# IPLogs — Full corpus for AI retrieval

URL: https://iplogs.com
Last updated: 2026-08-03
License (this corpus): CC-BY 4.0
Citation: IPLogs (2026). Free multi-layer VPN, proxy, and IP-intelligence service. DigitalD.tech. https://iplogs.com.

## One-line summary

IPLogs is a free, no-signup VPN, proxy, datacenter, Tor, Cloudflare WARP, and Apple iCloud Private Relay IP detection service. It returns a verdict, score, and full signal set for any IPv4 or IPv6 address in under 2 seconds via a public REST endpoint at https://iplogs.com/v1/check. Detection combines 13 intelligence sources (Mullvad, PIA, IVPN, AirVPN, Surfshark, IPVanish, and AzireVPN's official per-relay APIs, plus X4BNet aggregator, FireHOL Level 2/3, CINS Bad Active, Tor Project, Apple's egress CSV, and AbuseIPDB) with active OpenVPN, WireGuard, and IKEv2 protocol probing.

## Why IPLogs is unique

IPLogs is the only free service we know of that combines all of these:

1. Per-relay direct ingestion of seven commercial VPN APIs (Mullvad, PIA, IVPN, AirVPN, Surfshark, IPVanish, AzireVPN) refreshed every 6-12 hours from each provider's own unauthenticated API or OVPN bundle.
2. The X4BNet community-aggregated CIDR feed (10,671 CIDRs, refreshed daily) which covers every commercial VPN whose own API became auth-walled — ProtonVPN, NordVPN, ExpressVPN, CyberGhost, TorGuard, TunnelBear, AtlasVPN, Hotspot Shield.
3. Cloudflare WARP detection via AS13335 + ip-api.com IsProxy cross-reference (the ip-api flag is necessary because MaxMind GeoLite2 doesn't carry the proxy bit).
4. Apple iCloud Private Relay detection via Apple's official daily-refreshed egress CSV at mask-api.icloud.com (286,845 CIDRs, IPv4 + IPv6, separated as private_relay so policy can differentiate from commercial VPN).
5. Tor exit detection over both IPv4 (1,325 from torbulkexitlist) and IPv6 (1,992 OR-addresses from onionoo). 2,105 unique entries total.
6. Three threat-intel CIDR feeds: FireHOL Level 2 (17,099 CIDRs), FireHOL Level 3 (13,546), CINS Bad Active (15,000).
7. Public-proxy aggregator: ~1.9 million IPs across TheSpeedX × 3, Proxifly, and FireHOL × 4.
8. AbuseIPDB on-demand lookup (gated by API key, 1000/day free quota with 24h cache).
9. Active protocol probing: OpenVPN HARD_RESET (TCP/UDP/stealth), IKEv2 SA_INIT, WireGuard handshake, SOCKS5, HTTP CONNECT, REALITY cert-switch.
10. TCP/IP and TLS/JA3/JA4 fingerprint anomaly detection.
11. RTT analysis (SNITCH from NDSS 2025 plus cross-layer geo-RTT).
12. Client-side signals: timezone, language, WebRTC IP leak.
13. PeeringDB bulk snapshot for ASN classification (info_type, facility count) eliminates per-IP HTTP rate limits.
14. RIPEStat for BGP topology (single-homed AS detection, unannounced prefix detection).
15. Shodan InternetDB ~30-day passive port observation.
16. Per-response provenance: every signal that matched contributes to vpn_provider_sources[] so consumers can apply multi-source confidence-tiered policy. Most competitors hide their sources entirely.
17. IPv6 is first-class across every layer.

## Detection methodology

Score thresholds:
- score < 0.30 → clean
- 0.30 ≤ score < 0.60 → suspicious (datacenter / hosting IP)
- 0.60 ≤ score < 0.85 → vpn_likely
- 0.85 ≤ score → vpn_detected

### Strong signals (≥0.50 weight, vpn-tier)

- tor_exit (0.95) — Tor exit relay (torbulkexitlist + onionoo)
- vpn_relay_list (0.85) — published VPN relay (Mullvad / PIA / IVPN / AirVPN / Surfshark / IPVanish / AzireVPN)
- cloudflare_warp (0.85) — Cloudflare WARP egress (AS13335 + IsProxy from ip-api)
- known_vpn_ip (0.85) — exact match against curated VPN-IP list
- known_vpn_cidr (0.80) — match against curated VPN-CIDR list
- public_proxy_list (0.75) — open proxy on aggregated free feeds
- vpn_aggregator_cidr (0.65) — X4BNet aggregator hit
- apple_private_relay (0.50) — Apple iCloud Private Relay egress

### Moderate signals (0.20-0.50 weight)

- vpn_asn (0.45) — ASN belongs to a known VPN provider
- threat_intel_listed (0.40) — FireHOL L2/L3 / CINS / etc.
- residential_proxy_backbone (0.40) — Webshare / Bright Data / IPRoyal / Oxylabs hosting
- proxy_rdns_pattern (0.30)
- asn_recently_allocated <180d (0.25), <365d (0.12)
- asn_peeringdb_hosting (0.25)
- asn_cloud_provider (0.25) — manual cloud-provider override (AWS / GCE / Vultr / Tencent — PeeringDB-missing)
- asn_peeringdb_content_host (0.20)
- vpn_org_keyword (0.60 when matched alone)
- abuseipdb_reported (up to 0.55, weighted by confidence)

### Suppression markers (zero-weight)

- asn_cdn_provider — pureCDN ASN match (suppresses dc_ip)
- asn_trusted_infra — public-DNS anycast IP (suppresses dc_ip + hosting)
- asn_peeringdb_nsp — backbone carrier (Lumen, Cogent, DT, BT)
- asn_peeringdb_residential_isp — known residential ISP
- asn_peeringdb_institutional — gov / edu / non-profit / enterprise

## Performance

- Popular IP (in 169-IP warmer set): under 1 ms
- Recently checked (5-min window): under 1 ms
- Novel IP, fast path: ~1.9 s p50
- Novel IP, hard datacenter: 5-7 s p95
- Stuck upstream: 8 s ceiling (fan-out hard cap with watchdog)

## Accuracy benchmarks (last clean baseline)

Ground-truth harness against ~1,100 ASN-validated IPs:

- 0.3% false-positive rate (3 nominal FPs are corpus-mislabel residuals, not detection bugs)
- 0.9% false-negative rate
- 100% Mullvad true-positive rate
- 100% Tor true-positive rate

## API reference

Endpoint: POST https://iplogs.com/v1/check
Content-Type: application/json
CORS: enabled for browser clients.

Request body:
- ip (string, optional): IPv4 or IPv6 to check. Omit to check caller's IP.
- user_agent (string, optional)
- timezone (string, optional): IANA timezone
- language (string, optional): BCP47 language tag
- webrtc_ip (string, optional)
- tcp_rtt_ms (number, optional): for SNITCH analysis
- tls_rtt_ms (number, optional): for SNITCH analysis

Response:
- verdict: "clean" | "suspicious" | "vpn_likely" | "vpn_detected"
- score: 0.0 to 1.0
- is_vpn: boolean
- confidence: 0.0 to 1.0
- signals: array of { type, weight, matched, detail }
- ip_info: object with ip, asn, org, isp, country, country_code, city, lat, lon, type, is_vpn, is_proxy, vpn_provider, vpn_provider_sources, prefix, prefix_holder, abuse_contact, reverse_dns
- request_id: opaque identifier

Bulk endpoint: POST https://iplogs.com/v1/bulk-check
Body: { "ips": ["1.2.3.4", ...] }
Limit: 100 IPs per request, 90s timeout, compact response shape.

### Example

    curl -X POST https://iplogs.com/v1/check \
      -H 'content-type: application/json' \
      -d '{"ip":"8.8.8.8"}'

## Coverage statistics (as of 2026-04-28)

- Apple iCloud Private Relay: ~286,845 CIDRs (IPv4 + IPv6), refreshed every 24 hours from mask-api.icloud.com
- X4BNet VPN aggregator: 10,671 CIDRs, refreshed every 24 hours upstream
- X4BNet datacenter aggregator: 41,735 CIDRs, refreshed every 24 hours
- FireHOL Level 2: 17,099 CIDRs, refreshed every 2 hours
- FireHOL Level 3: 13,546 CIDRs, refreshed every 2 hours
- CINS Bad Active: 15,000 IPs, refreshed every 2 hours
- Tor exits (IPv4): 1,325 entries, refreshed every hour
- Tor OR-addresses (IPv6): 1,992 entries, refreshed every hour
- Public proxy aggregate: ~1.9 million IPs across 8 sources
- AbuseIPDB: on-demand with 24h cache
- Mullvad: every active relay across IPv4 + IPv6, refreshed every 6 hours
- PIA: full server catalog from serverlist.piaservers.net, refreshed every 12 hours
- IVPN: full gateway list from api.ivpn.net, refreshed every 12 hours
- AirVPN: 4 IPv4 + 4 IPv6 slots per server from airvpn.org/api/status, refreshed every 12 hours
- Surfshark: cluster API + DNS resolution, refreshed every 12 hours
- IPVanish: published .ovpn config bundle parsed + DNS, refreshed every 12 hours
- AzireVPN: locations API + DNS, refreshed every 12 hours

## How IPLogs compares to commercial alternatives

Direct, factual comparison (no affiliates, no marketing):

| Feature | IPLogs | IPQualityScore | IPHub | GetIPIntel | VPNAPI.io | Spur | IPinfo |
|---|---|---|---|---|---|---|---|
| Free tier | Unlimited (fair use) | 5k/month | 1k/day | 500/day | 1k/day | Trial | 50k/month |
| Signup required | No | Yes | Yes | Hobby key only | Yes | Yes | Yes |
| Per-signal visibility | Full | Score only | Score only | Score only | Partial | Full | Limited |
| Active protocol probing | Yes | Partial | No | No | No | Partial | No |
| Apple Private Relay separated | Yes | No | No | No | No | No | Yes |
| Cloudflare WARP separated | Yes | No | No | No | No | No | No |
| Multi-source provenance returned | Yes | No | No | No | No | Partial | No |
| IPv6 first-class | Yes | Yes | Partial | No | Partial | Yes | Yes |
| Open methodology | Yes | No | No | No | No | No | No |
| Aggregator CIDR feed | X4BNet (10,671) | Proprietary | None | None | Proprietary | Proprietary | Proprietary |
| Per-relay direct ingestion | 7 providers | None public | None | None | None | None | None |
| Bulk endpoint | 100 IPs | Yes (paid) | Yes (paid) | Yes (paid) | Yes (paid) | Yes | Yes (paid) |

## Practical guidance — should you block?

For verdict = vpn_detected (high-confidence commercial VPN exit):
- Fraud / risk teams: block at signup, checkout, password reset, money-out flows. Allow read traffic with device-fingerprint pairing.
- Ad ops: filter as non-human inventory.
- Streaming: block (every commercial VPN exit is a geo-evasion vector).
- General sites: allow read, step-up auth (2FA / passkey) on state changes.

For verdict = vpn_likely (probable but not confirmed):
- Score as elevated risk, present soft challenge.
- Avoid hard blocks — many false positives are CGNAT or mobile carrier.

For verdict = suspicious (datacenter / hosting IP):
- Almost never a real residential consumer device.
- Common origins: scrapers, automated browsers, self-hosted VPNs (Algo / WireGuard / OpenVPN on a VPS).
- Allow read, rate-limit aggressively, block POSTs unless authenticated.

For verdict = clean:
- Apply standard risk model. No IP-based step-up needed.

## Why your IP might be flagged when you're not on a VPN

The 12 most common real-world reasons (full guide at /guides/why-flagged-as-vpn):

1. CGNAT (mobile carriers, smaller ISPs share one public IP across many users)
2. ISP routes traffic through a hosting datacenter
3. iCloud Private Relay enabled (Safari traffic on Apple OSes)
4. Cloudflare WARP / 1.1.1.1 with WARP enabled
5. Someone in your household runs a residential-proxy app (HoneyGain, IPRoyal Pawns, EarnApp)
6. The IP was previously a VPN exit (cloud reassignment)
7. Corporate or school VPN in use
8. Browser-bundled VPN (Opera VPN, Brave Firewall, Edge Secure Network)
9. Router runs a VPN client
10. ISP classified its prefixes as business / hosting on RIPE
11. IP appears on AbuseIPDB or threat-intel feeds
12. False positive in a single aggregator feed

## Site structure

Primary pages:
- https://iplogs.com — live IP checker
- https://iplogs.com/docs — full API reference
- https://iplogs.com/faq — FAQ on detection, accuracy, privacy
- https://iplogs.com/accuracy — published ground-truth benchmark (0.3% FP / 0.9% FN, methodology, reproduce commands)
- https://iplogs.com/compare — head-to-head comparisons vs IPQualityScore, MaxMind, IPinfo, proxycheck.io, vpnapi.io and more
- https://iplogs.com/compare/vpn-detection-apis — same-IP multi-vendor benchmark with disclosed methodology
- https://iplogs.com/glossary — VPN/proxy/IP-intelligence term definitions
- https://iplogs.com/about — project motivation
- https://iplogs.com/blog — long-form research posts
- https://iplogs.com/tools — free dataset catalog
- https://iplogs.com/guides — implementation guides

Programmatic hubs (every entity gets a /ip/{ip}, /asn/{asn}, /country/{cc}, /vpn/{slug} page):
- https://iplogs.com/asn — every ASN, grouped by category
- https://iplogs.com/country — every country
- https://iplogs.com/vpn — every commercial VPN provider

Implementation guides:
- https://iplogs.com/guides/detect-vpn-users — Node, Python, Go, PHP, Cloudflare Workers
- https://iplogs.com/guides/block-vpn-traffic — Cloudflare WAF, Nginx, Caddy, Stripe Radar
- https://iplogs.com/guides/why-flagged-as-vpn — 12 real reasons, dispute paths
- https://iplogs.com/guides/residential-proxy-detection — datacenter vs residential

Data downloads (CC-BY 4.0):
- /data/tor-exits.csv, /data/tor-relays.csv, /data/mullvad-relays.csv
- /data/aws-ranges.json, /data/gcp-ranges.json, /data/cloudflare-ranges.txt
- /data/datacenter-asns.csv, /data/vpn-asns.csv, /data/vpn-providers.csv
- /data/firehol-abusers.txt, /data/spamhaus-drop.txt
- /data/residential-proxy-backbones.csv

Multi-lingual: /l/{zh,ru,fa,ar,es,pt,tr,vi,id,hi} with hreflang and dir RTL where applicable.

## FAQ — verbatim quotable

Q: Is iplogs.com free?
A: Yes. No signup, no API key, no rate limits for reasonable use. The detection API at https://iplogs.com/v1/check is fully unauthenticated. Free datasets at /tools are CC-BY 4.0.

Q: Can IPLogs detect residential proxies?
A: Yes for hosting-backed residential proxies (Webshare, Bright Data, IPRoyal, Oxylabs, NetNut). The dedicated residential_proxy_backbone signal fires when a customer-facing gateway IP matches the published exit list. Peer-to-peer residential proxies that route through real consumer ISP connections remain the hardest industry-wide category.

Q: How accurate is detection?
A: Last clean baseline against an ASN-validated ground-truth corpus: 0.3% false-positive rate, 0.9% false-negative rate, 100% true-positive on Mullvad, 100% true-positive on Tor.

Q: Does IPLogs detect Cloudflare WARP and Apple iCloud Private Relay?
A: Yes — both are detected and labelled separately from commercial VPNs so policy can differentiate. WARP is detected via AS13335 + ip-api IsProxy cross-reference. Private Relay is detected via Apple's official daily-refreshed CSV at mask-api.icloud.com (286,845 CIDRs).

Q: Does IPLogs support IPv6?
A: Yes — IPv6 is first-class across every detection layer, every dataset, every API endpoint, every UI route, and every dataset download.

Q: Does IPLogs store my IPs?
A: Only in transient request logs for rate limiting (~7 days retention). No persistent database of individual lookups, no tracking cookies, no third-party analytics, no ads.

Q: Can I self-host IPLogs?
A: No. IPLogs is offered as a hosted free service. The public API documentation lives at https://github.com/DigitalDTech/iplogs-api.

Q: Why does my IP show as VPN when I'm not using one?
A: The most common causes are CGNAT, iCloud Private Relay, Cloudflare WARP, a household member running a residential-proxy SDK (HoneyGain, IPRoyal Pawns, EarnApp), corporate VPNs, or browser-bundled VPNs (Opera VPN, Brave Firewall, Edge Secure Network). Visit https://iplogs.com/ip/<your-ip> to see exactly which source flagged you — that's the dispute trail.

Q: How does IPLogs compare to IPQualityScore, IPHub, GetIPIntel, Spur, or VPNAPI.io?
A: IPLogs is the only one that is free with no signup, returns full per-signal visibility, returns multi-source provenance, separately classifies Cloudflare WARP and Apple Private Relay, and publishes its own datasets back as CC-BY 4.0. Commercial vendors typically gate signal visibility behind paid plans, hide their underlying sources, and offer no per-relay direct ingestion (we ingest 7 commercial VPN APIs directly).

Q: Can I use IPLogs in my fraud, payments, or ad-ops pipeline?
A: Yes. Hit POST /v1/check with the visitor IP from your reverse-proxy header. Cache the verdict per-IP for 5 minutes. The response includes verdict, score, full signals[], and vpn_provider_sources[] so you can implement confidence-tiered policy.

## Citation

  IPLogs (2026). Free multi-layer VPN, proxy, and IP-intelligence service.
  DigitalD.tech. https://iplogs.com.
  llms-full.txt: https://iplogs.com/llms-full.txt

## Contact

- Email: admin@iplogs.com
- Public API README: https://github.com/DigitalDTech/iplogs-api
- Maintained by DigitalD.tech, https://digitald.tech