vpnapi.io, IPinfo, IPHub: What a VPN Detection API Should Actually Return

Every VPN detection API will tell you whether an address is a VPN. The differences that matter are in what else they tell you, and in how honest they are about the parts nobody can be certain of.

Details below were checked in August 2026. Pricing and free tiers in this category change often, so verify anything you are about to make a decision on rather than trusting a blog post, including this one.

The boolean problem

Here is the shape of response you get from a lot of tools:

{ "ip": "203.0.113.42", "is_vpn": true }

Your application now has one bit of information and a decision to make. Block or allow. That is the wrong granularity for almost every real use, because "is a VPN" spans a corporate employee on their company's network, a privacy-conscious customer on a commercial VPN, a scraper on a rented datacenter box, and a fraudster on a residential proxy. Those four should not receive the same treatment, and one boolean cannot distinguish them.

What you want is the evidence, separated:

{
  "ip": "203.0.113.42",
  "asn": 14061,
  "organisation": "DigitalOcean, LLC",
  "types": { "datacenter": true, "vpn": false, "proxy": false, "tor": false },
  "proxy_likelihood": "low",
  "risk_score": 55
}

Now the decision is yours. Datacenter traffic on a consumer signup form is highly suspicious. Datacenter traffic on an API endpoint is entirely normal, and if you had only the boolean you would have blocked your own customers' servers.

Field by field

ASN and organisation. The most underrated fields available and the ones I would refuse to go without. They let you write your own rules for cases the vendor cannot anticipate. A gaming company blocking a specific bulletproof hosting provider, a B2B tool allowing a particular corporate VPN because three customers use it. Without the raw ASN you are stuck with somebody else's classification.

Type separation. Datacenter, commercial VPN, public proxy, and Tor exit are four different populations with four different risk profiles. Tor in particular is worth its own field, because for most consumer products Tor at signup is a much stronger signal than a commercial VPN.

Confidence. The field most often missing and the one that reflects reality most accurately. Datacenter classification is close to certain. Residential proxy classification is a probability. An API that returns both as flat booleans is discarding the difference, and the difference is exactly where your false positives come from.

Geolocation with the connection type. Location alone is weak. Location plus whether the ASN is a consumer ISP, a mobile carrier, or a host is what lets you spot a mismatch between where the IP claims to be and what the browser reports, which is one of the more reliable residential-proxy tells. We went into that in residential proxies and the VPN detection blind spot.

Where the others are genuinely better

I run one of these products, so take the following in that spirit. There are real reasons to pick something else.

vpnapi.io has a considerably more generous free tier than we do, around 1,000 requests per day against our 200 per month as of August 2026. If you are prototyping, running a side project, or your volume genuinely fits inside a free tier, that is a straightforward advantage and there is no point pretending otherwise. It is also simple to integrate and fast.

IPinfo has the strongest general-purpose IP data in this group. If what you actually need is accurate geolocation, ASN, carrier, and company data, with VPN detection as a secondary concern, they are a better fit than a fraud-focused tool. Their data quality on the core IP attributes is excellent and their bulk and downloadable database options suit teams who would rather not make a network call per lookup.

IPHub is inexpensive, fast, and does exactly one thing. If your requirement is a datacenter check on a high-volume endpoint and you do not want to think about it further, that focus is a feature rather than a limitation.

Where we differ is that Fidro is not really an IP tool. It is a signup and payment risk tool that includes IP as one input, alongside email characteristics, cross-account linkage, and Stripe-side signals. If IP is the only thing you need, one of the above is probably a better and cheaper fit. If your actual problem is fake signups and you are reaching for an IP API because that is the tool you know about, the IP verdict alone will disappoint you, because it is the cheapest signal for an attacker to change.

Test it properly before you commit

Vendor accuracy claims are close to meaningless, because accuracy depends on which populations use your product. The test that matters uses your traffic.

Run in shadow mode for two weeks. Call the API on every signup, log the verdict, and act on none of it.

$verdict = $client->check($request->ip());

Log::channel('shadow')->info('ip_check', [
    'user_id' => $user->id,
    'score' => $verdict->risk_score,
    'types' => $verdict->types,
    'decision_would_be' => $verdict->risk_score >= 70 ? 'block' : 'allow',
]);
// proceed normally regardless

Then join those logs against outcomes you already have. Accounts that charged back. Accounts you banned manually. Accounts that never converted, and accounts that became paying customers.

Two numbers come out of that, and they are the only two that matter:

Of the accounts you later determined were bad, what fraction would this have flagged? That is your catch rate on your own traffic.

Of the accounts that became good paying customers, what fraction would this have blocked? That is your cost, and it is usually the number that decides between vendors, because a tool that catches 90% of fraud while blocking 4% of real customers is a bad trade for most businesses.

Run the same two weeks against two vendors at once if you can. It is more work and it settles the question with evidence rather than marketing.

What to do with the verdict

Whatever you choose, do not wire it to a hard block on its own.

match (true) {
    $risk >= 80 => $this->block(),
    $risk >= 50 => $this->requireEmailVerification(),
    default     => $this->allow(),
};

Allow, review, block. The middle path is what makes an imperfect signal usable, and every signal in this category is imperfect. Tuning fraud thresholds covers how to set those numbers against your own conversion data rather than guessing.

You can try our version on your own address at the free VPN detector, and the VPN detection API documents the full response. If IP is genuinely all you need, take the free tier that fits your volume and spend the saved effort on the payment layer instead, where the signals are harder to fake.