Response fields
detection
VPN, proxy, Tor, relay, hosting and mobile detection.
Anonymizer detection, verified by protocol handshakes on 25+ ports across 11 protocols and by nine VPN providers' own published server lists plus a public third-party list.
| Field | Type | Description |
|---|---|---|
is_proxy | boolean | IP responded as an open proxy during active probing. |
is_vpn | boolean | IP verified as VPN infrastructure by handshake, provider server list, ASN, or WHOIS evidence. |
is_tor | boolean | IP appears on the official Tor Project exit list (refreshed daily). |
is_hosting | boolean | IP belongs to hosting or datacenter infrastructure. |
is_relay | boolean | IP is a privacy relay (iCloud Private Relay or Cloudflare WARP), reported separately from VPNs. |
is_mobile | boolean | IP belongs to a mobile/cellular network. |
is_satellite | boolean | IP belongs to a satellite ISP (e.g. Starlink). |
is_anycast | boolean | IP is announced from multiple locations (anycast), per the manycast.net census. Common for public DNS and CDNs. |
is_residential_proxy | boolean | True when a proxy was detected on a home or mobile line. residential_proxy_status and residential_proxy_evidence say what it rests on. |
is_public_proxy | boolean | IP appears as a publicly listed open proxy. |
is_anonymous | boolean | Composite flag: true when any anonymizer signal (VPN, proxy, Tor, relay) applies. |
proxy_type | string | Protocol of the detected proxy (e.g. SOCKS5, HTTP CONNECT). |
anonymity_level | string | Anonymity level of the detected proxy. |
vpn_provider | string | Named VPN provider when the IP appears in a provider's own published server list, e.g. "NordVPN". |
vpn_provider_tier | string | Tier of the attributed VPN provider, when known. |
relay_provider | string | Named privacy-relay provider, e.g. "iCloud Private Relay", "Cloudflare WARP". |
proxy_score | number | Proxy likelihood from 0.0 to 1.0. |
vpn_confidence | number | 0–100 confidence that this IP is VPN infrastructure. |
residential_proxy_score | number | How likely the address is a residential proxy exit today, from 0.0 to 1.0. Falls as the last sighting gets older. 0 when no residential proxy was seen. |
last_seen | string | ISO 8601 timestamp of the most recent detection evidence. |
residential_proxy_status | string | "detected" (a proxy on a home or mobile line), "proxy_other_line" (a proxy, not on a home or mobile line) or "not_observed" (we never saw this address proxying, which is not the same as clean). |
residential_proxy_evidence | string | What the status rests on: "verified_forwarding" (it forwarded a test request), "observed_exit" (seen as the exit of a verified proxy), "third_party_observed" (seen proxying by a partner list), "handshake_only" (answered as a proxy, not verified) or "none". |
residential_proxy_last_seen | string | ISO 8601 timestamp of the latest proxy sighting, or "none". |
A field with no value comes back as the string "none", or 0 for numbers. The API never returns null.
Example
The detection group for 8.8.8.8, from a real lookup on 24 October 2026. Values change as the data is refreshed.
{
"detection": {
"is_proxy": false,
"is_vpn": false,
"is_tor": false,
"is_hosting": true,
"is_relay": false,
"is_mobile": false,
"is_satellite": false,
"is_anycast": true,
"is_residential_proxy": false,
"is_public_proxy": false,
"is_anonymous": false,
"proxy_type": "none",
"anonymity_level": "low",
"vpn_provider": "none",
"vpn_provider_tier": "none",
"relay_provider": "none",
"proxy_score": 0,
"vpn_confidence": 5,
"residential_proxy_status": "not_observed",
"residential_proxy_evidence": "none",
"residential_proxy_last_seen": "none",
"residential_proxy_score": 0,
"last_seen": "2026-10-20T12:21:35.000Z"
}
}