Proxy, VPN, and Tor IP check: how each signal works
A proxy, virtual private network (VPN), or Tor exit node can be hard to identify from an IP address alone. This tool checks separate signals from registries, cloud providers, exit node databases, and live DNS reputation systems. For the tested IPv4 or IPv6 address, it reports each finding, its data source, and its certainty. It shows the evidence behind a high, medium, low, or clean result instead of hiding it in a single trust score.
The check looks at four types of network data: official Tor exit node rosters from the Tor Project, IP prefixes published by cloud operators, regional internet registry records matching hosting providers, and live DNS queries against DroneBL.
The four detection signals explained
1. Tor exit node detection
Tor routes encrypted traffic through volunteer relays. Only the final node, called the exit relay, interacts directly with destination websites. The Tor Project publishes an official directory of active exit nodes every hour. Tor exit relays declare themselves to directory authorities, so a match against the bulk exit list identifies an address routing Tor traffic. Our systems fetch that list hourly. If the local copy is older than 24 hours, the tool marks Tor data unavailable instead of reporting an unverified result.
2. Cloud provider datacenter ranges
Major cloud infrastructure providers, including Amazon Web Services (AWS), Google Cloud Platform, Oracle Cloud, Cloudflare, Fastly, DigitalOcean, and Linode, publish official lists of their IP ranges. Datacenter IP addresses are used for virtual servers and cloud applications, rather than home broadband or mobile subscribers. A connection from an AWS EC2 or DigitalOcean Droplet IP commonly passes through a commercial VPN server, WireGuard tunnel, or cloud proxy. A cloud datacenter match is a medium-confidence signal of automated or tunneled traffic.
3. Hosting and colocation registry records
The five Regional Internet Registries (ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC) allocate internet addresses. Each allocation records the organization holding the range. Our server keeps a daily compiled database of registry allocations and checks whether the network holder matches an established hosting provider, such as Hetzner, OVH, Leaseweb, Equinix, or Contabo. Residential providers assign dynamic IPs to households; hosting networks run servers in commercial datacenters. Those networks also often host VPN relays and private proxy tunnels, though some provide standard web services.
4. DroneBL reputation and abuse queries
DroneBL is a live DNS-based blacklist (DNSBL) that tracks IP addresses reported for running open proxies, compromised routers, and botnet activities. For an IPv4 address, our server queries DroneBL using reversed IP notation. Responses identify threat classes. Codes such as 8 (Open SOCKS proxy), 9 (Open HTTP proxy), 10 (Proxychain), 11 (Web proxy), and 19 (Abused VPN Service) indicate confirmed proxy infrastructure and produce a high-risk verdict. Botnet codes produce a medium-risk verdict, while open DNS resolvers produce a low-risk notice. DroneBL does not index IPv6 addresses, which return a not applicable status.
Overall verdict levels
After evaluating all four data sources, the tool assigns an overall risk level based on the strongest signal observed:
- High Risk: The address is an active Tor exit node or has been reported to DroneBL as an open HTTP, SOCKS, or abused VPN proxy.
- Medium Risk: The address belongs to an official cloud datacenter range (such as AWS, Google Cloud, or DigitalOcean) or is listed on DroneBL for botnet activity.
- Low Risk: The address is registered to a known web hosting company, or is listed for open resolver activity.
- No Signal (Clean): No proxy, VPN, Tor, or datacenter signals were found in any checked database.
What this tool cannot detect
IP-based proxy detection has limits. This tool cannot detect residential proxies or VPNs using leased residential IP ranges. Proxy networks often lease IP blocks from residential providers or route traffic through peer-to-peer software on consumer devices. To external servers, those connections look like home broadband subscribers.
Private corporate VPNs that end on non-public subnets, unlisted niche hosting providers, and new commercial VPN servers whose allocations have not reached public registry files will not trigger detection. A clean verdict means no known anonymizing signal was detected. It does not prove the connection is direct.
Why we do not inspect browser timezone or language
Some commercial fraud tools compare a visitor's browser timezone or language header with the IP address's location to infer proxy use. We avoid this check. Many legitimate users travel internationally, work abroad, or use operating systems set to English while living elsewhere. Flagging someone because their language preferences differ from their ISP location creates false positives and unfairly penalizes ordinary users.
Frequently asked questions
Can this tool detect all VPNs and proxies?
No. While Tor exit nodes and major cloud ranges are detected accurately, residential proxies and private VPN setups cannot be identified from the IP address alone.
Why does my VPN show as a cloud provider?
Many commercial and self-hosted VPN servers operate in data centers provided by AWS, Google Cloud, DigitalOcean, or Linode, whose IP ranges are publicly documented.
How often is Tor exit node data updated?
Tor exit lists are downloaded directly from the Tor Project every hour. If data is older than 24 hours, the tool reports Tor data as unavailable.
Is my IP address saved when I run a check?
No. The checked address is evaluated against server-side datasets and a live DNS query is sent to DroneBL. No lookup logs or history are retained on our servers.
More free tools: IP lookup · WebRTC leak test · IP blacklist check · Port checker · Speed test