IPinfo - Comprehensive IP address data, IP geolocation API and database

Privacy Detection API Developer Resource

Available in: IPinfo Core, IPinfo Plus, and IPinfo Enterprise

The Privacy Detection API allows you to programmatically identify IP addresses associated with privacy services such as VPNs, proxies, Tor exit nodes, anonymous relays, and hosting/data center providers. The Privacy Detection API is available at /{ip}/privacy.

Quick Reference

API Schema
JSON
{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "IPinfo Privacy Detection API Response",
  "description": "Schema for IPinfo Privacy Detection API response",
  "type": "object",
  "properties": {
    "vpn": {
      "type": "boolean",
      "description": "Indicates whether the IP address is a Virtual Private Network (VPN) service exit node.",
      "example": true
    },
    "proxy": {
      "type": "boolean",
      "description": "Indicates whether the IP address is an open web proxy.",
      "example": false
    },
    "tor": {
      "type": "boolean",
      "description": "Indicates whether the IP address is a Tor (The Onion Router) exit node.",
      "example": false
    },
    "relay": {
      "type": "boolean",
      "description": "Indicates whether the IP address is part of a location-preserving anonymous relay service (e.g., iCloud Private Relay).",
      "example": false
    },
    "hosting": {
      "type": "boolean",
      "description": "Indicates whether the IP address belongs to a hosting provider, cloud service, or data center.",
      "example": true
    },
    "service": {
      "type": "string",
      "description": "The name of the privacy service provider (VPN, Proxy, or Relay provider name).",
      "example": "NordVPN"
    }
  }
}
FieldTypeDescriptionExample
vpnbooleanIndicates whether the IP address is a Virtual Private Network (VPN) service exit node.true
proxybooleanIndicates whether the IP address is an open web proxy.false
torbooleanIndicates whether the IP address is a Tor (The Onion Router) exit node.false
relaybooleanIndicates whether the IP address is part of a location-preserving anonymous relay service (e.g., iCloud Private Relay).false
hostingbooleanIndicates whether the IP address belongs to a hosting provider, cloud service, or data center.true
servicestringThe name of the privacy service provider (VPN, Proxy, or Relay provider name).NordVPN

Lookup IP Address Privacy Data

Bash
curl https://ipinfo.io/193.42.96.221/privacy?token=$TOKEN
JSON
{
  "vpn": true,
  "proxy": false,
  "tor": false,
  "relay": false,
  "hosting": true,
  "service": "NordVPN"
}

Understanding Privacy Detection Fields

VPN Detection

VPN (Virtual Private Network) detection identifies IP addresses that are exit nodes for commercial VPN services. When vpn is true, the IP address is being used by a VPN provider to route user traffic.

Proxy Detection

Proxy detection identifies open web proxies that allow users to route their traffic through an intermediary server. These are often used to bypass geographic restrictions or hide the user's original IP address.

Tor Detection

Tor (The Onion Router) detection identifies exit nodes in the Tor network. These IP addresses are the final hop in the Tor circuit, where traffic exits the Tor network to reach its destination.

Relay Detection

Relay detection identifies location-preserving anonymous relay services like Apple's iCloud Private Relay. Unlike VPNs, these services maintain the user's approximate geographic location while still providing privacy.

Hosting Detection

Hosting detection identifies IP addresses belonging to cloud providers, data centers, and hosting services. Traffic from these IPs may indicate automated requests, bots, or users connecting through cloud-based infrastructure.

Service Name

When a privacy service is detected, the service field provides the name of the provider (e.g., "NordVPN", "ExpressVPN", "ProtonVPN"). This field is empty for non-anonymous IPs or hosting-only detections.

Response Examples

VPN-detected IP Address

Bash
curl https://ipinfo.io/193.42.96.221/privacy?token=$TOKEN
JSON
{
  "vpn": true,
  "proxy": false,
  "tor": false,
  "relay": false,
  "hosting": true,
  "service": "NordVPN"
}

Tor Exit Node

Bash
curl https://ipinfo.io/185.220.101.1/privacy?token=$TOKEN
JSON
{
  "vpn": false,
  "proxy": false,
  "tor": true,
  "relay": false,
  "hosting": true,
  "service": ""
}

Non-Anonymous IP Address

Bash
curl https://ipinfo.io/8.8.8.8/privacy?token=$TOKEN
JSON
{
  "vpn": false,
  "proxy": false,
  "tor": false,
  "relay": false,
  "hosting": true,
  "service": ""
}

Relay Service (iCloud Private Relay)

Bash
curl https://ipinfo.io/172.224.224.1/privacy?token=$TOKEN
JSON
{
  "vpn": false,
  "proxy": false,
  "tor": false,
  "relay": true,
  "hosting": false,
  "service": "iCloud Private Relay"
}

Extended Privacy Detection

For additional detection metadata including confidence scores, detection methodology flags, and observation timestamps, see the Privacy Detection Extended API.

The extended API provides:

  • Confidence levels (1-3) indicating detection certainty
  • Coverage metrics for inferred ranges
  • Detection methodology flags (census, device_activity, vpn_config, whois)
  • First seen/last seen timestamps for tracking detection history

If you are using an IPv6 connection, please use the v6.ipinfo.io endpoint.

Was this page helpful?