Blanket-blocking every address that looks like a VPN is a product decision dressed up as security. On IP99 by ThreatHunter, the vpn signal means something narrower: a static commercial VPN exit on infrastructure the provider controls — usually a fixed hosting/dedicated address, shared by many users and stable for weeks. That is the opposite of a rotating residential proxy. Treating hosting alone, or every IDC address, as "VPN → refuse" over-blocks privacy users and travellers while still missing proxy supply that wants to look like a customer.
This walkthrough stays on free, no-key GET /v1/ip/{ip}. JSON samples below are documented product shapes from IP99 docs and prior verified captures — run the curls yourself for a live snapshot. Notes: IP99, API, Is this IP a VPN?, detect proxy / VPN.
What vpn is (and what it is not)
IP99's free lookup returns a 0–100 risk.score for freshness and strength of verifiable risk evidence, not attacker probability. risk.level follows the score (0 → none, 1–29 → low, 30–69 → medium, 70–100 → high). Signals appear only when they hit; missing keys mean unknown, not zero.
Tags that matter here:
| slug | Meaning | Typical disposition |
|---|---|---|
vpn | Static commercial VPN exit (observed infrastructure) | Product decision; often step-up, not refuse |
proxy | Address currently used as a proxy exit | Step-up or block by business cost |
dialup_pool | Dial-up / redial rotation pool | Treat as supply-side rotation (often DYN/MOB) |
hosting / mobile | Network attributes | Not risk verdicts alone |
crawler | Search crawler egress | Benign; does not score |
Official page shape for a commercial VPN exit (is-this-ip-a-vpn):
- Hosting or dedicated ranges — providers rent datacenter servers, so
network.usage_typeis usuallyIDCandrisk.signalsoften also listshosting. - Static — the same address serves the same provider for weeks or months; evidence ages slowly compared with rotating exits.
- Shared — many users sit behind one exit at once; the address's history must not attach to the next person behind it.
- Observed, not inferred —
vpncomes from observed VPN infrastructure, not from network type. Hosting alone never putsvpnthere.
Two common mistakes:
- IDC +
hosting≠ VPN. A datacenter address withoutvpnevidence is hosting, not a VPN. Public DNS and ordinary cloud servers look like that every day. - "VPN" apps on consumer devices ≠ commercial VPN exits. Apps that route through phones or home routers are residential proxy supply. IP99 reports those as
proxy/dialup_poolonDYNorMOBspace — detected by presence in proxy supply, not by calling them VPN.
Tor is not a VPN: Tor uses volunteer relays; a VPN is a commercial service with fixed provider-controlled exits. This article covers VPN/proxy infrastructure only — do not invent a Tor tag, and do not claim IP99 detects Tor.
Free /v1/ip does not return share_tier (Pulse only). On free tier, lean on evidence_state, score/level, signal type, plus your own velocity / device checks.
Documented contrast: hosting attribute vs datacenter proxy
curl https://ip99.com/v1/ip/8.8.8.8 Documented product sample (IP99 docs / prior verified capture):
{ "ip": "8.8.8.8", "computed_at": "2026-10-09T10:22:26Z", "evidence_state": "none", "geo": { "continent": "NA", "country": "US", "region": "California", "city": "Mountain View", "tz": "America/Los_Angeles" }, "network": { "asn": 15169, "usage_type": "IDC" }, "risk": { "score": 0, "level": "none", "signals": ["hosting"] } } hosting here is a network attribute on public DNS. evidence_state: none with score 0 means no verifiable proxy-class evidence on file — not a clean bill of health, and not a VPN. "Block all IDC" would refuse this address for the wrong reason.
Now a Paris datacenter address with proxy evidence (contrast: proxy on IDC, not vpn):
curl https://ip99.com/v1/ip/178.20.30.146 Documented product sample (IP99 docs / prior verified capture):
{ "ip": "178.20.30.146", "computed_at": "2026-10-09T10:23:02Z", "evidence_state": "active", "geo": { "continent": "EU", "country": "FR", "region": "Île-de-France", "city": "Paris", "tz": "Europe/Paris" }, "network": { "asn": 46475, "usage_type": "IDC" }, "risk": { "score": 99, "level": "high", "signals": ["hosting", "osint", "proxy"] } } Same IDC + hosting space as many VPN exits, but the slug here is proxy (plus osint), not vpn. Branch on the matched signal, not on "looks like a datacenter." When vpn appears on a fresh active response, treat the egress as a shared commercial exit: challenge where product rules require it, but do not attach prior account history to the next user behind that IP.
What the weekly capture mix says
VPN-style infrastructure and rotating proxy supply live in different places. Of the 10,638,587 new proxy exit addresses captured in the 7 days to 5 November 2026, only 4% sat in datacenter space; 79% were residential broadband. Source: proxy-exits (also cited on is-this-ip-a-vpn; page data risk:20261106211046 geo:20261106). Someone who wants to look like a customer does not buy a static commercial VPN. A hosting-only blocklist over-punishes legitimate VPN users and under-covers residential exits that dominate new supply.
A practical branch (evidence_state first)
Official triage order: evidence_state → score/level → signal type. Generic guidance (not a contract): score 0 → do not stamp the IP "clean"; 1–29 → observe; 30–69 → captcha / throttle / second factor rather than a hard ban; 70–100 → block only when business cost allows. Score meaning and freshness notes: IP risk score.
1. Read evidence_state (active / stale / none). 2. Read risk.signals and network.usage_type. 3. If vpn is present and evidence_state is active: - Decide what VPN means for YOUR product (privacy vs licensing / geo / promo rules). - Treat the exit as shared — never attach prior account history to the next user. - Read geo.country as the EXIT country, not the user's home country. - Prefer step-up + velocity/device over refuse for most consumer flows. 4. Else if hosting on IDC WITHOUT vpn / proxy / dialup_pool: - Network attribute only — do not invent a VPN verdict. 5. Else if proxy / dialup_pool on DYN or MOB: - Residential / mobile proxy supply — different playbook than commercial VPN. 6. Never mark score 0 + evidence_state none as "trusted clean." 7. Re-query at decision time; do not cache a VPN verdict for days. Anonymous quota is 500 lookups/day per client IP (60/min); a free logged-in key raises the daily cap to 5,000/day. Check remaining with GET https://ip99.com/v1/me or the X-Daily-* response headers. OpenAPI: https://ip99.com/openapi.json.
Do not treat IP99 scores as identical to other ThreatHunter datasets elsewhere — this article only claims what free /v1/ip and the cited English product pages document.
Try it
curl https://ip99.com/v1/ip curl https://ip99.com/v1/ip/8.8.8.8 curl https://ip99.com/v1/ip/178.20.30.146 curl https://ip99.com/v1/me IP99 is a ThreatHunter product. Use the free lookup to separate commercial VPN static exits from residential proxy supply and ordinary hosting before a blanket ban hits a legitimate privacy user. Start at https://ip99.com; read Is this IP a VPN?, detect proxy / VPN, and https://ip99.com/api.
