VPN detection APIs tested against 5 real IPs (2026)

Each test IP was queried against each vendor's free public API (no API key, no signup where possible) on 2026-04-29. Responses were captured raw. The criteria for 'correct' is: matches what the IP actually is. A clean public DNS resolver (8.8.8.8, 1.1.1.1) returning is_vpn=true is a false positive. An Apple Private Relay IP returning generic 'VPN' without separation is partial. A confirmed Mullvad relay returning is_vpn=false is a false negative. The test focuses on FP because that's what costs you customers.

IPQS requires API key signup and CAPTCHA on their public lookup page, so we couldn't capture an unauthenticated empirical response. Anecdotally (Reddit r/networking, r/SaaS, r/Entrepreneur) IPQS is widely reported to over-flag CGNAT and residential ISPs. Their fraud_score blends multiple signals into one number with no source visibility, making FP disputes hard. We'll add direct test data once we get a free key.

Best guess: their abuser feed gets contaminated by traffic patterns to high-volume IPs (every browser worldwide queries 8.8.8.8 / 1.1.1.1 directly or indirectly, so abuse-like signals from any one of those clients can leak into the score). It's a feed-quality issue, not a fundamental architecture problem. But it means anyone using ipapi.is for fraud scoring needs to allowlist trusted-infra IPs manually.

Several reasons. (1) IPLogs is free with no signup — ipinfo.io paid Privacy data starts at $250/month. (2) IPLogs returns the matched-source list (vpn_provider_sources[]) so users can dispute a false positive by name, ipinfo returns flags only. (3) IPLogs runs active OpenVPN/WireGuard/IKEv2 protocol probes which catch self-hosted VPNs (Algo, Streisand, Tailscale exit nodes) that no IP-list-based API will ever see. For most use cases, free + lower FP rate beats paid + slightly broader IP coverage.

WARP IPs rotate constantly within Cloudflare's pool, so a hardcoded test IP is unreliable. Best way to test: connect via the 1.1.1.1 with WARP app on iOS or Android, then visit each vendor's lookup page with the resulting IP. Most vendors (proxycheck.io, ipapi.is, ip-api.com) lump WARP into generic VPN/proxy. IPLogs and IPinfo paid identify WARP separately.

Run the same curl commands against each vendor with the test IPs. The IPs in this test are stable: 8.8.8.8 and 1.1.1.1 are always Google/Cloudflare DNS. 23.234.89.127 has been a Mullvad relay since 2024. 171.25.193.25 has been a DFRI Tor exit for years. 104.28.38.71 was an Apple Private Relay IP at the time of testing — Cloudflare may rotate this within their pool, so verify against Apple's current CSV at mask-api.icloud.com. Re-running the test takes about 5 minutes.

If you're picking a free VPN-detection API and your traffic includes Apple iCloud users (any consumer-facing iOS app), avoid ipapi.is, proxycheck.io's free tier, and ip-api.com for production policy decisions on iCloud+ users. Pair them with Apple's published CSV directly, or use IPLogs / ipinfo.io paid which already separate it. If you're paying for VPN detection, ipinfo.io paid is the highest-quality general-purpose option — but you don't get source visibility for FP disputes. Spur (paid only) and IPLogs (free) are the two with named-source provenance.