How to detect a proxy, VPN or datacenter IP
You cannot tell from the address itself. What you can check is what that address has been observed doing, and how recently. Three signals carry almost all of the information: the usage type of the network it sits in, whether it is currently present in proxy supply, and the age of that observation. The third one decides whether the first two still mean anything.
The three signals
1. Usage type of the network
Every address block belongs to a network with a purpose: residential broadband, mobile carrier, business leased line, datacenter, or campus. This is the cheapest signal and the most often over-read. Datacenter does not mean malicious — it is where VPN providers, CI runners and monitoring agents legitimately live. Residential does not mean human — that is precisely the address space residential proxy networks resell.
2. Presence in proxy supply
The useful question is not "is this a proxy" but "is this address currently being sold as an exit". That is an observation about the market, not a property of the address, and it has to be collected continuously.
3. Age of the observation
This is the one that decides. A residential exit is somebody's home connection rented for minutes to hours. An address that was an exit last week is very likely an ordinary subscriber today. Any answer that does not come with a timestamp cannot be acted on.
Why IP reputation lists go stale, and what that costs
Two clocks run at different speeds. The address changes hands in minutes; the list that describes it is refreshed in days. The gap is where false positives live: a real customer gets blocked because the address they were assigned this morning was an exit node last Thursday.
The practical consequence is that a verdict without an observation time is not usable. If a source cannot tell you when it last saw the behaviour it is reporting, it cannot tell you whether the verdict is still true.
What a risk score should mean
IP99 publishes a 0–100 score, and it is worth being explicit about what it measures: the freshness and strength of verifiable evidence, not the probability that the address is an attacker. Those are different quantities and conflating them is the most common way an IP feed gets misused.
The corollary matters more than the score: score 0 together with
evidence_state: "none" means we hold no evidence about this address.
It does not mean the address is safe. A source that reports "clean" where it should report
"unknown" is telling you something it does not know.
Check one address right now
Free, no signup, no API key — 500 lookups per day per IP:
curl https://ip99.com/v1/ip/8.8.8.8The fields that answer the question above are network.usage_type (signal 1),
evidence_state (signal 2) and computed_at (signal 3).
Full field reference: API documentation.
Agents can call the same lookup as a tool over the Model Context Protocol at
https://ip99.com/mcp — one read-only tool, ip_risk_lookup,
no key required.
What this cannot tell you
- It is not attribution. An address is a network location, not a person. Carrier-grade NAT puts thousands of unrelated subscribers behind one address.
- Datacenter is not a verdict. Blocking all datacenter space blocks VPN users, researchers and your own integration partners.
- Absence of evidence is not innocence. Most addresses are simply unobserved.
- No source is complete. Proxy supply is a market; every vendor sees a slice of it. Treat any single feed, this one included, as one input among several.
The data behind this page
IP99 maintains its own geolocation and proxy-supply databases, covering 244 countries and regions, refreshed daily. The proxy-supply observations on this site cover the 7 days to 28 October 2026. Country-level breakdowns, including the residential-versus-datacenter split for each, are published at IP ranges by country.
Related: What is my IP address? · IP location: where an IP address is · IP address lookup: what you can and cannot find out · Rotating residential proxies and dial-up pools · Residential proxy vs datacenter proxy · Is this IP a VPN? · What an IP risk score means · How fresh should IP risk evidence be? · What is an ASN? · Free IP geolocation and risk API · Proxy exit addresses captured this week · IP risk profile · IP ranges by country · IP ranges by ASN.
FAQ
Can I tell whether an IP is a VPN from the address alone?
No. The address carries no mark. What can be checked is the usage type of the network it sits in, whether it is currently present in proxy supply, and how old that observation is. IP99 returns all three: network.usage_type, evidence_state and computed_at.
Does a datacenter IP mean a bot?
No. Datacenter is where VPN providers, CI runners, monitoring agents and integration partners legitimately live. Treat usage type as one signal and read it together with the risk score and the age of the evidence.
How old can the evidence be before it stops meaning anything?
Rotating proxy exits and dial-up pools change tenant within minutes to hours. IP99 decays the score with the age of the last observation and moves evidence_state from active to stale when it expires; a verdict without a timestamp cannot be acted on.
Is the lookup free?
Yes: GET https://ip99.com/v1/ip/{ip} needs no key and no signup, 500 lookups per day per client IP, and the same lookup is an MCP tool at https://ip99.com/mcp. A free account raises the allowance; higher volumes and self-hosted deployment are on the pricing page.