Is this IP a VPN? What a VPN exit looks like in the data

A VPN exit is usually a fixed address on hosting or dedicated infrastructure, shared by many users at once and stable for weeks — the opposite of a rotating residential proxy. In a lookup it shows as signals.vpn: true with a vpn tag, most often on usage_type: "IDC" space. A datacenter address without that evidence is hosting, not a VPN, and a "VPN" app that routes through consumer devices is a residential proxy and is reported as one.

What a VPN exit looks like

Hosting or dedicated ranges. Commercial VPN providers rent servers in datacenters, so the exit's segment is IDC and signals.hosting is true. Some run their own ASN; many rent from the same few clouds.
Static. The same address serves the same provider for weeks or months. Evidence about it ages slowly, unlike rotating exits.
Shared. Hundreds of users at a time sit behind one exit, which is why a VPN address carries no information about any one of them.
Observed, not inferred. IP99 sets signals.vpn from observed VPN infrastructure with a last_seen on the tag, not from the network type. Hosting alone never sets it.

VPN, proxy, residential proxy: what is the difference for a defender

VPN — the user chose it; datacenter space; static; announces itself by network type and by observed provider infrastructure. Reported as vpn.
Datacenter proxy — a server relaying requests; same space as a VPN, often shorter-lived. Reported as proxy with hosting: true.
Residential proxy / dial-up pool — a consumer connection resold as an exit, sometimes without its owner's knowledge; changes hands in minutes. Reported as proxy or dialup_pool on DYN or MOB space. See rotating residential proxies and dial-up pools.

What the data says

VPN-style infrastructure and rotating proxy supply live in different places. Of the 1,000,455 exit addresses IP99 observed in commercial rotating pools in the 7 days to 12 September 2026, only 5% sat in datacenter space; 71% were residential broadband. Someone who wants to look like a customer does not buy a VPN. Weekly figures: Residential proxy exits observed this week.

How to check

Free, no signup, no API key — 1000 lookups per day per client IP:

curl https://ip99.com/v1/ip/{ip}

Read four fields together: signals.vpn (observed VPN infrastructure), signals.hosting (datacenter space, on its own not a verdict), network.usage_type (IDC / DYN / MOB / GTW) and evidence_state with computed_at (how current the evidence is). risk.tag_details carries the last_seen time of each tag. Field reference: API documentation.

What to do with a VPN hit

Decide what a VPN means for your product first. Privacy users, travellers and corporate egress all look the same. For most consumer services a VPN is a reason to watch velocity and device signals, not to refuse.
Treat it as shared. One exit, many users: never let a VPN address's history attach to the next person behind it.
Where VPN use breaks your rules (licensing, geo-restricted content, one-account-per-person promotions), challenge on vpn: true with fresh evidence — and read geo.country as the exit's country, not the user's.

FAQ

Does signals.hosting true mean the IP is a VPN?

No. hosting means the address belongs to datacenter or cloud infrastructure; most such addresses are ordinary servers. A VPN exit is reported by signals.vpn and the vpn tag, which come from observed VPN infrastructure with a last_seen time.

Can a VPN be on a residential IP?

Apps sold as VPNs sometimes route traffic through other users' phones or home routers. Technically that is a residential proxy, and IP99 reports it as one: proxy or dialup_pool on residential or mobile space, detected by observed presence in proxy supply rather than by network type.

How current is a VPN detection?

VPN exits are stable, so the evidence ages slowly, but it still ages: every tag carries a last_seen time and the response carries evidence_state and computed_at. Query at decision time rather than caching a verdict.

Should I block VPN users?

That is a product decision, not a security one. Many VPN users are legitimate; the address is shared by many people at once; and the exit's country is not the user's. Most services do better stepping up on fresh evidence combined with velocity and device signals than refusing outright.

Is Tor the same as a VPN?

No. Tor is a volunteer relay network with its own exit nodes and its own detection mechanism; a VPN is a commercial service with fixed exits on infrastructure the provider controls. This page covers VPN and proxy infrastructure only.