Documentation for IPinfo IP to Privacy Detection (Extended) API

The IPinfo IP to Privacy Detection (Extended) API service provides detection methodology related metadata to support risk scoring, confidence metrics, and IP reputation aspects behind each IP address that IPinfo detects to be anonymous.

IPinfo uses multi-modal detection methods to detect anonymous IP addresses, which includes internet measurement, IP address behavior and characteristics, internet records metadata, etc. This multi-data detection method makes for a robust detection process and can be used to fine-tune fraud detection models based on the risk models of companies.

You can access IPinfo Anonymous IP Detection (Extended) data as a downloadable dataset as well: Privacy Detection Extended Data Downloads

Quick Reference

Field	Description	Example
`vpn`	Indicates Virtual Private Network (VPN) service exit node IP address	`true`
`proxy`	Indicates an open web proxy IP address	`false`
`tor`	Indicates a Tor (The Onion Router) exit node IP address	`false`
`relay`	Indicates a location-preserving anonymous relay service	`false`
`hosting`	Indicates a hosting/cloud service/data center IP address	`true`
`service`	Name of the privacy service provider - includes VPN, Proxy, and Relay service provider names	`NordVPN`
`confidence`	The level (from 1 to 3) of confidence attributed to the best source associated with this range	`3`
`coverage`	For inferred ranges (see inferred flag), represents the proportion of the range (in IP count) that we saw direct evidence of VPN activity on; the remaining percentage of the range (1 - coverage) is composed of IPs we did not directly observe. For IPs/ranges we've fully directly observed VPN evidence on, this value is 1.0.	`1`
`census`	Ranges where we've observed VPN software/ports on; we run scans on ports and protocols commonly associated with VPN software. Ranges with the census flag are those where these scans obtained positive results	`false`
`census_ports`	The ports we've gotten positive results for when running our VPN detection census	``
`device_activity`	Ranges on which we've observed device activity compatible with VPN usage (outside of known infrastructure area; simultaneous use around a large area; pingable and/or associated with hosting providers)	`false`
`inferred`	Whether the range associated with the record is the result of direct observation or inference based on neighboring IPs	`false`
`vpn_config`	Ranges where we confirmed VPN activity by directly running VPN software from almost 200 different providers and collecting exit IPs	`false`
`whois`	Ranges where we've observed VPN software/ports on AND have a WHOIS association with either VPNs in general or specific VPN providers. e.g. if our ipsec scan returned a positive result for an IP and its WHOIS record indicates that it is owned by a VPN provider, this flag will be true.	`false`
`first_seen`	Date when the activity on an anonymous IP address was first observed: Date in YYYY-MM-DD format, ISO-8601. Within the 3-month lookback period.	`2025-09-19`
`last_seen`	Date when the activity on an anonymous IP address was last/recently observed: Date in YYYY-MM-DD format, ISO-8601.	`2025-11-06`

Confidence intervals defined:

Confidence Level	Description
3	Direct observation of commercial use (vpn_config)
2	Direct observation of VPN software running on the range (census) + registrar information associated with VPNs or specific providers OR highly convincing device activity (large spread of devices on pingable networks that are not associated with carrier traffic and known to be associated with hosting providers)
1	Direct observation of VPN software running on the range (census) without known association to specific providers or VPNs in general OR device data that is suspicious but not associated with hosting ranges

Lookup IP addresses:

curl https://ipinfo.io/193.42.96.221/privacy?token=$TOKEN

{
  "vpn": true,
  "proxy": false,
  "tor": false,
  "relay": false,
  "hosting": true,
  "service": "NordVPN",
  "confidence": 3,
  "coverage": 1,
  "census": false,
  "census_ports": "",
  "device_activity": false,
  "inferred": false,
  "vpn_config": false,
  "whois": false,
  "first_seen": "2025-09-19",
  "last_seen": "2025-11-06"
}

In the case that the IP address is not an anonymous type or actively hosting IP anonymization technology (only a hosting-type IP), the respective detection metadata fields will not be present.

non-anonymous IP address

curl https://ipinfo.io/93.42.96.221/privacy?token=$TOKEN

{
  "vpn": false,
  "proxy": false,
  "tor": false,
  "relay": false,
  "hosting": false,
  "service": ""
}

Hosting (only) type IP address

curl https://ipinfo.io/2a02:6ea0:2700:1:1012:2a00:4028:0/privacy?token=$TOKEN

{
  "vpn": false,
  "proxy": false,
  "tor": false,
  "relay": false,
  "hosting": true,
  "service": ""
}

If you are using an IPv6 connection, please use the v6.ipinfo.io endpoint.

View raw markdown file