

Volume pricing, every database under one license, a named contact with agreed response times, and the DPA and security review your procurement asks for.

Open

Tor IP and Relay IP are free

Every account holds a license to both, and to Relay IP's provider catalog, from the moment it's made. Download them from the console, the API or any client under CC BY-SA 4.0: credit VPNDetection, and share anything you adapt from them under the same license.

On this page

Do higher plans return more fields?

No. Every paid plan returns every field, the same on Starter as on Max. A plan is its monthly lookups and its overage rate, and nothing else.

00 · No key

Start without signing up.

Paste it into a terminal. No account needed. 1,000 lookups a day per address, answering ip and is_vpn.

curl "https://api.vpndetection.io/146.70.116.130"
{
"ip": "146.70.116.130",
"is_vpn": true
}
01 · Free key

Sign up and get 50,000 requests a month.

No card and no sales call: the key is issued on signup.
Every request flags VPN IPs.
Upgrade only when you outgrow the allowance.