Is 176.103.130.131 a VPN? Probably.
Multiple signals point to VPN/proxy — 1 signal matched across 1 intelligence source. very low confidence in this reading.
Protocol handshake
Live OpenVPN, IKEv2, WireGuard, SOCKS5, and HTTP-CONNECT probes. Ground truth on positive.
OpenVPN P_CONTROL_HARD_RESET_SERVER_V2 reply on UDP/53
Should I block this IP?
Practical guidance by use case — fraud, ad-ops, streaming, and general websites.
Several signals point to commercial VPN or proxy use, but no single source has fully confirmed it. False-positive risk is low but non-zero.
- Fraud / risk teams
- Add to your "elevated risk" bucket. Step-up auth on sensitive flows, but don't hard-block read traffic.
- Ad ops / programmatic
- Fold into your bot-likely bucket and discount bid value. Keep monitoring — when this hits vpn_detected, escalate to block.
- Streaming / geo-licensing
- Challenge with a soft block (geo-restriction notice with a path to retry). Many false positives here are CGNAT or carrier-grade NAT — don't punish residential users.
- General sites & forums
About IP address 176.103.130.131
176.103.130.131 is an IPv4 address routed via AS212772 (AdGuard Software Limited) and geo-located to Cyprus. The verdict above combines six free, no-auth intelligence sources: local db-ip ASN data, the Tor Project exit list, public proxy feeds (TheSpeedX / Proxifly / FireHOL), Team Cymru + PeeringDB for ASN classification, RIPE NCC for BGP topology and abuse contacts, and Shodan InternetDB for ~30-day port observation.
Verdicts are recomputed on every page load and cached for up to one hour upstream. No data about your browser or identity is persisted.