How to detect a proxy, VPN or datacenter IP
You cannot tell from the address itself. What you can check is what that address has been observed doing, and how recently. Three signals carry almost all of the information: the usage type of the network it sits in, whether it is currently present in proxy supply, and the age of that observation. The third one decides whether the first two still mean anything.
The three signals
1. Usage type of the network
Every address block belongs to a network with a purpose: residential broadband, mobile carrier, business leased line, datacenter, or campus. This is the cheapest signal and the most often over-read. Datacenter does not mean malicious — it is where VPN providers, CI runners and monitoring agents legitimately live. Residential does not mean human — that is precisely the address space residential proxy networks resell.
2. Presence in proxy supply
The useful question is not "is this a proxy" but "is this address currently being sold as an exit". That is an observation about the market, not a property of the address, and it has to be collected continuously.
3. Age of the observation
This is the one that decides. A residential exit is somebody's home connection rented for minutes to hours. An address that was an exit last week is very likely an ordinary subscriber today. Any answer that does not come with a timestamp cannot be acted on.
Why IP reputation lists go stale, and what that costs
Two clocks run at different speeds. The address changes hands in minutes; the list that describes it is refreshed in days. The gap is where false positives live: a real customer gets blocked because the address they were assigned this morning was an exit node last Thursday.
The practical consequence is that a verdict without an observation time is not usable. If a source cannot tell you when it last saw the behaviour it is reporting, it cannot tell you whether the verdict is still true.
What a risk score should mean
IP99 publishes a 0–100 score, and it is worth being explicit about what it measures: the freshness and strength of verifiable evidence, not the probability that the address is an attacker. Those are different quantities and conflating them is the most common way an IP feed gets misused.
The corollary matters more than the score: score 0 together with
evidence_state: "none" means we hold no evidence about this address.
It does not mean the address is safe. A source that reports "clean" where it should report
"unknown" is telling you something it does not know.
Check one address right now
Free, no signup, no API key — 1000 lookups per day per IP:
curl https://ip99.com/v1/ip/8.8.8.8The fields that answer the question above are network.usage_type (signal 1),
evidence_state (signal 2) and computed_at together with
meta.data_version (signal 3). Every response carries a
source_url so a verdict can be traced back to a page a human can read.
Full field reference: API documentation.
Agents can call the same lookup as a tool over the Model Context Protocol at
https://ip99.com/mcp — one read-only tool, ip_risk_lookup,
no key required.
What this cannot tell you
- It is not attribution. An address is a network location, not a person. Carrier-grade NAT puts thousands of unrelated subscribers behind one address.
- Datacenter is not a verdict. Blocking all datacenter space blocks VPN users, researchers and your own integration partners.
- Absence of evidence is not innocence. Most addresses are simply unobserved.
- No source is complete. Proxy supply is a market; every vendor sees a slice of it. Treat any single feed, this one included, as one input among several.
The data behind this page
IP99 maintains its own geolocation and proxy-supply databases, covering 244 countries and regions, refreshed daily. The proxy-supply observations on this site cover the 4 days to 12 September 2026. Country-level breakdowns, including the residential-versus-datacenter split for each, are published at IP ranges by country.