VPN IP detection
Matching an address against evidence of VPN infrastructure.
Definition
A VPN can carry traffic through another network before it reaches a service. IP-based VPN detection classifies the visible address using network evidence or curated lists. It does not inspect the encrypted tunnel or identify every possible VPN service.
Worked example
IPQuery checks listed ranges and reviewed VPN-operated ASNs in risk.is_vpn. The example below shows the actual flag for one address; VPN and hosting remain separate classifications.
{
"ip": "2.26.157.0",
"risk": {
"is_vpn": false
}
}Selected fields from one complete single-IP response. Values describe the address looked up, not the reader’s connection.
API fields
Matching ruleListed VPN prefix contains the address.
risk.is_vpnboolean- Address matches a listed VPN range or a reviewed VPN-operated ASN.
A false flag means its matching condition was not met. A missing or failed response is unavailable, not false.
Interpretation
A listed network may have several uses, and a missing list entry does not prove that the client is not using a VPN. Read the matching rule and collection limits alongside the flag.
Matching rules and limits