Detect connections routed through VPNs, proxies, Tor exit nodes, and privacy relays. IP Trust combines VPN detection, proxy detection, Tor monitoring, and privacy relay identification into a single IP anonymisation API - so you can apply different policies to each method.
IP Trust detects four categories of IP anonymisation: VPNs, proxies, Tor exit nodes, and privacy relays. Each is returned as a separate object so you can apply different VPN detection and proxy detection policies to different anonymisation methods.
| JSON Field | Description | Plans |
|---|---|---|
| { | ||
| "tor_exit_node": { | ||
| "detected": true | Whether this IP is a known Tor network exit node. | Premium |
| }, | ||
| "privacy_relay": { | ||
| "detected": true, | Whether the IP is part of a commercial privacy relay service. | Premium |
| "provider": "icloud_private_relay" | optional The privacy relay provider identifier. For now, always icloud_private_relay. |
Premium |
| }, | ||
| "proxy": { Dedicated page → | ||
| "detected": true, | Whether this IP has been detected as an active proxy server. | Premium |
| "type": "residential", | optional Type of proxy, one of:
|
Premium |
| "last_detected": "2025-11-15" | optional Date (ISO 8601) when proxy activity was last observed for this IP, if available. | Premium |
| }, | ||
| "vpn": { Dedicated page → | ||
| "detected": true, | Whether this IP has been identified as part of a VPN service. | Premium |
| "provider": "nord_vpn", | optional Identifier of the VPN provider, if known. | Premium |
| "last_detected": "2025-11-15" | optional Date (ISO 8601) when VPN activity was last observed for this IP. | Premium |
| } | ||
| } |
| Field | Value | Description | Database Package |
|---|---|---|---|
| tor_exit_node | true | Whether this IP is a known Tor network exit node. | Anonymisation |
| privacy_relay | true | Whether the IP is part of a commercial privacy relay service. | Anonymisation |
| privacy_relay_provider | icloud_private_relay | The privacy relay provider identifier. | Anonymisation |
| proxy | true | Whether this IP has been detected as an active proxy server. | Anonymisation |
| proxy_type | residential | Type of proxy: residential (commercial residential proxy provider) or open (publicly accessible proxy server). | Anonymisation |
| proxy_last_detected | 2025-11-15 | Date (ISO 8601) when proxy activity was last observed for this IP. | Anonymisation |
| vpn | true | Whether this IP has been identified as part of a VPN service. | Anonymisation |
| vpn_provider | nord_vpn | Identifier of the VPN provider, if known. | Anonymisation |
| vpn_last_detected | 2025-11-15 | Date (ISO 8601) when VPN activity was last observed for this IP. | Anonymisation |
Understand how visitors are masking their identity to make smarter security decisions. Apply different VPN detection, proxy detection, and Tor policies depending on the anonymisation method in use.
Not all anonymisation is equal. Apply stricter controls to Tor and open proxy traffic while allowing privacy relay users through with minimal friction. Tailor your security posture to the specific anonymisation method in use.
Detect account takeover attempts, payment fraud, and automated abuse from users hiding behind VPNs, proxies, and Tor. Combine anonymisation signals with geolocation and ASN data for a complete risk picture.
Track and report on the volume and types of anonymised traffic hitting your platform. Meet regulatory requirements that demand visibility into how users access your services.
IP Trust anonymisation data provides you with granular insights into the anonymisation methods in use by your visitors, allowing you to apply different policies to each type rather than treating all anonymous traffic the same way.
We detect VPNs, open and residential proxies, Tor exit nodes, and privacy relays as separate categories. This lets you apply different policies to each type rather than treating all anonymous traffic the same way. See our dedicated VPN detection and proxy detection pages for more detail.
We actively scan VPN provider endpoints, open proxy lists, residential proxy networks, and monitor the Tor exit node directory. Combined with threat signals observed by Friendly Captcha across billions of requests, our detection stays ahead of rapidly changing anonymisation infrastructure.
Where possible, we identify the specific VPN or privacy relay provider behind each connection. For high-churn proxy and VPN IPs, we include a last-detected date so you can make an intelligent call about whether the IP is still actively in use.
Choose the integration model that works best for your use case.
| Network | Tor Exit | VPN | VPN Provider | Proxy | Proxy Type | Privacy Relay |
|---|---|---|---|---|---|---|
| 2.36.214.116/32 | false | false | true | residential | false | |
| 185.159.156.28/32 | false | true | protonvpn | false | false | |
| 176.10.99.200/32 | true | false | false | false | ||
| 2a02:26f7:c1c0::/56 | false | false | false | true | ||
| 89.187.162.0/24 | false | true | nord_vpn | false | false |
IP anonymisation detection is the process of identifying whether an IP address is being routed through a service designed to hide the user's true identity or location. This includes VPNs, proxy servers, Tor exit nodes, and privacy relays such as Apple's iCloud Private Relay. IP Trust detects all four categories and returns them as separate signals so you can handle each one differently.
IP Trust detects four distinct types of anonymisation: commercial and residential VPNs, open and residential proxy servers, Tor exit nodes, and privacy relays. Each type is returned as a separate object in the API response or as dedicated fields in the database download, giving you granular control over your security policies.
VPN detection and proxy detection are subsets of IP anonymisation detection. VPN detection specifically identifies traffic from commercial VPN services, while proxy detection covers open and residential proxy servers. IP anonymisation detection is the broader category that also includes Tor exit nodes and privacy relays - giving you a complete picture of how an IP address may be masking its origin.
Yes. IP Trust offers an Anonymisation database package available for download in MMDB, CSV, JSON, and Parquet formats. Once downloaded, you can perform IP anonymisation lookups entirely on your own infrastructure with zero external API calls and unlimited query volume. See our database downloads page for details.
IP Trust actively scans VPN provider endpoints, monitors open proxy lists and residential proxy networks, and tracks the Tor exit node directory on a continuous basis. These scans are combined with real-world threat signals observed by Friendly Captcha across billions of requests, ensuring that new anonymisation infrastructure is detected quickly - even in high-churn networks where IP addresses rotate frequently.