Is This IP a VPN? Reading the vpn Signal Without Blanket Blocks

Blanket-blocking every address that looks like a VPN is a product decision dressed up as security. On IP99 by ThreatHunter, the vpn signal means something narrower: a static commercial VPN exit on infrastructure the provider controls — usually a fixed hosting/dedicated address, shared by many users and stable for weeks. That is the opposite of a rotating residential proxy. Treating hosting alone, or every IDC address, as "VPN → refuse" over-blocks privacy users and travellers while still missing proxy supply that wants to look like a customer.

This walkthrough stays on free, no-key GET /v1/ip/{ip}. JSON samples below are documented product shapes from IP99 docs and prior verified captures — run the curls yourself for a live snapshot. Notes: IP99, API, Is this IP a VPN?, detect proxy / VPN.

What vpn is (and what it is not)

IP99's free lookup returns a 0–100 risk.score for freshness and strength of verifiable risk evidence, not attacker probability. risk.level follows the score (0 → none, 1–29 → low, 30–69 → medium, 70–100 → high). Signals appear only when they hit; missing keys mean unknown, not zero.

Tags that matter here:

slug	Meaning	Typical disposition
vpn	Static commercial VPN exit (observed infrastructure)	Product decision; often step-up, not refuse
proxy	Address currently used as a proxy exit	Step-up or block by business cost
dialup_pool	Dial-up / redial rotation pool	Treat as supply-side rotation (often DYN/MOB)
hosting / mobile	Network attributes	Not risk verdicts alone
crawler	Search crawler egress	Benign; does not score

Official page shape for a commercial VPN exit (is-this-ip-a-vpn):

• Hosting or dedicated ranges — providers rent datacenter servers, so network.usage_type is usually IDC and risk.signals often also lists hosting.
• Static — the same address serves the same provider for weeks or months; evidence ages slowly compared with rotating exits.
• Shared — many users sit behind one exit at once; the address's history must not attach to the next person behind it.
• Observed, not inferred — vpn comes from observed VPN infrastructure, not from network type. Hosting alone never puts vpn there.

Two common mistakes:

1. IDC + hosting ≠ VPN. A datacenter address without vpn evidence is hosting, not a VPN. Public DNS and ordinary cloud servers look like that every day.
2. "VPN" apps on consumer devices ≠ commercial VPN exits. Apps that route through phones or home routers are residential proxy supply. IP99 reports those as proxy / dialup_pool on DYN or MOB space — detected by presence in proxy supply, not by calling them VPN.

Tor is not a VPN: Tor uses volunteer relays; a VPN is a commercial service with fixed provider-controlled exits. This article covers VPN/proxy infrastructure only — do not invent a Tor tag, and do not claim IP99 detects Tor.

Free /v1/ip does not return share_tier (Pulse only). On free tier, lean on evidence_state, score/level, signal type, plus your own velocity / device checks.

Documented contrast: hosting attribute vs datacenter proxy

curl https://ip99.com/v1/ip/8.8.8.8

Documented product sample (IP99 docs / prior verified capture):

{
  "ip": "8.8.8.8",
  "computed_at": "2026-10-09T10:22:26Z",
  "evidence_state": "none",
  "geo": {
    "continent": "NA",
    "country": "US",
    "region": "California",
    "city": "Mountain View",
    "tz": "America/Los_Angeles"
  },
  "network": { "asn": 15169, "usage_type": "IDC" },
  "risk": {
    "score": 0,
    "level": "none",
    "signals": ["hosting"]
  }
}

hosting here is a network attribute on public DNS. evidence_state: none with score 0 means no verifiable proxy-class evidence on file — not a clean bill of health, and not a VPN. "Block all IDC" would refuse this address for the wrong reason.

Now a Paris datacenter address with proxy evidence (contrast: proxy on IDC, not vpn):

curl https://ip99.com/v1/ip/178.20.30.146

Documented product sample (IP99 docs / prior verified capture):

{
  "ip": "178.20.30.146",
  "computed_at": "2026-10-09T10:23:02Z",
  "evidence_state": "active",
  "geo": {
    "continent": "EU",
    "country": "FR",
    "region": "Île-de-France",
    "city": "Paris",
    "tz": "Europe/Paris"
  },
  "network": { "asn": 46475, "usage_type": "IDC" },
  "risk": {
    "score": 99,
    "level": "high",
    "signals": ["hosting", "osint", "proxy"]
  }
}

Same IDC + hosting space as many VPN exits, but the slug here is proxy (plus osint), not vpn. Branch on the matched signal, not on "looks like a datacenter." When vpn appears on a fresh active response, treat the egress as a shared commercial exit: challenge where product rules require it, but do not attach prior account history to the next user behind that IP.

What the weekly capture mix says

VPN-style infrastructure and rotating proxy supply live in different places. Of the 10,638,587 new proxy exit addresses captured in the 7 days to 5 November 2026, only 4% sat in datacenter space; 79% were residential broadband. Source: proxy-exits (also cited on is-this-ip-a-vpn; page data risk:20261106211046 geo:20261106). Someone who wants to look like a customer does not buy a static commercial VPN. A hosting-only blocklist over-punishes legitimate VPN users and under-covers residential exits that dominate new supply.

A practical branch (evidence_state first)

Official triage order: evidence_state → score/level → signal type. Generic guidance (not a contract): score 0 → do not stamp the IP "clean"; 1–29 → observe; 30–69 → captcha / throttle / second factor rather than a hard ban; 70–100 → block only when business cost allows. Score meaning and freshness notes: IP risk score.

1. Read evidence_state (active / stale / none).
2. Read risk.signals and network.usage_type.
3. If vpn is present and evidence_state is active:
     - Decide what VPN means for YOUR product (privacy vs licensing / geo / promo rules).
     - Treat the exit as shared — never attach prior account history to the next user.
     - Read geo.country as the EXIT country, not the user's home country.
     - Prefer step-up + velocity/device over refuse for most consumer flows.
4. Else if hosting on IDC WITHOUT vpn / proxy / dialup_pool:
     - Network attribute only — do not invent a VPN verdict.
5. Else if proxy / dialup_pool on DYN or MOB:
     - Residential / mobile proxy supply — different playbook than commercial VPN.
6. Never mark score 0 + evidence_state none as "trusted clean."
7. Re-query at decision time; do not cache a VPN verdict for days.

Anonymous quota is 500 lookups/day per client IP (60/min); a free logged-in key raises the daily cap to 5,000/day. Check remaining with GET https://ip99.com/v1/me or the X-Daily-* response headers. OpenAPI: https://ip99.com/openapi.json.

Do not treat IP99 scores as identical to other ThreatHunter datasets elsewhere — this article only claims what free /v1/ip and the cited English product pages document.

Try it

curl https://ip99.com/v1/ip
curl https://ip99.com/v1/ip/8.8.8.8
curl https://ip99.com/v1/ip/178.20.30.146
curl https://ip99.com/v1/me

IP99 is a ThreatHunter product. Use the free lookup to separate commercial VPN static exits from residential proxy supply and ordinary hosting before a blanket ban hits a legitimate privacy user. Start at https://ip99.com; read Is this IP a VPN?, detect proxy / VPN, and https://ip99.com/api.