Free VPN Checker: Detect if Any IP Is on a VPN Instantly
What is a VPN check?
A VPN check looks up an IP address and returns whether it belongs to a known commercial VPN service. Users connect to VPNs to mask their real IP, change their apparent location, or bypass network restrictions; from your server's point of view, every request from a VPN looks like it came from the VPN provider's exit IP, not the user's actual one.
The check returns a boolean signal (VPN detected, yes or no) plus context about the IP itself: the country it appears to be in, whether it also shows up as a proxy or Tor node, and which network operates it. It is the standard input for any decision that depends on knowing whether a request is coming from a real user IP or an anonymizing service.
How VPN detection works
When you submit an IP address, the check runs three steps:
- VPN-server list lookup: The IP is cross-referenced against current ranges operated by major commercial VPN providers (NordVPN, ExpressVPN, ProtonVPN, Surfshark, and others). A direct match is the strongest single signal.
- Behavioral and network cross-checks: The check combines list lookups with traffic patterns common to VPN exits (high concurrent connection counts, characteristic port usage, ASN type) and a hosting/datacenter cross-reference. Most commercial VPN servers run in datacenters, not residential networks, so the hosting flag corroborates the VPN signal.
- Single-call response: The VPN signal returns alongside proxy, Tor, hosting, and country fields in one request. No separate calls per category, no orchestration.
Commercial VPN providers add and rotate servers constantly, so the underlying data is refreshed continuously and a server that came online this week is reflected in the check. Most checks complete in under 200ms.
What VPN check catches vs. what it doesn't
The check is strong for major commercial VPNs and explicit about its limits.
What it identifies: major commercial VPN providers with public server infrastructure (NordVPN, ExpressVPN, ProtonVPN, Surfshark, CyberGhost, and others), both consumer and business endpoints, the country the exit appears in, and whether the IP is also in a hosting range or shows up as a proxy or Tor node. Best for signup fraud screening, geolocation enforcement, ad fraud detection, and account-takeover screening — the cases where a single boolean signal is reliably actionable.
What it does not identify: custom self-hosted VPN servers (private OpenVPN or WireGuard endpoints), residential proxy services that route through real consumer connections, Tor exit nodes, and brand-new or obscure VPN providers before they reach public lists. For dedicated proxy or Tor detection, the Proxy Checker and Tor Checker are the right tools. Pair the VPN flag with the proxy and Tor signals when you need fuller anonymizer coverage.
A false result on the VPN check means "no commercial VPN detected on this IP," not "the user is definitely not anonymized." For high-stakes decisions, combine VPN, proxy, Tor, and hosting signals rather than relying on any one alone.
Use cases for VPN checks
Signup fraud screening: Catch fraudulent signups masking their real location. VPN traffic on signup is one of the most reliable indicators of fake accounts, promo abuse, and policy violations. Combine the VPN flag with proxy, Tor, and hosting status to filter the patterns most associated with bad actors.
Geolocation enforcement: Streaming, gambling, and compliance often require traffic from specific regions. A VPN flag tells you when an IP's apparent country may not match the user's real one, which is the basis for blocking, additional verification, or reduced functionality.
Ad fraud and analytics hygiene: VPN traffic distorts geographic analytics, attribution, and ad delivery. Flagging it lets you exclude or annotate it in your data pipelines, keeping campaign metrics and audience reports cleaner.
Account-takeover screening: A login from a VPN that the legitimate user has never used is a strong risk signal. Combine the VPN flag with device fingerprinting, login history, and behavioral signals to flag suspicious sessions for step-up authentication.
See what the API returns
Response parameters
ip_address
security.is_vpn
security.is_proxy
security.is_tor
security.is_hosting
security.is_relay
security.is_mobile
security.is_abuse
asn.asn
asn.name
asn.domain
asn.type
company.name
company.domain
company.type
domains.domains
location.city
location.city_geoname_id
location.region
location.region_iso_code
location.region_geoname_id
location.postal_code
location.country
location.country_code
location.country_geoname_id
location.is_country_eu
location.continent
location.continent_code
location.continent_geoname_id
location.longitude
location.latitude
timezone.name
timezone.abbreviation
timezone.utc_offset
timezone.local_time
timezone.is_dst
flag.emoji
flag.unicode
flag.png
flag.svg
currency.name
currency.code
currency.symbol
API Endpoint
curl --request GET \
--url https://ip-intelligence.abstractapi.com/v1API Response
{
"ip_address": "185.197.192.65",
"security": {
"is_vpn": true,
"is_proxy": true,
"is_tor": false,
"is_hosting": false,
"is_relay": false,
"is_mobile": false,
"is_abuse": false,
},
"asn": {
"asn": 136787,
"name": "PacketHub S.A.",
"domain": "packethub.tech",
"type": "isp",
},
"company": {
"name": "PacketHub S.A.",
"domain": "packethub.tech",
"type": "isp",
},
"domains": {
"domains": []
},
"location": {
"city": "Miami",
"city_geoname_id": 4164138,
"region": "Florida",
"region_iso_code": "FL",
"region_geoname_id": 4155751,
"postal_code": "33197",
"country": "United States",
"country_code": "US",
"country_geoname_id": 6252001,
"is_country_eu": false,
"continent": "North America",
"continent_code": "NA",
"continent_geoname_id": 6255149,
"longitude": -80.1946,
"latitude": 25.7689,
},
"timezone": {
"name": "America/New_York",
"abbreviation": "EST",
"utc_offset": -5,
"local_time": "12:07:51",
"is_dst": false,
},
"flag": {
"emoji": "🇺🇸",
"unicode": "U+1F1FA U+1F1F8",
"png": "https://static.abstractapi.com/country-flags/US_flag.png",
"svg": "https://static.abstractapi.com/country-flags/US_flag.svg",
},
"currency": {
"name": "US Dollar",
"code": "USD",
"symbol": "$"
}
}VPN Checker FAQ
What is a VPN?
A VPN (Virtual Private Network) routes a user's internet traffic through a remote server before it reaches the public internet. The server's IP address replaces the user's real one, masking their location and ISP. Commercial VPN services like NordVPN, ExpressVPN, and ProtonVPN run thousands of these servers across many countries, and users connect to them for privacy, geolocation changes, or to bypass network restrictions.
How does VPN detection work?
Abstract maintains current lists of IP ranges operated by major commercial VPN services and combines them with behavioral signals (datacenter origin, port patterns, ASN type) to flag IPs that route VPN traffic. When you submit an IP, the check returns true if the IP belongs to a known commercial VPN, plus context like country, proxy status, and Tor status. The result returns in under 200ms.
Can VPN detection be bypassed?
Yes, in some cases. Custom self-hosted VPN servers (private OpenVPN or WireGuard endpoints) are not in any public list, so they will not be flagged. Residential proxy services route through real residential IPs and look indistinguishable from regular user traffic. Newly launched or obscure VPN services may have lag time before they appear in the data. The check is a strong signal for the major commercial providers but not a complete anonymizer detector.
What is the difference between a VPN, a proxy, and Tor?
A VPN is a commercial service that encrypts and tunnels all traffic from a device through a remote server. A proxy forwards specific requests through an intermediary IP, often without encryption, and includes residential proxies that route through real consumer connections. Tor is a volunteer network that routes traffic through three hops to anonymize the source. They overlap in purpose (masking the real IP) but differ in how they work and how they show up in detection. Abstract has separate checks for each.
How accurate is the VPN check?
VPN detection is highly accurate for major commercial providers because their server IPs are publicly known and Abstract refreshes the underlying lists continuously. Accuracy drops for self-hosted VPNs, residential proxies, and very new or niche services. Treat a true result as a strong signal worth acting on. Treat a false result as "no commercial VPN detected" rather than a guarantee that the user is not anonymized.
Is the VPN Checker tool free?
Yes. The online tool is free with no signup required for individual lookups. For programmatic access, Abstract's IP Intelligence API offers a free tier with 1,000 requests per month. View pricing for higher-volume plans.
More IP intelligence tools
