Skip to content
IPGet

Security Tools

VPN & Proxy Detection

See what your connection looks like from the outside — VPN, proxy, Tor or datacenter.

VPN and proxy check

Leave the field empty to check your own connection, or enter any public address.

What this page can actually see

Every request that reaches a web server carries one piece of information the sender cannot hide: the address the packets came from. Everything on this page is derived from that address and from public records about the network it belongs to. Nothing here inspects your device, and nothing could.

That distinction matters more than it sounds. The question people usually mean when they ask “am I on a VPN?” is does the internet see me as myself? — and that question is answerable. The question “is VPN software running?” is not, from here. This page answers the first one and says plainly when the answer is uncertain.

The four checks, and what each one rests on

Each verdict is produced by a named detector and shown with the evidence it used, so you can judge it against the network details in the same card rather than taking it on trust.

  • VPN. Matches the network’s registered operator against companies that sell consumer VPN egress. High confidence when it matches, because these operators register their own ranges under their own names.
  • Proxy. Two independent sources: operators that sell proxy or residential-proxy egress, and forwarding headers on your own request that our infrastructure did not add. Only header names are examined — values are never read, so a forged address in one cannot influence the result.
  • Tor. Compared against the Tor Project’s published exit-relay list, downloaded by our server and matched locally.
  • Hosting. Whether the address belongs to a cloud, colocation or hosting network. This is a fact about the address, not a judgement — a great deal of legitimate traffic originates in a datacenter.

VPN, proxy and Tor are not the same thing

They solve overlapping problems in genuinely different ways, which is why this page reports them separately rather than collapsing them into one “anonymised” flag.

Aspect VPN Proxy Tor
What it carries All traffic from the device or system Specific requests from a configured application Traffic through three volunteer relays
Encryption to the operator Yes, by design Often none (HTTP proxies) Yes, layered
Who sees your real address The VPN provider The proxy operator The entry guard only
How this page detects it Network registered to a VPN operator Proxy operator, or forwarding headers on the request The published exit-relay list
Typical reason to use it Privacy, geo-restrictions, remote access Scraping, caching, corporate filtering Anonymity under threat

Why the three-state answer

Each check can return detected, not detected, or not determined. The third state is not padding. If the Tor exit list cannot be reached, the honest answer is that we do not know — and reporting that as “not detected” would convert a temporary outage into a confident all-clear. The same applies when an address has no published registration data at all: there is nothing to reason from, and saying so is more useful than guessing.

What this is good for

The most common genuinely useful case is verifying that a VPN is doing what you think. A tunnel that has silently dropped, a client that reconnected through a different country, or split tunnelling that routes a browser outside the tunnel all look identical from inside the VPN app and obvious from here. The second case is diagnosing why a service is treating you oddly: rate limits, extra captchas and blocked signups are frequently triggered by an address that resolves to a hosting or VPN network, and this page tells you whether that is what is happening.

Frequently asked questions

Can a website really tell if I am using a VPN?

Not directly, and any tool claiming otherwise is overstating what it does. A website sees the address your traffic arrives from and the public registration data attached to it. If that address belongs to a network registered to a company that sells VPN service, that is strong evidence — but it is evidence about the network, not an observation of software on your device. A corporate VPN terminating on the company’s own network looks like an ordinary office connection, and this page will say so.

What is the difference between a VPN and a proxy here?

A VPN carries all of your traffic through an encrypted tunnel and out of the provider’s network, so your address becomes theirs. A proxy relays specific requests, often without encryption, and frequently announces itself with headers such as Via or Forwarded. This page reports them separately because they are detected differently: the VPN verdict comes from who owns the network, while the proxy verdict can also come from the shape of the request itself.

How is the Tor result determined?

The Tor Project publishes a list of every current exit relay. We download that public list on the server, cache it, and compare your address against it locally. Your address is never sent to the Tor Project or to anyone else. If the list cannot be fetched the result is reported as “not determined” rather than “not detected”, because an outage is not evidence that you are not using Tor.

Why does it say hosting when I am connecting from home?

Two common causes. Some internet providers announce residential ranges from an autonomous system that also serves hosting customers, so the registration looks like a datacenter even though the connection is not. And some smaller ISPs lease address space from cloud providers, which leaves the cloud provider’s name on the record. The organisation name shown next to the verdict is the evidence — if you recognise it as your own provider, the hosting flag is noise.

Is my IP address sent to a VPN-detection service?

No. IPGet uses the same geolocation lookup the rest of the site already performs, plus a public list it downloads itself. There is no third-party reputation API in this feature, no paid data vendor, and nothing that receives your address for the purpose of scoring it. Results are cached briefly on our server, and the cache for your own address is kept in a separate namespace from addresses people look up deliberately, so the cache cannot be used to learn who has visited.

Does a detected VPN mean something is wrong?

No, and the page is deliberately styled not to imply that. Using a VPN is ordinary and often sensible. The reason this check exists is that a VPN sometimes fails silently — the tunnel drops, the client reconnects on a different exit, or split tunnelling sends traffic the way you did not intend. Knowing what the internet actually sees is useful precisely because it can differ from what you expect.

Related tools