Is this IP a VPN? What a VPN exit looks like in the data

A VPN exit is usually a fixed address on hosting or dedicated infrastructure, shared by many users at once and stable for weeks — the opposite of a rotating residential proxy. In a lookup it shows as "vpn" in risk.signals, most often on usage_type: "IDC" space. A datacenter address without that evidence is hosting, not a VPN, and a "VPN" app that routes through consumer devices is a residential proxy and is reported as one.

What a VPN exit looks like

Hosting or dedicated ranges. Commercial VPN providers rent servers in datacenters, so the exit's segment is IDC and risk.signals lists "hosting". Some run their own ASN; many rent from the same few clouds.
Static. The same address serves the same provider for weeks or months. Evidence about it ages slowly, unlike rotating exits.
Shared. Hundreds of users at a time sit behind one exit, which is why a VPN address carries no information about any one of them.
Observed, not inferred. IP99 puts "vpn" in risk.signals from observed VPN infrastructure, not from the network type; hosting alone never puts it there. The seconds-level time of that observation is a professional-tier field on the Pulse evidence rows, not part of this lookup.

VPN, proxy, residential proxy: what is the difference for a defender

VPN — the user chose it; datacenter space; static; announces itself by network type and by observed provider infrastructure. Reported as vpn.
Datacenter proxy — a server relaying requests; same space as a VPN, often shorter-lived. Reported as "proxy", with "hosting" alongside it in risk.signals.
Residential proxy / dial-up pool — a consumer connection resold as an exit, sometimes without its owner's knowledge; changes hands in minutes. Reported as proxy or dialup_pool on DYN or MOB space. See rotating residential proxies and dial-up pools.

What the data says

VPN-style infrastructure and rotating proxy supply live in different places. Of the 11,196,585 new proxy exit addresses the IP99 risk feed captured in the 7 days to 28 October 2026, only 2% sat in datacenter space; 80% were residential broadband. Someone who wants to look like a customer does not buy a VPN. Weekly figures: Proxy exit addresses captured this week.

How to check

Free, no signup, no API key — 500 lookups per day per client IP:

curl https://ip99.com/v1/ip/{ip}

Read three things together: risk.signals (the matched slugs — "vpn" for observed VPN infrastructure, "proxy" and "dialup_pool" for exits, "hosting" for datacenter space, which on its own is not a verdict), network.usage_type (IDC / DYN / MOB / GTW) and evidence_state with computed_at (how current the evidence is). The per-signal last_seen timestamp is not in this response: signals are in risk.signals, and seconds-level observation times belong to the professional Pulse tier's evidence rows. Field reference: API documentation.

What to do with a VPN hit

Decide what a VPN means for your product first. Privacy users, travellers and corporate egress all look the same. For most consumer services a VPN is a reason to watch velocity and device signals, not to refuse.
Treat it as shared. One exit, many users: never let a VPN address's history attach to the next person behind it.
Where VPN use breaks your rules (licensing, geo-restricted content, one-account-per-person promotions), challenge on a fresh "vpn" signal — and read geo.country as the exit's country, not the user's.

FAQ

Does hosting space mean the IP is a VPN?

No. "hosting" in risk.signals means the address belongs to datacenter or cloud infrastructure; most such addresses are ordinary servers. A VPN exit is a separate observation, reported by "vpn" in risk.signals with the observation time on the professional tier's evidence rows.

Can a VPN be on a residential IP?

Apps sold as VPNs sometimes route traffic through other users' phones or home routers. Technically that is a residential proxy, and IP99 reports it as one: proxy or dialup_pool on residential or mobile space, detected by observed presence in proxy supply rather than by network type.

How current is a VPN detection?

VPN exits are stable, so the evidence ages slowly, but it still ages: the response carries evidence_state and computed_at, and the seconds-level observation time is on the professional tier's evidence rows. Query at decision time rather than caching a verdict.

Should I block VPN users?

That is a product decision, not a security one. Many VPN users are legitimate; the address is shared by many people at once; and the exit's country is not the user's. Most services do better stepping up on fresh evidence combined with velocity and device signals than refusing outright.

Is Tor the same as a VPN?

No. Tor is a volunteer relay network with its own exit nodes and its own detection mechanism; a VPN is a commercial service with fixed exits on infrastructure the provider controls. This page covers VPN and proxy infrastructure only.