iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
You can detect VPNs, proxies and Tor exit nodes in a Node.js application by looking up the visitor’s IP address with an IP-intelligence API. For a straightforward implementation, the ip-api.io JavaScript SDK documents one lookup that returns all three flags. A positive flag identifies a network signal—not a person’s identity or proof of abuse—so use it to inform a risk decision rather than automatically blocking every flagged visitor.
How to check an IP for VPN, proxy and Tor flags in Node.js
The ip-api.io SDK guide documents the ip-api-io package, an IpApiClient, and an asynchronous lookup call. Its stated prerequisites are Node.js 18 or later and a free API key. Keep the key on the server, such as in an environment variable, rather than exposing it in browser code.
import { IpApiClient } from "ip-api-io";
const client = new IpApiClient({ apiKey: process.env.IP_API_IO_KEY });
const info = await client.lookup(ipAddress);
const flags = info.suspicious_factors;
if (flags.is_vpn || flags.is_proxy || flags.is_tor_node) {
// Apply the application's risk policy, such as step-up verification.
}The documented suspicious_factors object includes boolean fields is_vpn, is_proxy, and is_tor_node, alongside other signals such as datacenter, spam, crawler, and threat. Check the ip-api.io JavaScript SDK guide for the current package interface and response details before deploying; provider documentation and API behavior can change.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When to make a separate Tor check
The same SDK documents client.torCheck(ip), which returns is_tor and tor_node_count. A regular lookup already includes a Tor boolean, so a separate call is useful when your application needs the matching-node count or an explicit Tor check. Avoid making an extra request when the ordinary lookup provides all the information your policy needs.
#1 Best Overall
Get the visitor’s IP from a trusted source
Perform the lookup on your server and use the client address established by your trusted ingress infrastructure. If your app sits behind a CDN or reverse proxy, configure the application to trust only the proxy chain you control. Do not accept an arbitrary client-supplied forwarding header as the visitor’s IP: a caller could set it themselves and cause your server to look up a misleading address.
The correct header is deployment-specific. For example, the GetIPIntel project README cites Cloudflare’s CF-Connecting-IP; that example is not a universal header recommendation. Confirm your CDN or proxy’s documented behavior and configure trusted-proxy handling accordingly in your Node.js stack. See the GetIPIntel project documentation for its example.
Rank #2
Free API options and what their limits mean
“Free” does not mean the same thing across providers: some require a key, some describe a keyless allowance, and some impose fair-use throttling. The details below are provider statements on their cited pages, not an independently tested ranking; confirm current terms and limits before relying on them.
| Provider | Documented Node.js entry point | Signals and stated access details |
|---|---|---|
| ip-api.io | JavaScript SDK; guide lists Node.js 18+ | Requires a free API key. One lookup returns VPN, proxy, and Tor booleans; an optional Tor check returns a node count. Provider documentation. |
| IPLogs | Provider says Node.js examples are available | Describes a no-signup API supporting IPv4 and IPv6, several signals, and a bulk endpoint for up to 100 IPs per call. Its FAQ describes public endpoint access as fair-use and subject to possible throttling. Provider site. |
| VPNDetection | Provider lists an official Node.js client | Its API page states that keyless access allows 1,000 daily lookups per user and returns ip and is_vpn. It also describes a free-key plan with 50,000 requests monthly and VPN-IP flags. The page documents HTTP 429 guidance, including a possible Retry-After header. Provider API page. |
| GetIPIntel | Free API documentation linked from the project | Returns a probabilistic score for proxy, VPN, hosting, or bad-IP likelihood. The project author recommends testing sample data and tuning thresholds before taking automated action. Project documentation. |
The providers return different data and operate under different terms. To compare them for your application, run the same labeled IPv4 and IPv6 sample through each, then record false positives and missed detections by category. Also check how each response distinguishes a missing field from a false value, measure latency and rate-limit behavior at your expected request volume, and review data-retention and permitted-use terms. The cited material does not establish an overall accuracy winner.
Rank #3
What a VPN, proxy or Tor result can—and cannot—tell you
A positive result classifies an IP address or network route according to the provider’s data. It does not identify the individual using that address or establish malicious intent. Shared VPN exits, legitimate privacy use, and other ordinary traffic can all produce a flag. The ip-api.io guide advises against blocking all VPN and proxy traffic and describes step-up verification as a common alternative; treat that as a risk-management pattern, not a universal rule.
Tor and VPN coverage also depends on the provider’s maintained address intelligence and detection signals. IPLogs says its Tor exit list comes from check.torproject.org and is fetched hourly; ip-api.io describes its dedicated Tor check as checking a live Tor-node list. These descriptions indicate list-based detection, not guaranteed identification of every anonymizing route.
Rank #4
Residential proxies are a difficult case
IPLogs says peer-to-peer residential proxies using genuine consumer ISP connections are its hardest category and that it is still researching behavioral heuristics for them. Its FAQ suggests combining IP intelligence with session behavior analytics for higher confidence. That is a provider’s description of its limitations and suggestion—not evidence that behavioral analysis will reliably identify every residential proxy.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Interpret published accuracy figures narrowly
IPLogs publishes a 2026 benchmark of a 0.3% false-positive rate and a 0.9% false-negative rate, which its FAQ says was based on approximately 1,100 addresses validated against Team Cymru. These are IPLogs-reported figures, not independently verified results. They do not establish performance for another provider, dataset, geography, or workload.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose an action that matches the risk
Use the flag as one input into an application-specific decision. For example, a flagged address might trigger an additional verification step for a sensitive account action, while an unrelated low-risk page remains available. Reserve a hard block for cases where your broader policy and stronger threat signals justify it; an anonymizing-network flag alone does not prove abuse.
- Decide what action each signal can trigger before wiring the result into access control.
- Measure false positives and missed detections against representative traffic, including both IPv4 and IPv6 where relevant.
- Review outcomes by signal category rather than treating VPN, proxy, and Tor flags as interchangeable.
- Provide an appropriate recovery path for legitimate users challenged by the policy.
Check limits, errors and privacy before production use
Provider allowances and response behavior can change. Check the current API limit, IPv6 coverage, response fields, retry semantics, service availability, and terms of use for the provider and plan you select. For VPNDetection, the API page says an HTTP 429 response may include Retry-After and distinguishes a transient limit from an exhausted allowance; handle rate limiting according to the current API guidance rather than retrying without bounds.
IPLogs says it uses transient request logs for abuse detection, rotates logs automatically, and does not keep a persistent database of individual lookups or use tracking cookies, advertising integrations, or third-party analytics. This is the provider’s own description. Review its current privacy policy and the relevant terms before sending production traffic. Apply the same review to any provider: understand what IP data is transmitted, how it is retained, and whether the intended use is permitted.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
