How to check if an IP address is a VPN

Paste the address into the FernTool IP lookup and look at the Type line. It tells you if the IP is a Tor exit node, a data centre or hosting network (where almost all VPNs and proxies run), a public DNS server, or a normal home or business internet connection. It’s free and needs no sign-up.

What the check looks at

Tor exit list. The Tor Project publishes every exit node. A match is certain: the person is using Tor.
Who owns the network. Home users get IPs from ISPs such as Telkom, Vodacom or Afrihost. VPNs rent servers from hosting companies and clouds (M247, Datacamp, OVHcloud, Hetzner, DigitalOcean, AWS and others). If the ASN owner is a hosting company, the visitor is almost certainly on a VPN, proxy or server.
Published cloud ranges. Amazon, Google, Microsoft, Cloudflare, DigitalOcean and Oracle publish their address lists, so we match those exactly.

Other clues you can check yourself

Reverse DNS: run the reverse DNS lookup. Names containing “vpn”, “proxy”, “server” or a hosting brand are a giveaway; home lines usually have ISP-style names (or none).
WHOIS: the WHOIS lookup shows who registered the address block and whether it’s marked for hosting.
Location mismatch: on your own site, an IP “in the Netherlands” with a browser set to South African time is a common VPN sign.
Many accounts, one IP: lots of unrelated sign-ups from one address points to a VPN or proxy, though mobile networks also share IPs (CGNAT).

What no IP check can reliably catch

Residential proxies route traffic through real home connections, so they look like ordinary users.
Self-hosted VPNs on a home line (for example a router at someone’s house) look residential.
False alarms: company networks, school networks and Apple’s iCloud Private Relay also come from data-centre addresses but aren’t “hiding” anything suspicious.

So treat a datacentre result as a strong hint, not proof, and don’t block people on it alone.

Is your own VPN working?

Turn the VPN on and open the VPN leak test. It should show the VPN’s IP and country, flag it as a VPN/datacentre address, and find no WebRTC leak of your real IP. Compare with your IP with the VPN off.

Checking many IPs (for site owners)

To screen sign-ups or log files, the free FernTool API checks up to 100 addresses per request with POST /api/batch, returning is_tor, is_datacenter and the provider for each. See the API docs. Use it to add friction (an extra verification step) rather than to ban people outright.

Frequently asked questions

Can websites tell if I am using a VPN?

Often, yes. Most VPN servers sit in data centres, and sites can match the IP against hosting networks. They still can’t see your real IP if the VPN works and has no leaks.

How accurate is VPN detection by IP?

Tor detection is exact, and data-centre detection catches most commercial VPNs and proxies. Residential proxies and VPNs running on home connections can’t be reliably detected from the IP alone.

Is it legal to check if an IP is a VPN?

Yes. It uses public information about who owns IP address ranges. Using a VPN is also legal in South Africa.

Why is my normal home IP flagged as a VPN?

Rarely, an ISP uses addresses registered to a hosting company, or you are behind a company network or iCloud Private Relay. Check the network owner in the IP lookup; if it is your ISP, the address is residential.