Detect VPNs, Proxies & Tor in Node.js with a Free API

Updated 6 November 2026 · Standard formula, shown below

You can detect VPNs, proxies, and Tor connections in a Node.js app by calling a free IP-intelligence API that returns a risk score or a connection type for each IP address. You send the user’s IP to the API, and it replies with flags like is_vpn, is_proxy, is_tor, or a numeric threat score, which you can then use to block, challenge, or log the request. This article explains the main free options, how the detection works, how to integrate them, and the limitations you should know about.

What â€œdetectingâ€� a VPN or proxy actually means

When a visitor connects through a VPN, proxy, or Tor, the IP address you see in your server logs is not the visitor’s real residential IP. It belongs to a VPN server, a datacenter, or a Tor exit node. Detection services maintain large databases of these known IP ranges and update them constantly. When you query their API with an IP, they check it against their databases and also run heuristicsâ€”like checking if the IP is in a datacenter range, if it has a history of abuse, or if it shows signs of anonymization. The result is a set of flags or a risk score that tells you how likely it is that the IP is being used to hide the user’s true location or identity.

Why you might want to detect VPNs and proxies

There are several legitimate reasons to detect anonymized traffic:

Fraud prevention: E-commerce sites and payment gateways often block or flag orders coming from VPNs because fraudsters use them to hide their location.
Content licensing: Streaming services and news sites enforce geographic restrictions by blocking IPs that appear to be VPNs or proxies.
Security: A sudden spike in traffic from Tor exit nodes or known proxy IPs can indicate a scraping bot or an attack.
Compliance: Some platforms are required to verify user location for legal reasons, and VPNs break that verification.

It’s not about blocking all privacy toolsâ€”many legitimate users use VPNs for good reasons. But in specific contexts, knowing that an IP is a VPN helps you make a risk-based decision.

Free APIs that work with Node.js

Several services offer free tiers for IP intelligence. Here are the most commonly used ones, with their free limits and how to call them from Node.js.

1. ip-api.com

This service offers a free endpoint that returns JSON with fields like proxy, hosting, and tor. The free tier is limited to 45 requests per minute from one IP address, and it’s HTTP-only (no HTTPS on the free plan). For a Node.js app, you can use the built-in fetch:

const res = await fetch('http://ip-api.com/json/8.8.8.8?fields=proxy,hosting,tor,country')
const data = await res.json()
console.log(data) // { proxy: false, hosting: true, tor: false, country: 'US' }

The hosting flag is true for datacenter IPs, which often indicates a VPN or proxyâ€”but not always. The proxy flag covers public proxies and some VPNs, and tor is true for known Tor exit nodes.

2. IPWHOIS.io

IPWHOIS.io offers a free tier of 1,000 requests per month. It returns a type field that can be vpn, proxy, tor, business, or isp, plus a threat_score from 0 to 100. Here’s a Node.js call:

const apiKey = 'your_free_key'
const res = await fetch(`https://ipwhois.io/check-ip?ip=8.8.8.8&key=${apiKey}`)
const data = await res.json()
console.log(data.type, data.threat_score)

3. IPQualityScore

IPQualityScore has a free plan that gives you 500 lookups per month. The response includes proxy, vpn, tor, bot_status, and a fraud_score from 0 to 100. You need an API key, but the free tier is generous for testing:

const apiKey = 'your_free_key'
const res = await fetch(`https://ipqualityscore.com/api/json/ip/${apiKey}/8.8.8.8`)
const data = await res.json()
console.log(data.proxy, data.vpn, data.tor, data.fraud_score)

4. VirusTotal

VirusTotal has an IP report endpoint that includes a detected_urls list and a harmless count, but it doesn’t directly label an IP as VPN or proxy. It’s more useful for checking if an IP is flagged for malware. Not ideal for this specific purpose.

How to choose the right API for your app

When picking a free API, consider these factors:

Accuracy: No service is 100% accurate. Test the API with known VPN IPs and Tor exit nodes to see how well it performs.
Rate limits: Free tiers often limit requests per minute or per month. If your app gets more traffic than the limit, you’ll need to cache results.
HTTPS: Some free tiers (like ip-api.com) only support HTTP, which is a security risk if you’re sending IPs from a production app.
Fields returned: Make sure the API returns the specific flags you need (vpn vs proxy vs tor).
Privacy: Check the service’s privacy policy to see how they handle the IPs you send them. Some services log queries.

Implementing detection in a Node.js middleware

Here’s a practical example using Express and ip-api.com. This middleware checks every incoming request and blocks if the IP is flagged as a proxy or Tor:

const express = require('express')
const app = express()

async function detectAnonymizer(ip) {
  const res = await fetch(`http://ip-api.com/json/${ip}?fields=proxy,tor,hosting`)
  return res.json()
}

app.use(async (req, res, next) => {
  const ip = req.ip || req.connection.remoteAddress
  const info = await detectAnonymizer(ip)
  if (info.proxy || info.tor) {
    return res.status(403).send('Access denied')
  }
  next()
})

app.get('/', (req, res) => res.send('Hello'))

For production, you should cache the results using a simple in-memory cache or Redis, because the same IP will be checked repeatedly. A TTL of 24 hours is reasonable since IP classifications change slowly.

Common problems and limitations

False positives: Some legitimate users behind corporate networks or mobile carriers may be flagged as proxies. This can lock out real customers.
False negatives: New VPN servers that aren’t in the database yet won’t be detected. Also, some VPNs use residential IPs (like Hola or certain P2P VPNs) that look like normal home connections.
IPv6: Not all APIs support IPv6 detection. If your app receives IPv6 addresses, test whether the API handles them.
Rate limiting: Free APIs will throttle you if you exceed the limit. Always handle HTTP 429 responses gracefully.
Privacy laws: Sending IPs to third-party APIs may be considered a data transfer under GDPR. You may need to inform users or get consent.

Alternatives to a free API

If a free API isn’t enough, you have a few options:

Paid APIs: Services like MaxMind, IPinfo, and AbuseIPDB offer more accurate and higher-volume detection for a fee.
Self-hosted databases: You can download IP lists (like Tor exit node lists from the Tor Project) and check them locally. This is free and private, but it only covers Tor, not VPNs or proxies.
Open-source libraries: Some libraries like geoip-lite give you geolocation but not VPN detection. You’d need to combine them with a database of known VPN IPs.

Frequently Asked Questions

Can I detect a VPN without an API?

Yes, you can download lists of known VPN and proxy IP ranges, but they go out of date quickly. You can also check if an IP is in a datacenter range by using WHOIS or ASN data, but that’s not reliable because many VPNs now use residential IPs. For Tor, the Tor Project publishes an official list of exit nodes that you can fetch and check locally.

Is it legal to block VPN users?

Yes, in most countries it’s legal to block or restrict access based on IP address, as long as you’re not discriminating against a protected class. However, if you’re in the EU, blocking all VPN users might inadvertently block legitimate users who rely on VPNs for privacy, which is not illegal but could hurt your business. Always check your local laws.

Why does my VPN show up as a proxy?

Many VPN services use the same IP ranges as public proxies or datacenter servers. Detection services often label any IP that is not a residential ISP as a proxy, even if it’s a VPN. That’s why you see both proxy and vpn flags in some APIs.

How often do these databases update?

Most commercial services update their databases daily or even hourly. Free services may update less frequently. Tor exit nodes change every few minutes, so any service that detects Tor must update very frequently to be accurate.

Can I detect a VPN if the user is using a residential proxy?

Residential proxies are IPs from real home connections that are rented out by services. They are extremely hard to detect because they look like normal residential traffic. Some advanced services use machine learning to identify patterns, but no free API can reliably detect them.

What should I do if the API is down?

Your app should have a fallback strategy. For example, if the API call fails, you can allow the request but log the failure, or you can use a local Tor exit node list as a backup. Never block all traffic just because the detection service is unavailable.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.