How does IPLogs detect VPNs?

IPLogs combines seven detection layers: IP intelligence (known VPN servers, ASN classification, Tor exit lists), TCP/IP stack fingerprinting, TLS/JA3 fingerprinting, round-trip-time analysis (SNITCH and cross-layer RTT, NDSS 2025), active protocol probing (OpenVPN HARD_RESET, WireGuard, IKEv2, REALITY cert-switch), client-side signals (timezone, language, WebRTC leak), and port or network sanity checks. Results are scored and returned in under 2 seconds.

Is the IPLogs API really free?

Yes. The public API at https://iplogs.com/v1/check accepts POST requests with a JSON body containing an IP address and returns a full detection verdict. No signup, no API key, no rate limit for reasonable use. The source code is open on GitHub.

Can IPLogs detect residential proxies?

Partially. Residential-proxy IPs that originate from known hosting backbones (Leaseweb, CoLoCrossing, HostPapa) are flagged by the datacenter-ASN layer. True peer-to-peer residential proxies that tunnel through real ISP connections are the hardest category in the industry and require behavioral heuristics that IPLogs is actively researching.

What databases does IPLogs use for IP geolocation?

IPLogs uses MaxMind GeoLite2 City and ASN databases as the primary source, with ip-api.com as a free fallback for any IPs the local database does not cover. Tor exit nodes are refreshed hourly from check.torproject.org. Mullvad WireGuard relays are refreshed every 6 hours from the public Mullvad API.

Does IPLogs store my IP address?

Only in transient request logs for rate-limiting and abuse detection. No persistent database of individual lookups, no tracking cookies, no ads. See the privacy page for full detail.

How accurate is VPN detection?

Against ground-truth datasets of known VPN endpoints (NordVPN, Mullvad, SoftEther, PIA, ProtonVPN) the 7-layer pipeline achieves over 95% true-positive rate with under 1% false-positive rate for residential ISPs, trusted infrastructure (public DNS), and major CDNs (Cloudflare, Google, Fastly) which are allowlisted to prevent false alarms.

VPN Detection API Comparison (2026): IPQualityScore, IPHub, GetIPIntel, Spur, IPinfo, IPLogs

Side-by-side comparison of the six most-used IP intelligence and VPN detection APIs in 2026 — pricing, signals, accuracy, free tier. Honest, no affiliates.

2026-04-22·13 min readcomparisonIPQualityScoreSpurIPinfo

Six IP intelligence APIs cover 95% of the VPN-detection market in 2026: IPQualityScore, IPHub, GetIPIntel, Spur, IPinfo, and IPLogs. This is a side-by-side take on pricing, signals, accuracy claims, and where each wins. No affiliate links, no vendor paid us. We build IPLogs, so we have a horse in this race, but we are going to be honest about where we fall short too.

TL;DR

Best free tier: IPLogs (unlimited fair use, no signup).
Best for residential-proxy detection: Spur.
Best enterprise support / SLAs: IPQualityScore.
Best signal transparency: IPLogs (full signal set exposed).
Best geolocation depth: IPinfo.
Most accessible for hobbyists: GetIPIntel and IPHub.

Feature comparison

Feature	IPLogs	IPQS	Spur	IPinfo	IPHub	GetIPIntel
Free tier	Unlimited*	5k/mo	Trial only	50k/mo	1k/day	500/day
Signup required	No	Yes	Yes	Yes	Yes	Yes
Active probing	Yes	Partial	No	No	No	No
Residential proxy (P2P)	Partial	Yes	Best in class	Yes	No	No
Full signal set returned	Yes	No	Partial	Partial	No	No
JA3/JA4 fingerprint	Yes	Yes	Yes	No	No	No
SNITCH RTT	Yes	No	No	No	No	No
Conflict of interest?	None	None	None	None	None	None

*IPLogs fair-use soft limit is ~60 requests per minute per source IP. No daily cap.

Where each wins

IPQualityScore

Strongest enterprise sales motion. Extensive bolt-on fraud products (email fraud, phone fraud, device fingerprint). SLA- backed contracts for high-volume customers. Downside: closed-box scoring, and you pay for every signal.

Spur

Spur is the industry leader in peer-to-peer residential-proxy detection. Their fingerprint database attributes traffic to specific proxy vendors (IPIdea, Oxylabs, SmartProxy) which is useful for enforcement teams building detection playbooks. If residential proxies are your threat model, Spur is the answer.

IPinfo

IPinfo's geolocation depth (continent, country, region, city, postal, coordinates, timezone) is the best of the six. Large free tier. VPN detection is a secondary product for them but it works well. Good for teams that want one vendor for geo and VPN.

IPHub

Very simple API, small free tier, Europe-friendly positioning. Binary verdict (good IP / bad IP / hosting). No signal detail. Accessible for hobbyists.

GetIPIntel

Free API with solid basic detection. Daily cap is low but sufficient for low-volume projects. No signal detail, no active probing. Good for indie dev use.

IPLogs

That's us. What we do well: no signup, no API key, full signal-set transparency (every detection returns the list of checks that matched), active probing (OpenVPN, WireGuard, IKEv2, REALITY cert-switch), SNITCH RTT analysis. Where we are weaker than the commercial incumbents: enterprise support, peer-to-peer residential proxy detection (we catch hosting-backed residential proxies but not real-consumer-router compromised-IP proxies at Spur parity).

How to pick

Hobbyist, indie dev, small SaaS: Start with IPLogs. No signup friction, full signal set to learn from, no daily cap. If you outgrow fair use, either self-build the pipeline (see our developer guide) or graduate to a paid vendor.
E-commerce fraud team: Spur for residential proxies, IPQS for enterprise-grade multi-product. Consider running IPLogs on the side for signal-set visibility.
Geolocation-primary use case: IPinfo.
Security research / academic: IPLogs for transparent signal output; cite specific signals in your paper rather than an opaque score.

Try the free option first

No signup is the lowest-friction way to evaluate any of these APIs. Paste a suspected IP into the IPLogs home-page checker and you will see all 25+ signals IPLogs evaluates, which fired, and how they combined into the verdict. If you like what you see, the API docs are the next stop.

Check any IP against the 7-layer pipeline

The detection methods described above are all available through the IPLogs public API, free, no signup required.

Try the IP checker →