Probably. 95.211.0.1 matches several VPN/proxy signals, but no single source has fully confirmed it. Treat as elevated risk.

95.211.0.1 is announced by AS60781 (LeaseWeb Netherlands B.V.), located in The Netherlands. The holder of the announced BGP prefix 95.211.0.0/16 is LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.. You can look up other IPs on the same network via the IPLogs ASN directory.

Should I block 95.211.0.1?

Apply elevated risk scoring rather than a hard block. Many false positives in this bucket are CGNAT-shared mobile users — a hard block would punish legitimate residential users.

Cautious. This IP isn't on any threat-intel feed today, but it isn't a regular consumer connection either. Don't grant it residential-tier trust.

Why is my IP flagged as vpn likely?

If you visited iplogs.com from your own connection and were flagged vpn likely, the cause is one of: a VPN client on your device or network, a corporate proxy, a CGNAT pool that overlaps with VPN exits, an ISP-level DNS resolver routing through Cloudflare/Apple infrastructure, or your IP being on a published commercial-VPN relay list. The "Why this IP is flagged" section above lists every source that matched — that's the dispute trail.

How do I check 95.211.0.1 via API?

Hit our public API: `POST https://iplogs.com/v1/check` with body `{"ip":"95.211.0.1"}`. You get back a JSON verdict, score 0–1, every matched signal, ASN/geo info, and the full provenance list. Free, no signup, no API key. See /docs for client examples in curl, Python, Node.js and Go.

Is 95.211.0.1 a VPN? Probably.

IPv4 lookup

95.211.0.1

The NetherlandsAmsterdamAS60781LeaseWeb Netherlands B.V.

VPN likely

Multiple signals point to VPN/proxy — 3 signals matched across 2 intelligence sources. moderate confidence in this reading.

Threat Score

Network identity

ASN

AS60781

Organization

LeaseWeb Netherlands B.V.

Network type

datacenter

Location

The Netherlands

Amsterdam

Coordinates

52.367, 4.895

Country code

BGP / prefix

Announced prefix

95.211.0.0/16

Holder

LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.

This IP in /1664.0K addrs

Report abuse

Abuse contact

abuse@nl.leaseweb.com

Send abuse report

Detection signals · 7-layer pipeline

0.70

Weighted score · vpn-likely line 0.50

Summary

2 of 7 layers contributed evidence

3 signals matched · 0 strong sources · verdict score 0.70

IP intelligence+0.50

ASN classification+0.20

§ 01

+0.50moderate

IP intelligence

Matches against the Tor exit list, public proxy feeds, curated VPN-provider ranges, and datacenter ASN registries.

Residential-proxy backbonemoderate+0.40

ASN AS60781 is a hosting backend for commercial residential-proxy networks (Leaseweb Netherlands)

Datacenter IPinfo+0.10

Datacenter / hosting ASN AS60781 (LeaseWeb Netherlands B.V.)

+0.50

moderate

§ 02

+0.20moderate

ASN classification

Team Cymru allocation data + PeeringDB self-declared network type.

PeeringDB: content/cloudmoderate+0.20

PeeringDB classifies ASN AS60781 as "Content" — content/cloud-hosting profile

+0.20

moderate

Σ Total weighted score

0.70 / 1.00

Should I block this IP?

Practical guidance by use case — fraud, ad-ops, streaming, and general websites.

Probable VPN/proxy — present a soft challenge

Several signals point to commercial VPN or proxy use, but no single source has fully confirmed it. False-positive risk is low but non-zero.

Fraud / risk teams: Add to your "elevated risk" bucket. Step-up auth on sensitive flows, but don't hard-block read traffic.
Ad ops / programmatic: Fold into your bot-likely bucket and discount bid value. Keep monitoring — when this hits vpn_detected, escalate to block.
Streaming / geo-licensing: Challenge with a soft block (geo-restriction notice with a path to retry). Many false positives here are CGNAT or carrier-grade NAT — don't punish residential users.

About IP address 95.211.0.1

95.211.0.1 is an IPv4 address routed via AS60781 (LeaseWeb Netherlands B.V.) and geo-located to The Netherlands. The verdict above combines six free, no-auth intelligence sources: local db-ip ASN data, the Tor Project exit list, public proxy feeds (TheSpeedX / Proxifly / FireHOL), Team Cymru + PeeringDB for ASN classification, RIPE NCC for BGP topology and abuse contacts, and Shodan InternetDB for ~30-day port observation.

Verdicts are recomputed on every page load and cached for up to one hour upstream. No data about your browser or identity is persisted.

Is 95.211.0.1 a VPN? Probably.

IP intelligence

ASN classification

Should I block this IP?

About IP address 95.211.0.1

Related lookups

Frequently asked questions about 95.211.0.1