Proxy and VPN checker

Your own address is checked when the page loads. The verdict says residential, mobile, business, data center, VPN, proxy, Tor or relay, with a confidence and the reasons. Below it, browser-side checks compare your device's time zone with the address's time zone and look for WebRTC and DNS results that point at another network.

Enter an IPv4 or IPv6 address to run the list-based checks on it: Tor exit list, VPN and data center ranges, cloud provider feeds, iCloud Private Relay, open-proxy blocklists and the ASN's network type. The browser-side checks apply only to your own connection, since we cannot see another device's clock or WebRTC.

No site can see through a proxy; what it can see is the address the traffic arrives from and the context around it. Detection is a set of published lists plus a few consistency checks.

The address belongs to a hosting or cloud network — AWS, Google Cloud, Oracle, DigitalOcean, Linode, Vultr and others publish their ranges, and the X4BNet data center list and the ASN type cover the rest. Ordinary people do not browse from a server, so a hosting address is treated as a proxy or VPN by default.

Commercial VPN providers' exit addresses are collected in public lists (we use X4BNet's VPN list, MIT-licensed, refreshed weekly). A hit is a high-confidence VPN verdict; many smaller providers are not on any list and show up only as data center.

Open proxies that anyone can use end up in abuse databases quickly; several DNS blocklists we query (for example DroneBL) flag them with a specific return code, which we show.

The Tor Project publishes its exit list; we refresh it hourly. A Tor exit is the only verdict that is practically certain. See the Tor check.

On your own connection we compare the browser's reported time zone with the address's time zone, and the languages your browser accepts with the address's country. A Berlin clock on a Dutch address is not proof of anything — people travel — but together with a hosting address it is how most detection systems make up their mind.

The word proxy covers very different things, and detection treats them differently.

A data center proxy runs on a server and is recognized by the hosting range alone. A residential proxy routes traffic through a real home or mobile connection, so the address looks like an ordinary ISP customer; it is only caught by behavior, reputation lists or the mismatch checks above.

An HTTP proxy understands web requests and can add headers that reveal it (Via, X-Forwarded-For); a SOCKS5 proxy forwards any TCP connection without looking inside. Neither carries UDP, which is why WebRTC and some DNS lookups bypass both — see the WebRTC leak test.

In order of likelihood: the address is in a hosting or VPN range (fix: a residential or mobile exit, or a provider not on the lists); the device time zone or language does not match the address (fix: align them); WebRTC or DNS exposes your real network (fix: see the VPN test); the address is on a blocklist because of previous abuse (fix: another server, or delisting if it is yours); or the site uses a commercial reputation service whose data we do not have. The reasons list on this page tells you which of these applies to the lists we can see.