Is 23.226.128.1 a VPN? No — M/S UMARA INTERNATIONAL.
23.226.128.1No VPN/proxy indicators — no detection signals matched. Overall risk: very low.
Clean across every detection layer
No IP-intel, ASN, BGP, Shodan, active-probe, fingerprint, or client-telemetry signal triggered. Consistent with legitimate residential or business network activity.
Should I block this IP?
Practical guidance by use case — fraud, ad-ops, streaming, and general websites.
No VPN, proxy, datacenter, or Tor signals matched. The IP looks like a real consumer or business broadband line. Treat as a normal user.
- Fraud / risk teams
- Apply your standard risk model. No IP-based step-up needed.
- Ad ops / programmatic
- Bid normally. This IP is in your billable, real-human pool.
- Streaming / geo-licensing
- Allow. Geo-licensing rules still apply, but VPN evasion is not a concern here.
- General sites & forums
- Standard access. Use other signals (device fingerprint, behavior, account age) for risk scoring.
Want to enforce this in code? See our copy-paste blocking recipes for Cloudflare WAF, Nginx, Caddy, and Stripe Radar.
About IP address 23.226.128.1
23.226.128.1 is an IPv4 address routed via AS154132 (M/S UMARA INTERNATIONAL) and geo-located to United States. The verdict above combines six free, no-auth intelligence sources: local db-ip ASN data, the Tor Project exit list, public proxy feeds (TheSpeedX / Proxifly / FireHOL), Team Cymru + PeeringDB for ASN classification, RIPE NCC for BGP topology and abuse contacts, and Shodan InternetDB for ~30-day port observation.
Verdicts are recomputed on every page load and cached for up to one hour upstream. No data about your browser or identity is persisted.