How accurate is IPLogs VPN detection?
On its most recent ground-truth benchmark, IPLogs records a 0.3% false-positive rate and a 0.9% false-negative rate across a roughly 1,100-IP labeled corpus validated against Team Cymru. It detected 100% of published Mullvad relays and 100% of Tor exit nodes in that corpus.
Benchmark results
The three nominal false positives in the most recent run traced to mislabeled corpus entries (IPs whose published label was stale), not to detection errors. The figure is reported as-measured rather than corrected, so the real-world false-positive rate is at or below 0.3%.
What the corpus contains
The benchmark corpus is roughly 1,100 IP addresses spanning five categories, chosen so that both the “should flag” and “should stay clean” sides are well represented:
- Published Mullvad relays (500) — WireGuard and OpenVPN exit IPs taken directly from Mullvad's own server list. Ground truth for “is a VPN”.
- Tor exit nodes (100) — running exits from the Tor Project consensus, IPv4 and IPv6.
- Residential ISP addresses — sampled per ISP. Ground truth for “should stay clean”; these are where false positives hurt most.
- Datacenter / hosting IPs — sampled per provider. Flagged as datacenter, not necessarily VPN, so the detector must distinguish the two.
- CDN edge IPs — sampled per provider (Cloudflare, Google, Fastly, Akamai, etc.). Must stay clean despite living in datacenter ASNs.
How the benchmark is run
- 1.Collect labeled IPs from authoritative sources — Mullvad's server API, the Tor Project consensus, and per-ISP / per-provider sampling for the clean and datacenter categories.
- 2.Validate every ASN against Team Cymru's IP-to-ASN service. An IP whose live ASN doesn't match its label is dropped or re-labeled, so the measured error reflects detection quality, not corpus noise.
- 3.Run against production — every corpus IP is checked against the live
/v1/checkAPI, not a lab build, so the numbers reflect what real callers get. - 4.Compare to ground truth — each verdict is scored against the validated label to compute the false-positive, false-negative, and per-category true-positive rates above.
Why the false-positive rate is the number that matters
For most teams, a false positive is far more expensive than a false negative: it blocks a paying customer, fails a real signup, or declines a legitimate payment. A detector that flags everything scores a perfect true-positive rate while making itself useless. The honest measure of a VPN detector is how rarely it flags a clean residential user — which is exactly why IPLogs publishes its 0.3% false-positive rate rather than only a true-positive headline.
Accuracy FAQ
How accurate is IPLogs VPN detection?
On its most recent ground-truth benchmark, IPLogs records a 0.3% false-positive rate and a 0.9% false-negative rate across a roughly 1,100-IP labeled corpus. It detected 100% of published Mullvad relays and 100% of Tor exit nodes in that corpus.
What is a false positive in VPN detection?
A false positive is a clean residential or trusted IP that a detector wrongly flags as a VPN or proxy. False positives are the costly errors — they block real customers. IPLogs measures this directly and reports 0.3% on its ground-truth corpus.
What is a false negative in VPN detection?
A false negative is a real VPN, proxy, or Tor exit that a detector misses and marks as clean. IPLogs records a 0.9% false-negative rate on its benchmark corpus, meaning roughly 99 of every 100 known anonymizing IPs are correctly flagged.
How is the benchmark corpus validated?
Every IP in the corpus has its origin ASN cross-checked against Team Cymru's IP-to-ASN service before it is labeled. This catches mislabeled or re-allocated addresses, so the measured error rate reflects detection quality rather than corpus noise.
Why don't other VPN detection services publish a false-positive rate?
Most commercial IP-intelligence vendors publish a confidence score but no measured error rate against a labeled corpus. Publishing a false-positive rate is falsifiable and invites scrutiny — IPLogs reports it because the figure is the number that decides whether you block real customers.
Reproduce or build on this
The detection methodology is documented openly and the aggregated VPN-provider dataset is published under CC-BY 4.0. See the API docs for the verdict schema, the datasets catalog for the downloadable feeds, and the comparison page for how IPLogs stacks up against other IP-intelligence APIs.