Is your connection hidden?

What this tool actually checks

Three signals, each independent, run against the IP you submit:

• Datacenter / VPN ASN matching. Most VPN traffic originates from hosting and cloud ASNs — even when the specific VPN brand is unknowable, identifying the IP as datacenter rather than residential is a strong signal. The detector compares the IP's ASN against a curated list of major cloud providers (AWS, Azure, GCP, Cloudflare, Akamai), hosting companies (OVH, Hetzner, DigitalOcean, Linode, Vultr, Leaseweb, M247), and known VPN infrastructure (Tefincom/NordVPN, Surfshark, Mullvad).
• Tor exit node matching. The Tor Project publishes the current list of exit relays at check.torproject.org/torbulkexitlist. We refresh it every 24 hours.
• Geolocation context. Country and ASN organisation come from MaxMind's GeoLite2 databases.

What it doesn't do

• Residential proxy detection is not yet available. Services like Bright Data, Oxylabs, and Smartproxy route traffic through real home IPs leased from compromised devices or paid users. These addresses are structurally indistinguishable from legitimate residential connections without paid proxy databases — which we deliberately don't use.
• IP-range-level VPN provider identification is planned. A future update will be able to pinpoint specific VPN brands by their announced address blocks. For now the detector tells you "this is a datacenter" rather than "this is NordVPN exit node #214".
• ASN-based detection can produce false positives. Legitimate businesses that host their own infrastructure on cloud platforms will appear as datacenter connections. A small startup running a developer's office VPN on a $5 DigitalOcean droplet looks identical to a commercial VPN service to this detector.

How to read the result

The verdict pill at the top of the card uses three colors:

• Green — residential. ASN is not on the datacenter list and isn't a known Tor exit. The most likely explanation is that the IP belongs to a real ISP customer.
• Amber — VPN or datacenter. ASN matches the datacenter/hosting/VPN list. Confidence is "high" when the organisation name itself contains words like hosting, cloud, or VPN; "medium" when the ASN is on the list but the org name is generic.
• Red — Tor exit node. IP is on the Tor Project's published exit list. Confidence is always high for these — Tor publishes the list themselves.

If you want to read more, the ASN explainer covers what an autonomous system actually is, and the blacklist post walks through the related question of whether an IP is reputationally flagged.