Who owns 217.138.192.1?

217.138.192.1 is announced by AS9009 (M247 Europe SRL), located in Hungary. The holder of the announced BGP prefix 217.138.192.0/24 is M247 M247 Europe SRL. You can look up other IPs on the same network via the IPLogs ASN directory.

Should I block 217.138.192.1?

Apply elevated risk scoring rather than a hard block. Many false positives in this bucket are CGNAT-shared mobile users — a hard block would punish legitimate residential users.

Is 217.138.192.1 safe?

Cautious. This IP isn't on any threat-intel feed today, but it isn't a regular consumer connection either. Don't grant it residential-tier trust.

Why is my IP flagged as vpn likely?

If you visited iplogs.com from your own connection and were flagged vpn likely, the cause is one of: a VPN client on your device or network, a corporate proxy, a CGNAT pool that overlaps with VPN exits, an ISP-level DNS resolver routing through Cloudflare/Apple infrastructure, or your IP being on a published commercial-VPN relay list. The "Why this IP is flagged" section above lists every source that matched — that's the dispute trail.

How do I check 217.138.192.1 via API?

Hit our public API: `POST https://iplogs.com/v1/check` with body `{"ip":"217.138.192.1"}`. You get back a JSON verdict, score 0–1, every matched signal, ASN/geo info, and the full provenance list. Free, no signup, no API key. See /docs for client examples in curl, Python, Node.js and Go.

Is 217.138.192.1 a VPN? Probably — X4BNet VPN aggregator.

Q: Is 217.138.192.1 a VPN?

Probably. 217.138.192.1 matches several VPN/proxy signals consistent with X4BNet VPN aggregator, but no single source has fully confirmed it. Treat as elevated risk.

IPv4 lookup

217.138.192.1

HungaryBudapestAS9009M247 Europe SRL

VPN likely

Multiple signals point to VPN/proxy — 3 signals matched across 3 intelligence sources. moderate confidence in this reading.

Threat Score

Network identity

ASN

AS9009

Organization

M247 Europe SRL

Network type

datacenter

Location

Hungary

Budapest

Coordinates

47.498, 19.040

Country code

BGP / prefix

Announced prefix

217.138.192.0/24

Holder

M247 M247 Europe SRL

This IP in /24256 addrs

Report abuse

Abuse contact

abuse@m247.com

Send abuse report

Detection signals · 7-layer pipeline

0.65

Weighted score · vpn-likely line 0.50

Summary

3 of 7 layers contributed evidence

3 signals matched · 1 strong source · verdict score 0.65

IP intelligence+0.65

Shodan observation+0.00

ASN classification+0.00

§ 01

+0.65strong

IP intelligence

Matches against the Tor exit list, public proxy feeds, curated VPN-provider ranges, and datacenter ASN registries.

VPN aggregator feed matchstrong+0.65

Listed in X4BNet VPN aggregator aggregated VPN/proxy CIDR feed

+0.65

strong

§ 02

+0.00info

Shodan observation

Passive ~30-day port fingerprint. VPN/proxy software CPE matches and observed ports.

Observed open portsinfo

Shodan has observed 1 open port(s) on this IP

+0.00

info

§ 03

+0.00info

ASN classification

Team Cymru allocation data + PeeringDB self-declared network type.

PeeringDB: backbone / transitinfo

PeeringDB classifies ASN AS9009 as "NSP" — backbone / transit carrier

+0.00

info

Σ Total weighted score

0.65 / 1.00

Why this IP is flagged — sources that matched

Every list, feed, or live probe that confirmed the verdict above. Cross-source agreement is what makes this verdict trustworthy — most competitors hide their sources entirely.

X4BNet VPN aggregatorrefresh: every 24h
Community-maintained CIDR feed covering ProtonVPN, NordVPN, ExpressVPN, CyberGhost, TorGuard, TunnelBear, AtlasVPN, Hotspot Shield, and others whose own APIs became auth-walled.

Should I block this IP?

Practical guidance by use case — fraud, ad-ops, streaming, and general websites.

Probable VPN/proxy — present a soft challenge

Several signals point to commercial VPN or proxy use, but no single source has fully confirmed it. False-positive risk is low but non-zero.

About IP address 217.138.192.1

217.138.192.1 is an IPv4 address routed via AS9009 (M247 Europe SRL) and geo-located to Hungary. The verdict above combines six free, no-auth intelligence sources: local db-ip ASN data, the Tor Project exit list, public proxy feeds (TheSpeedX / Proxifly / FireHOL), Team Cymru + PeeringDB for ASN classification, RIPE NCC for BGP topology and abuse contacts, and Shodan InternetDB for ~30-day port observation.

Verdicts are recomputed on every page load and cached for up to one hour upstream. No data about your browser or identity is persisted.