Skip to content
VPNDetection
Log inGet a free API key
Proxy detection

Residential proxy detection, in one GET

A residential proxy sends its traffic out through someone's home connection, so the address looks like an ordinary customer's. One lookup tells you whether an address is in a residential, mobile, datacenter or public proxy pool, when we first and last saw it there, on how many days, and how many providers resell it.

Get a free API keySee pricing →

Proxy flags are on every paid plan, from $19 a month. A free account tries every field, 100 lookups a day.

Where it catches what a VPN check misses

  • Sign-up

    One person opening account after account, each from a new home address. A residential proxy seen recently is the signal, whatever country it reads as.

  • Checkout

    Card testing and stolen cards run through residential and mobile pools, so each try looks like a new shopper. Hold the order for review rather than refusing it.

  • Sign-in

    Credential stuffing that rotates through home addresses to stay under the limits you set per address.

  • Promotions and referrals

    The same bonus claimed again and again, from addresses that each look like a new household.

A rule in your own code

The middleware looks up each request's address and refuses the ones your condition matches. Or read the answer yourself and hold the request for review.

import express from "express";
import { vpndetection } from "vpndetection-express";
 
const app = express();
app.set("trust proxy", "loopback");
 
// Refuse a sign-up from a mobile proxy, or from a residential
// one seen five times or more in 90 days.
app.post("/signup", vpndetection({
    apiKey: process.env.VPNDETECTION_API_KEY,
    blockCondition: [
        { isResproxy: true, resproxy: { hits: { gte: 5 } } },
        { isMobproxy: true },
    ],
}), signup);
app.mjsnpm install vpndetection-express

Plans

  • No card and no sales call: the key is issued when you sign up.
  • Every paid plan answers every field. The plans differ in lookups, overage and how fast support replies.

Compare plans

Choose yearly and get 2 months free
Full pricing →
Unlimited
Free

No key or card needed

  • Unlimited lookups
  • Try every field, 100 a day
  • VPN, Tor and relay flagsPlus location and ASN
  • Database downloadsTor IP, Relay IP, Relay Provider
  • Support
Get a free API key
Starter
$19.00/mo

Billed monthly

  • 250,000 lookups a month
  • Then $0.09 per 1,000 lookups
  • All our data fieldsAnonymity, location and ASN
  • Database downloadsTor IP, Relay IP, Relay Provider
  • Support48-hour response time
Subscribe
ScaleMost popular
$99.00/mo

Billed monthly

  • 2,000,000 lookups a month
  • Then $0.07 per 1,000 lookups
  • All our data fieldsAnonymity, location and ASN
  • Database downloadsTor IP, Relay IP, Relay Provider
  • Support24-hour response time
Subscribe
Max
$199.00/mo

Billed monthly

  • 5,000,000 lookups a month
  • Then $0.05 per 1,000 lookups
  • All our data fieldsAnonymity, location and ASN
  • Database downloadsTor IP, Relay IP, Relay Provider
  • Support12-hour response time
Subscribe
Enterprise
Custom

Annual, priced to your volume

  • Custom lookup volume
  • Negotiated overage rate
  • All our data fieldsAnonymity, location and ASN
  • Database downloadsEvery dataset, licensed per dataset
  • Priority supportNamed contact and agreed response times
Contact sales

Every paid lookup answers all of this

Starter answers exactly what Max does. This is an illustration, with every object filled at once, which no real address is: 198.51.100.24 is a documentation address.

{
"ip": "198.51.100.24",
The address you asked about.
"is_vpn": true,
A commercial VPN exit. The operator is named in the vpn object.
"is_hosting": true,
Leased hosting or cloud space. Infrastructure, not anonymity on its own.
"is_relay": true,
A privacy relay, such as iCloud Private Relay, or an enterprise web gateway, such as Zscaler.
"is_tor": true,
A Tor node, from the public Tor set, rebuilt daily.
"is_cdn": true,
A content-delivery edge. Grouped with hosting, not with anonymity.
"is_resproxy": true,
Seen in a residential proxy pool. It stays true once the address leaves the pool: resproxy.last_seen says when it was last seen.
"is_dcproxy": true,
An address a datacenter proxy service sells or runs on, a proxy company's own ranges included, and kept the same way.
"is_mobproxy": true,
Seen in a mobile proxy pool, on a mobile carrier's addresses, and kept the same way.
"is_pubproxy": true,
A public proxy anyone can connect through listens on the address or sends its traffic out from it, or did: pubproxy.last_seen says when.
"vpn": {
Which VPN it is, and how sure we are.
"provider": "mullvad",
The operator this address belongs to, as a stable ID you can key rules off.
"last_seen": "2026-10-19",
The most recent build in which we observed it.
"confidence": "high"
How strongly the observation is supported: high, medium or low.
},
"hosting": {
The hosting provider behind the address.
"provider": "m247",
"confidence": "high",
"last_seen": "2026-10-19"
},
"relay": {
The relay's or gateway's operator, in the same fields.
"provider": "apple_private_relay",
"confidence": "high",
"last_seen": "2026-10-19"
},
"tor": {
The same fields. Tor has no operator, so provider is empty.
"provider": "",
"confidence": "high",
"last_seen": "2026-10-19"
},
"cdn": {
The edge network's operator, in the same fields.
"provider": "gcore",
"confidence": "high",
"last_seen": "2026-10-19"
},
"resproxy": {
Who resells the address, and how often it turned up in 90 days.
"provider": "netnut",
"first_seen": "2026-07-23",
The first build inside the window in which we observed it.
"last_seen": "2026-10-18",
"hits": 8,
How many times the address was observed during the window.
"hits_days_pct": 6,
Share of days in the window on which the address appeared.
"providers_num": 7
How many distinct providers resold this address.
},
"dcproxy": {
The same fields, for a datacenter proxy service.
"provider": "floppydata",
"first_seen": "2026-08-02",
"last_seen": "2026-10-17",
"hits": 13,
"hits_days_pct": 9,
"providers_num": 3
},
"mobproxy": {
The same fields, from a mobile proxy pool.
"provider": "dataimpulse",
"first_seen": "2026-09-14",
"last_seen": "2026-10-16",
"hits": 17,
"hits_days_pct": 12,
"providers_num": 2
},
"pubproxy": {
A public proxy's own record.
"entry": true,
Whether a public proxy listens on this address.
"exit": true,
Whether a public proxy's traffic leaves from this address.
"protocols": ["http", "socks5"],
What the proxies on this address speak: HTTP, HTTPS, SOCKS4 or SOCKS5.
"num_ports": 2,
How many ports a public proxy listens on at this address.
"num_proxies": 3,
How many public proxies' traffic leaves from this address.
"last_seen": "2026-10-19",
"last_usable": "2026-10-18"
The last day a request through a proxy on this address was answered.
},
"location": {
Where the address is, to the country.
"continent": "EU",
The continent, as a two-letter code and a name.
"continent_name": "Europe",
"country": "DE",
The ISO 3166 country, as a code and a name.
"country_name": "Germany",
"timezone": "Europe/Berlin",
The address's IANA timezone.
"currency_code": "EUR",
The country's currency.
"currency_name": "Euro",
"currency_symbol": "€",
"flag_emoji": "🇩🇪",
The country's flag, and its code points.
"flag_unicode": "U+1F1E9 U+1F1EA"
},
"asn": {
The network that announces the address.
"asn": 64500,
The AS number, 0 when no announcement covers the address.
"name": "Example Hosting GmbH",
Who runs the AS.
"domain": "example.net",
The AS operator's own domain.
"type": "hosting",
The kind of network: isp, hosting, education, government or business.
"prefix": "198.51.100.0/24"
The announced prefix that covers the address, the most specific when several do.
}
}

IPv4 and IPv6 · batches of 1,000 · 13 SDKs, a CLI and MCP

00 · Unlimited

Unlimited lookups, no sign-up.

Paste it into a terminal. Any address answers its VPN, Tor and relay flags, where it is and which network announces it, with no daily or monthly cap.

curl "https://api.vpndetection.io/146.70.116.130"
{
  "ip": "146.70.116.130",
  "is_vpn": true,
  "is_relay": false,
  "is_tor": false,
  "location": {
    "country": "AT", ...
  },
  "asn": { "asn": 9009, ... }
}
01 · Sign up

Try every field, free.

Your first 100 lookups each day answer every field, the evidence behind each flag included.
The rest answer as Unlimited, with no cap.
No card and no sales call: the key is issued on signup.
A paid plan answers every field on every lookup.
Get a free API keySee pricing