VPN detection is genuinely hard, and most implementations quietly fail. The common approach — check whether the IP belongs to a hosting provider's ASN — misses the majority of consumer VPN traffic, because the large consumer VPNs rent capacity from ordinary hosting companies rather than running their own networks.
ASN lookups tell you an address belongs to a hosting company. That catches servers, and it catches VPN operators who own their own network. It misses NordVPN, Surfshark, PIA and CyberGhost exits sitting on shared hosts, because the ASN belongs to the host, not the VPN. We measured this: fifteen real NordVPN exits, and three of them looked completely clean to an ASN-only check.
Several major VPN providers publish their live server lists — the same endpoints their own apps call to pick a server. NordVPN publishes roughly 9,000 exit addresses; Mullvad publishes its relays. Reading those is exact rather than inferred, and it is public data, so there is no licence question. Providers who publish nothing still need the inferential approach.
"Datacenter", "commercial VPN", "public proxy" and "Tor exit" are four different facts with four different meanings. A Tor exit on a banking signup is a strong signal. A commercial VPN on a consumer app is Tuesday.
curl "https://www.layercall.com/v1/score/ip?ip=1.2.3.4" \ -H "X-Api-Key: YOUR_KEY"
A geolocation database maps a VPN range to where the operator registered it, not where the exit physically is. That is how a user connecting through Amsterdam gets reported as Switzerland. If you make decisions on country, a VPN silently corrupts them — so prefer the operator's declared location when the exit is known.
Every check here has a cost in real customers. These are the ones that actually bite — several because we shipped them ourselves.
Paste any IP, email, phone or domain into the playground — no signup. Or get a free API key for 1,000 lookups a month, no card.