VPN detection

Check whether an IP address matches a VPN network.

Keep VPN evidence separate from hosting.

Check risk.is_vpn for a listed VPN range or a reviewed VPN-operated ASN. A hosting classification alone does not establish a VPN match.

185.159.157.1Full IP report

Example lookup185.159.157.1risk.is_vpntrue

VPNListed

HostingClassified

AS209103 · Proton AG

Comparison lookup1.1.1.1risk.is_vpnfalse

VPNNot listed

HostingClassified

AS13335 · Cloudflare, Inc.

A match is evidence of a listed VPN network, not proof that a particular request used a VPN. List absence does not establish that an address is not a VPN.

API fields

Field definitionExample from 185.159.157.1

risk.is_vpnType: boolean: Address matches a listed VPN range or a reviewed VPN-operated ASN.; Example valuetrue

Look up one address

Request

curl --fail --silent --show-error --max-time 5 \
  "https://api.ipquery.io/185.159.157.1?format=json"

Actual response fields

JSON

{
  "ip": "185.159.157.1",
  "risk": {
    "is_mobile": false,
    "is_vpn": true,
    "is_tor": false,
    "is_proxy": false,
    "is_datacenter": true,
    "risk_score": 50
  }
}

The excerpt shows the relevant fields from this single-IP response. Inspect the full IP report

For the connecting client’s own address, use https://api.ipquery.io/?format=json. Bulk lookups are disabled.

API reference

Matching and provenance

VPN classification checks listed IPv4 and IPv6 ranges and reviewed VPN-operated ASNs, independently of hosting.

Explore VPN networks Full methodology