VPN Detection API: Separating Proxy and Tor Abuse From Legitimate Users

A VPN detection API tells you that a connection is anonymized. It does not tell you who is behind it. Millions of people use VPNs for privacy, public Wi-Fi security, and remote work, so treating every VPN as a threat turns away real customers. The useful question is narrower: is this specific IP showing signs of abuse right now? This guide explains how to answer that with connection type, blocklist and abuse signals from multiple sources, and data that stays current, and how to turn the answer into a policy your team controls.

Why Blocking Every VPN Costs You Legitimate Users

VPN use is mainstream. A February 2025 CNET survey conducted by YouGov found that 43% of US adults use a VPN, and 52% of people who have used one do so to protect their IP address. Keeping online activity private was the second most common reason.

Work is another major reason. In an August 2023 OnePoll survey of 2,000 British adults for Forbes Advisor UK, 24% of British VPN users said their employer requires one, and 34% use a VPN for security on public Wi-Fi. Many companies also route staff traffic through Zero Trust Network Access (ZTNA) services, which means a sign-up from a corporate laptop can look like proxied traffic.

Even Tor has legitimate users. The Tor Project's guidance for relay operators describes the network as "a censorship resistance, privacy, and anonymity system used by whistle blowers, journalists" and abuse victims, among others.

A blanket rule that rejects all anonymized traffic will catch some abuse, but it also rejects these users. A better approach scores each connection on what it is doing and what is known about it, then lets your team decide how to respond.

VPN, Proxy, Residential Proxy, and Tor: How Each Connection Type Differs

These connection types are often grouped together, but they carry different signals.

Commercial VPN. Traffic exits through servers run by a VPN provider. The IP usually belongs to hosting infrastructure and is shared by many customers at once.
Open proxy. An unvetted proxy server that anyone can route traffic through. Open proxies are often found and listed by public proxy feeds.
Residential proxy. Traffic exits through a home or small business connection. It looks like an ordinary broadband user, which is exactly why it is attractive for abuse (more on this below).
Tor exit node. The last relay in a Tor circuit. The Tor Project publishes exit relay addresses, and those addresses change as relays join and leave the network.
ZTNA and enterprise access. Corporate security services that route employee traffic through known provider ranges. This is legitimate business traffic.

IP Insights classifies each IP into one of eight connection types: enterprise, wired, mobile, vpn, tor, open-proxy, cloud-provider, and satellite. Classification uses network ranges, autonomous system number (ASN) patterns, which identify the network that owns an IP range, reverse DNS data, and reputation sources. A separate trusted provider check recognizes known ZTNA providers, such as Zscaler, Cloudflare Access, Palo Alto Networks, Okta, and Netskope, which lowers the risk score for that traffic.

Residential Proxies Are Where Abuse Hides

Residential proxies are the hardest category to judge from the IP alone, because they borrow the reputation of real households.

The FBI warned in 2026 that "residential proxies allow cyber attackers to rapidly rotate between a large number of IPs, bypassing rate limits and lockout mechanisms." The same advisory notes that criminals can obtain "a residential proxy IP address in the same city as the victim" to avoid geolocation alerts during account takeover.

The scale is large. Over a 55-day period in early 2026, Bitsight observed 53 million unique exit nodes across 30 residential proxy services, and 15% of those exit IPs (8.2 million) were also flagged for active malware infections. Lumen's Black Lotus Labs reports tracking "nearly 20 million distinct IPs per day across more than 30 malicious proxy botnet clusters."

Rotation also limits what any single reputation list can see. In a report on 4 billion malicious sessions targeting edge devices, GreyNoise found that each residential IP averaged fewer than three sessions before disappearing, and that 78% were "invisible to reputation feeds."

The practical takeaway: a clean reputation result on a residential IP is weak evidence of legitimacy. It works best as one input alongside behavioral, email, and velocity signals.

Why One Blocklist Is Not Enough

Blocklists answer an important question: has this IP been reported for abuse? But any single list has limits.

Coverage differs between lists. A study of 2,093 open-source blocklists, published in 2021 as "Blocklist Babel," reported generally low overlap between providers and wide differences in how often entries are added and removed. An IP missing from one list may appear on another.

Addresses are shared and reused. A study of 151 public IPv4 blocklists, presented at the 2020 ACM Internet Measurement Conference (IMC), found that 53% to 60% of the lists contained reused addresses, which can affect as many as 78 legitimate users for as many as 44 days. Cloudflare has reported that carrier-grade NAT (CGNAT) addresses, where many subscribers share one public IP, are rate limited three times more often than other IPs despite bot scores that indicate traffic is more likely to be human.

Agreement carries weight. When several independent sources report the same IP, and it has active abuse reports, the case for review is much stronger than a single listing.

To check a single address by hand, try the free IP reputation checker or IP blacklist checker. Blacklist and blocklist mean the same thing; this guide uses blocklist.

IP Insights checks each IP against aggregated abuse and threat feeds, including curated DNS-based blocklists (DNSBL/RBL), as part of 30+ continuously updated threat intelligence sources. The response includes whether the IP is blocklisted, the number of active abuse reports, and the number of independent sources that reported it.

Why Freshness Matters: Tor Exit Lists and IP Reputation Change Constantly

IP reputation decays quickly. In the IMC 2020 study, blocklisted addresses were removed within nine days on average, and about 77% of dynamically allocated reused addresses were removed within two days. An IP that was abusive last week may belong to a different, legitimate user today.

Tor changes just as fast. In 2020, the Tor Project stated that its bulk exit list "is updated at most once every 40 minutes depending on the number of exit relays in the network at the time, fetching it every hour would be reasonable."

Two implications for your stack:

Use continuously updated sources. A list snapshot from last month will both miss new abusers and flag addresses that have since been reassigned.
Do not cache dynamic results for long. The Opportify documentation recommends caching relatively stable data such as geolocation or ASN, but avoiding long caching for dynamic data such as blocklist or risk states.

How IP Insights Scores Anonymized Traffic

IP Insights combines these signals into a normalized risk score from 200 to 1000, with five risk levels: lowest, low, medium, high, and highest. Each analysis lists reason codes for the highest-weight factors behind the score, such as ip-blocklisted, multiple-blocklist-sources, tor-exit-node, open-proxy, vpn, or trusted-provider, so your team can see why an IP was scored the way it was. Together, the score, level, and reason codes form the Explainable Risk Report.

The main inputs are:

Blocklist status, abuse reports, and source count. Current listings and agreement across sources raise the score.
Connection type. Tor exit nodes and open proxies are scored in the high-risk range by design, because they offer anonymity to anyone. That is a scoring rule, not a verdict: the person behind a Tor exit node may be a journalist or a privacy-conscious customer. A VPN connection raises the score less, and the result depends on the other signals present.
Trusted provider recognition. Known ZTNA and enterprise providers reduce the score, so corporate traffic is less likely to be mistaken for a threat.
Network context. Geography, reverse DNS, and WHOIS completeness (whether public registration records exist for the IP range) add supporting evidence.

This is how the score helps separate cases that look identical at the connection level. A commercial VPN IP with no blocklist hits and no abuse reports is a different situation from a VPN IP reported by several sources with active abuse reports. The score reflects that difference.

Building a Risk-Based Policy Your Team Controls

IP Insights scores and flags. Your team decides what happens next. A risk-based policy usually works better than a single allow or deny rule. Here is an example to adapt to your own audience and risk tolerance:

Situation	Example response
Lowest or low risk, including trusted ZTNA providers	Continue the normal flow
VPN with no blocklist hits or abuse reports	Continue, and weigh email, behavioral, and velocity signals
Medium risk	Add a verification step or queue for review
Tor exit node or open proxy without other risk signals	Review, or require additional verification for sensitive actions
Blocklisted by multiple sources with active abuse reports	Hold for manual review before granting access

A few practices make this policy hold up over time:

Combine signals. IP data is strongest alongside email, device, behavioral, and velocity signals. Fraud Protection scores each submission across 100+ signals if you need that combined view.
Review false positives. Track how often legitimate users land in each tier, and adjust thresholds for your audience. A business-facing product with many remote employees will see more ZTNA and VPN traffic than a consumer app.
Keep results fresh. Re-score at the moment of the action you care about, such as sign-up or checkout, rather than relying on an old lookup.

Getting Started With IP Insights as Your VPN Detection API

Send a request to the Analyze IP endpoint, POST /ip/analyze, on the base URL https://api.opportify.ai/insights/v1, with your API key in the x-opportify-token header. The request body takes the ip to analyze (IPv4 or IPv6) and an optional enableAI flag, which defaults to false. Opportify does not use query parameters for authentication or personal data; everything travels in headers or the request body.

curl -X POST "https://api.opportify.ai/insights/v1/ip/analyze" \
  -H "Content-Type: application/json" \
  -H "x-opportify-token: YOUR_API_KEY" \
  -d '{ "ip": "203.0.113.42", "enableAI": true }'

The response also includes geolocation, WHOIS, and reverse DNS data. The fields most relevant to this guide look like this (example values, response trimmed):

{
  "ipAddress": "203.0.113.42",
  "connectionType": "vpn",
  "trustedProvider": { "isKnownProvider": false },
  "blocklisted": {
    "isBlockListed": false,
    "sources": 0,
    "activeReports": 0
  },
  "riskReport": {
    "score": 480,
    "level": "medium",
    "baseAnalysis": ["vpn"]
  }
}

riskReport.level is one of lowest, low, medium, high, or highest. Route on it for simple policies, and use connectionType, trustedProvider, blocklisted, and riskReport.baseAnalysis when you need finer rules. Official SDKs are available for Node.js, Python, PHP, and Java. See the IP Insights API reference for the full schema, and pricing for current plans.

Key Takeaways

A VPN or proxy connection is a signal, not a verdict. Many users rely on VPNs for privacy, public Wi-Fi security, and remote work.
Residential proxies rotate quickly and borrow household reputations, so weigh them with behavioral, email, and velocity signals.
No single blocklist is complete. Agreement across multiple sources and active abuse reports are stronger evidence than one listing.
IP reputation and Tor exit lists change constantly. Use continuously updated sources and avoid long caching of risk results.
IP Insights scores and explains each IP with reason codes. Your team sets the policy for each risk level.

By Use Case

By Role

Free Tools