Detect VPNs, proxies, and residential proxies the instant they connect, and reveal each visitor's actual country behind the mask. Every verdict includes a confidence score to allow, challenge, or block.
IP Address
xxx.xxx.xxx.xxxTrusted by teams at
Real-time detection checks the live connection, catches new VPN/proxy exits, and avoids false flags from rotating residential IPs.
A lightweight script starts the test in the visitor's browser, live network tests measure how the connection actually behaves, and the verdict comes back usually in one to five seconds with scores you can act on. No API key ships to the client: requests are authorized by your registered domain.
Authorized script starts the test of the current connection
Detection Engine performs multiple tests on the incoming connection
Checks routing paths and connection signals
Returns VPN/Proxy scores instantly
Almost 98% of test results matched the actual connection status.
Four fields, meant to be read together: is_anonymous answers whether the connection is hiding, confidence says how much to trust that answer, and the two scores say what kind of hiding it looks like.
The headline verdict. True means the connection is anonymized through a VPN or a proxy; false means the live tests found nothing hiding. It deliberately does not say which type: that is the job of the two scores.
Certainty about the is_anonymous verdict, up to 100. This is not a risk score: confidence 100 with is_anonymous false means confidently clean. Low values are weak evidence in either direction, so gate your actions on it.
The likelihood, 0 to 100, that the connection runs through a VPN tunnel. Plenty of legitimate users browse through VPNs, so a high value usually deserves a challenge rather than an outright block.
The likelihood, 0 to 100, that the connection runs through a proxy, including residential and rotating proxies. The two scores are independent likelihoods, not halves of a split, so both can be high at once.
Below 30 indicates a very weak signal where false positives live, so these requests are allowed and logged without adding anything to the user's path.
These bands are starting points. Tune the cutoffs against your own confirmed fraud data, because the right threshold depends on what a false positive costs you.
Live VPN and proxy signals are a high-value input for fraud decisions because they arrive while the session is still in front of you: before the account exists, before the payment settles. Combined with your behavioral, velocity, and transaction data, they catch the anonymized traffic that drives fake signups, credential abuse, and payment fraud.
Flag anonymized traffic during signups, logins, and payments without depending on just IP lists. New exits and fresh proxy pools get caught on behavior, not reputation.
Feed the live verdict into your risk engine as a low-latency input. It slots next to device, velocity, and transaction signals rather than replacing them.
Turn on IP security context and every verdict arrives with the address's threat score, provider names, and history, so one round trip gives you both the live behavior and the reputation to confirm it.
Each detection below was reproduced by connecting a real browser or device through the named service and running the live test.
The session appeared to come from a normal residential ISP. Live checks detected proxy infrastructure behind the connection and flagged it with high confidence, a case IP reputation alone can miss.
The IP belonged to an ordinary consumer network on paper. Real-time analysis identified active anonymization during the session and returned a strong proxy verdict while the address still looked clean in list terms.
The application was accessed through an encrypted tunnel. Live detection identified the anonymization and classified the session as VPN traffic with high confidence, tunnel protocol and all.
WARP can make traffic appear like normal consumer traffic, but live detection still identified the session as anonymized with high confidence. This shows how live analysis can detect VPN activity that may look residential at the IP level.
Score the session at checkout, while the transaction can still be challenged. Anonymized connections correlate with stolen-card testing and fake orders, and a live proxy verdict is grounds for review before the charge, not after the chargeback.
Run the test on the signup form to stop multi-accounting at the door. Fraud farms lean on residential proxies precisely because lists trust them; live analysis does not.
Check coupon redemptions and referral claims in real time to stop one user harvesting rewards behind rotating proxies, without blocking the legitimate customer on a VPN.
A trusted account arriving anonymized for the first time is a session worth challenging. Trigger MFA or session monitoring from the live verdict instead of a stale IP flag.
Banned users come back through VPNs and proxies. Catch the anonymization live at re-registration or re-entry and enforce device or account controls immediately.
Understand why real-time detection offers superior protection against modern anonymization techniques compared to traditional static lists.
Real-time VPN and proxy detection tests the live connection at the moment of access instead of just looking the IP up in a static list. It catches anonymization that has no list history yet, including residential proxies and brand-new VPN exits, and returns scored verdicts you can act on immediately.
No. Live detection returns a decision signal, and you choose the action: allow, challenge with CAPTCHA or MFA, rate-limit, or block, based on your own risk tolerance. Working in confidence bands keeps false positives from quietly costing you real, paying customers.
is_anonymous is the verdict: the connection is anonymized or it is not. confidence, up to 100, is certainty about that verdict, not a risk score. vpn_score and proxy_score are independent 0 to 100 likelihoods for each type of anonymization, so you can treat VPN traffic and proxy traffic differently.
Yes. WARP operates as a relay service rather than a traditional proxy, and the live detection test analyzes the network characteristics of the connection to identify this behavior. In our reproduced tests, WARP sessions were detected as anonymized with strong confidence, even when the traffic appeared similar to normal consumer browsing.
Each session analysis costs 3 credits, or 5 credits with IP security context included, drawn from your plan's normal credit pool. Paid plans start at $19 per month for 150,000 credits. The credits usage guide lists the exact billing rules per request.
You can sign up for an IPGeolocation account to get started. For access or trial options specific to real-time VPN and proxy detection, contact the support team for details that fit your setup.
No. It classifies a session using live connection-level techniques alone and reaches its verdict without consulting our IP intelligence database or any traditional IP lookup. If you ask for the IP reputation data as well, it is simply attached alongside the live result.
Yes. No offline database has complete coverage: new VPN endpoints, private proxies, and rotating residential pools may not be listed anywhere yet. Real-time detection does not depend on having seen the address before.
Both, where you can. The IP Security API gives broader context and known history for an address; real-time detection tells you what the connection is doing right now. Together they support better decisions without unnecessarily blocking legitimate users.
The IP Security API answers "what is known about this IP address" from continuously updated intelligence, server-side. Live detection answers "is this session anonymized right now" by testing the connection in the browser. They corroborate each other: set includeIPSecurity to true and one round trip returns both views.
No, if you use it as designed. The script loads async and a verdict usually takes one to five seconds depending on the session, so you start monitoring on page load and read the result at your decision point. Most teams run it only on high-value actions like signup, login, and checkout.
Yes, and that is the main reason it exists. Residential proxies borrow real consumer IPs, so blocklists trust them. Live detection evaluates the connection's behavior rather than the IP's reputation, which catches a residential proxy session even while the same address serves a legitimate household.
A database is the right tool for offline scoring, bulk jobs, and zero-latency lookups, and the wrong tool for catching anonymization it has never seen. Endpoints rotate, new providers launch, and IPs get reassigned. Live detection closes that gap; many teams run both and corroborate.
Register your domain as a Request Origin in the dashboard, add one async script tag, and read the verdict at your decision point. No API key ships to the browser; the origin registration authorizes the call. The docs cover the full response schema and recommended thresholds.
The IP Security API reports what is already known about an IP address, drawn from our IP intelligence database and updated daily: whether that address is associated with VPN or proxy infrastructure. Real-time detection inspects the connection as it happens, so its answer describes the session in front of you rather than the address's history.
A residential IP is a real household address that may also be part of a proxy network. The homeowner's own request and an anonymous request routed through that network can arrive from the same address seconds apart. A database can tell you the address is associated with residential proxy infrastructure, but not how it is being used on this particular connection, so acting on that association alone can affect legitimate users too.
In our testing, classification accuracy is around 98%. The sessions it read incorrectly all came back with low confidence (< 35), so consider the confidence value before making a decision.
Ready to Catch
Run live VPN and proxy detection on your highest-risk actions, on the same global edge and 99.99% uptime SLA as every ipgeolocation.io API. Create a key, register your origin, and the first verdict is minutes away.
Get the latest in geolocation tech, straight to your inbox.
