185.159.157.1 — datacenter / hosting IP, not residential.

185.159.157.1 is not a confirmed VPN, but it is a hosting / datacenter IP — almost certainly not a real residential consumer device. Common origins are scrapers, automated browsers, or self-hosted VPNs running on a VPS.

185.159.157.1 is announced by AS209103 (Proton AG), located in Switzerland. The holder of the announced BGP prefix 185.159.157.0/24 is ProtonVPN Proton AG. You can look up other IPs on the same network via the IPLogs ASN directory.

Yes for write traffic, no for read. Datacenter IPs are almost never real human users — block POSTs, throttle reads, but avoid hard 403s if you serve global traffic.

Cautious. This IP isn't on any threat-intel feed today, but it isn't a regular consumer connection either. Don't grant it residential-tier trust.

If you visited iplogs.com from your own connection and were flagged suspicious, the cause is one of: a VPN client on your device or network, a corporate proxy, a CGNAT pool that overlaps with VPN exits, an ISP-level DNS resolver routing through Cloudflare/Apple infrastructure, or your IP being on a published commercial-VPN relay list. The "Why this IP is flagged" section above lists every source that matched — that's the dispute trail.

Hit our public API: `POST https://iplogs.com/v1/check` with body `{"ip":"185.159.157.1"}`. You get back a JSON verdict, score 0–1, every matched signal, ASN/geo info, and the full provenance list. Free, no signup, no API key. See /docs for client examples in curl, Python, Node.js and Go.