Changelog

When you check your own connection from a datacenter address and your browser's DNS lookup comes from a home ISP in another country, the self-check now counts it as a VPN or proxy that leaks DNS (new signal dns_leak, weight 0.50). Public resolvers such as Google, Cloudflare and Quad9 never count.

When your own device opened the connection but with a tunnel's packet size (as WireGuard, OpenVPN or IKEv2 set it) and it arrives from a datacenter address, the self-check now reads it as a VPN (new signal hosting_tunnel_mss, weight 0.50). Later lookups of that address remember it.

When you check your own connection from a datacenter address and the TCP connection was opened by a different operating system than your browser's, a proxy server re-opened it. That now reads as a proxy (new signal hosting_stack_mismatch, weight 0.60, sets is_proxy), and later lookups of that address remember it.

The spec covers /v1/check, /v1/bulk-check, /v1/ip and /v1/health, with every response flag, rate-limit header and error status. It is built from the same field tables as the docs, so the two stay in step.

A public DNS leak test page is live, backed by GET /v1/dns-leak, which returns the resolvers that asked for your test tokens with their network, country and hosting status. It reports a leak only when a resolver sits on an ISP network other than your connection's, so public resolvers such as Google or Quad9 are not flagged.

Addresses inside a crawler operator's own published ranges now return a crawler object with name, operator and purpose (search, ai_training, ai_search, user_fetch, archive, seo, monitor, crawler or ai), alongside is_crawler. Nine more crawler and monitor range lists were added; the verdict is unchanged and a forged User-Agent gets nothing.

Addresses on satellite and in-flight Wi-Fi networks return is_satellite: true, in fast mode too. Round-trip and SYN checks are skipped on these links, because satellite TCP accelerators used to make real users look like proxies.

A new active probe recognises servers that speak only IKEv1 Main Mode, which covers L2TP/IPsec and SoftEther. The IKEv2 probe also now accepts notify-style replies, and a leak in the probe code that held sockets open was fixed.

About 65,000 CyberGhost server addresses, 185 AirVPN exit addresses (users leave from an address that differs from the entry list) and 632 servers across six more providers are now detected. The independent CyberGhost sample went from 92% to 100% in fast mode.

A new /ip-reputation page explains the reputation field returned by /v1/check. Only abuse evidence blocklists an address; a non-clean verdict without abuse greylists it, and clean, CDN or public-DNS addresses are allowlisted.

Several CDN and DDoS-protection networks, and hosts that answer every request, were read as VPN or proxy servers. They now read as hosting or clean, and free V2Ray fronts that resolve to shared reverse proxies no longer count as proxy exits. False positives on a 5,000-address top-website sample fell to 0.18%.

The full-depth benchmark was re-run on the 2,831-address corpus: all 1,722 commercial VPN servers detected and 4 of 951 ordinary addresses flagged as VPN. VPN Gate recall in fast mode measured 94 of 97 live servers.

An internal research job exhausted memory on the host and made the site and API unresponsive for about 3 minutes. Services did not restart and no data was lost; such jobs now run under a hard memory limit.

GET /v1/ip returns the caller's own address and family, and is served on ipv4.iplogs.com (IPv4 only) and ipv6.iplogs.com (IPv6 only). The self-check page uses it to show both addresses.

A full check now takes about 3.0 to 3.3 seconds instead of 6.5, with no detection lost. Fast mode is unchanged at microseconds.

Active probing now sends a real OpenVPN handshake on TCP 443, and recognises TLS relays (such as REALITY) that borrow a CDN-fronted site's certificate. Hosting addresses that answered a handshake are also remembered, so fast and bulk lookups benefit.

The brand-certificate probe now also matches private certificate authorities named after a VPN brand, which adds roughly 690 CyberGhost rack hosts and five more brands. Generic names containing "proxy" or a hoster's name no longer count.

iCloud Private Relay addresses now read suspicious and relay, never VPN, whichever network hosts the egress. ip_info.is_vpn also now matches the top-level is_vpn instead of showing true on a relay address.

Edge servers of several CDNs were detected as VPN or proxy servers. Edges are now recognised from the operators' published ranges, and 47 more edges stopped reading is_vpn.

api.iplogs.com now tells browsers to stay off HTTP/3, so every browser self-check can be read for TLS fingerprint, handshake timing and connection details. Before, 16 to 28% arrived over HTTP/3 and could not be assessed.

Pools of static ISP proxy addresses that our weekly checks confirm now return is_proxy with proxy_type isp in every mode, not only full checks. Mobile-carrier addresses are weighted lower, since carrier NAT shares one address among many people.

The Node.js and Python integration guides took the client IP from CF-Connecting-IP or X-Forwarded-For without checking who sent it, so a client could pick its own address. The guides now only trust those headers from your own proxy.

Some Pakistani ISP blocks were shown at the ISP's registered head office in Islamabad. That placeholder city is no longer shown.

A single VPN handshake on a residential line is usually a router's own VPN server, so those addresses now read suspicious instead of is_vpn. This removed the home-broadband false positives from our benchmark.

Addresses of Opera's data-saving page proxies now match a browser_proxy signal and set is_relay. They read suspicious, not VPN.

WARP is now recognised from Cloudflare's own published egress ranges, so it works in fast and bulk mode and for IPv6, where it was previously missed. ProtonVPN IPv6 servers were added at the same time.

Whenever is_proxy is true, proxy_type names the kind: residential, isp, public or datacenter. Tor and Private Relay keep their own flags and get no type.

Cloudflare website ranges no longer read as WARP, and a Google load balancer that answers on every port no longer reads as a VPN. The full benchmark's false-positive rate moved from 0.9% to 0.6%.

/v1/check now splits the verdict by kind, so you can allow iCloud Private Relay or WARP while blocking VPNs. The flags are present in fast mode, and bulk rows include them when true.

signals[].last_seen (UTC) shows when our data last confirmed the address, such as the last refresh of the server list that contains it. It is omitted when unknown.

Addresses inside the published ranges of Google, Bing, OpenAI, Apple, Perplexity, DuckDuckGo, Common Crawl and Anthropic crawlers return is_crawler and a zero-weight known_crawler signal. Verdicts are unchanged, so blocking suspicious addresses can now exempt search engines.

An address that was on a published VPN server list in the last days but is not in the latest copy now returns vpn_relay_recent, instead of reading clean. Weight decays with age.

After an API restart the Tor exit list could stay empty until the next hourly refresh, so some exits read vpn_likely instead of vpn_detected. Fetches now retry, either source alone is enough, and the last good list is kept.

The docs now state that timezone, language, webrtc_ip and user_agent are only used on a browser self-check, and ignored when an ip is supplied. Added tested examples in cURL, Node.js, Python, PHP, Go and Java, and a sample response per status code.

ASN pages and /data/vpn-asns.csv used to say any address on certain hosting ASNs was a confirmed VPN exit. The vpn category now lists only operators that are VPN companies; busy hosting networks are labelled datacenter.

Server lists for 114 providers were connected by this date, up from 57 the day before, by reading each provider's own published lists and verified server names.

For a short time 1.1.1.1, 8.8.8.8, 9.9.9.9 and similar public resolvers were returned as a VPN provider's servers, because a scraped page listed them. The data was removed and no list can ingest a public resolver any more.

A hosting address caught relaying by our own self-checks, and named by no list, now returns learned_vpn_exit at 0.30 to 0.55, which reads suspicious and never vpn_detected. It is forgotten when a later self-check shows a direct connection and deleted 30 days after it was last seen.

The new home, IP lookup, docs, bulk and blog pages replaced the old site, with the same URLs and canonical tags kept. Articles are published on a schedule, not backdated.

A faulty dashboard deploy left the site without a built front end and every page returned 502. It was restored from backup within about 2 minutes, and deploys now restore the previous build automatically if the new one fails.

Limits are per client IP (IPv6 per /64): 60 requests per minute on /v1/check, a lower rate on bulk, and 1,000 full-depth lookups per UTC day. Past the daily quota the API still answers 200, in fast mode, and X-RateLimit-Limit/Remaining/Reset headers are returned on charged responses.