Check whether a proxy IP address is flagged as a proxy or VPN.
Enter a proxy IP address to see whether it is flagged as a proxy or VPN. It is free, with no signup.
Free & rate-limited. No signup required to try.
A proxy checker reads the flags on an IP address: whether it is flagged as a proxy or VPN, sits in hosting or datacenter space, or is a Tor exit node. 1Lookup's free checker shows those flags for any IPv4 or IPv6 address. It never connects to the proxy, so it cannot say whether the proxy is online or fast.
- Free, no signup
- IPv4 and IPv6 addresses
- Never connects to the proxy
- Says Unknown or Not checked when it cannot tell
You can check a proxy address in under a minute.
Enter the address.
Type the IP address of the proxy. A port after it, such as :8080, is removed before the lookup.
Read the headline.
It names the strongest flag: a Tor exit node, a proxy or VPN, a hosting address, or no flag at all.
Read each flag.
The proxy, hosting and Tor flags are separate fields, and the reverse DNS and country fields sit under them.
Decide what the flags mean for your use.
A hosting flag says where the address lives, and it does not say the proxy is broken or unsafe.
Need this at scale? IP Lookup API
Flag proxy, VPN, Tor and hosting addresses on every signup, login and order, one request per address.
A proxy checker reads what is known about an address, and it cannot tell whether the proxy works.
A proxy is a server that passes your traffic on for you, so the site you visit sees the proxy's address and not yours. An HTTP proxy forwards web requests, an HTTP CONNECT proxy opens a tunnel that forwards data blind in both directions, and a SOCKS5 proxy, defined in RFC 1928 in 1996, gives a client program a framework to use a proxy server for TCP and UDP traffic.
This checker looks the address up and reports the flags its record carries: whether it is flagged as a proxy or VPN, whether it sits in hosting or datacenter space, whether it is on the Tor Project's list of exit addresses, and whether it has a reverse DNS name. It does not connect to the proxy, send it a request or read its headers. So it cannot say whether the proxy is online, how fast it is, whether it needs a login or how much of your identity it hides.
That is the view a website has. A site cannot see your proxy settings, only the address that reaches it, and it can only act on what is known about that address. Tools that connect through a proxy answer a different question, which is whether the proxy works, so use them to test a proxy you rent and use this check to see how its address looks to the sites you visit through it.
The IP lookup API returns the same flags for every address you collect.
When the check has to run on every login or signup, the IP lookup endpoint returns the flags for 1 credit a lookup. See the IP lookup API. To rate the risk of an address from these flags and more, use our free IP fraud score checker. To see whether an address is on public spam blocklists, use our free IP blacklist check. To detect VPN, proxy, Tor and datacenter addresses in one place, use our free VPN and proxy detection tool. To find the network and AS number behind an address, use our free ASN lookup. To read the guide behind this check, see our guide to residential proxy detection.
A proxy check returns these fields, and each one answers a different question.
This is an invented result for a documentation address, laid out the way a check comes back. The first five fields are free on this page, and a free account opens the rest.
- Proxy or VPN flaggedNo
- Hosting or datacenterYes
- Tor exit nodeNo
- Reverse DNS name setNo
- CountryUnited States
Opens with a free trial
- The network and organization that own the addressExample Networks Inc
- The AS number and its nameAS64496, Example Networks
- City and regionSpringfield, Illinois
Proxy or VPN flagged
Yes when the record flags the address as a proxy or VPN, and Unknown when the record has no flag list.
Hosting or datacenter
Yes when the address belongs to a hosting company or a cloud operator, or sits in a range a cloud operator publishes.
Tor exit node
Yes when the address is on the Tor Project's list of exit addresses, and Not checked when that list could not be read.
Reverse DNS name set
Whether the address has a name set for it in reverse DNS.
Country
The country the address record gives for it.
The network and organization that own the address
The network and the organization the address is registered to.
The AS number and its name
The autonomous system that announces the address on the internet.
City and region
The approximate place the location record gives for the address.
The checker reads the flags on an address in three steps.
You enter the proxy's address.
Type an IPv4 or IPv6 address. If your list writes it as 203.0.113.42:8080, the port is cut off and only the address is checked.
We read the flags on that address.
1Lookup looks up whether the address is flagged as a proxy or VPN, sits in a hosting range or is on the Tor exit list. Nothing is sent to the proxy.
You read the headline and the flags.
The headline puts the strongest flag first. The fields under it show each flag, the reverse DNS flag and the country, and a free account opens the rest.
A proxy check reads the flags on one address, and it never reaches the proxy itself.
A website sees only the address that connects to it, so the check reads what is known about that address.
- You enter the addressIPv4 or IPv6, with or without a port. The port is dropped.
- Its flags are readThe record says whether the address is flagged as a proxy or VPN, sits in hosting space or is on the Tor exit list.
- The flags become a headlineA Tor exit comes first, then a proxy or VPN flag, then a hosting flag. If none is raised, the address reads as not flagged.A flag list that did not come back shows as Unknown
- You read the resultThe headline, each flag, the country and any cloud provider. Whether the proxy works stays outside what flags show.
The count of Tor exit relays grew 82.2% from October 2022 to October 2026, from 1,475 to 2,688.
A Tor exit relay is the last stop of a Tor circuit, and a website sees traffic from it as coming from the relay's address. The Tor Project counts the relays that carry the Exit flag. These are its counts for 21 October of each year, and the count fell in 2024 and again in 2026.
| Year | Relays with the Exit flag on 21 October |
|---|---|
| 2022 | 1,475 |
| 2023 | 2,384 |
| 2024 | 2,275 |
| 2025 | 2,813 |
| 2026 | 2,688 |
Source: Tor Metrics, Relays with relay flags, Exit flag, 21 October of 2022 to 2026.
The United States, the Netherlands, Germany and Sweden host 80.2% of the 2,710 Tor exit relays that were running on 23 October 2026.
Onionoo is the Tor Project's relay data service. This is its list of relays that were running and carried the Exit flag when it was published at 15:00 UTC on 23 October 2026, grouped by the country its data gives each relay. The 2,710 relays are spread over 52 countries, and the last row adds up the rest.
| Country | Exit relays running | Share of all exit relays |
|---|---|---|
| United States | 998 | 36.8% |
| Netherlands | 613 | 22.6% |
| Germany | 361 | 13.3% |
| Sweden | 202 | 7.5% |
| Austria | 122 | 4.5% |
| France | 63 | 2.3% |
| Norway | 49 | 1.8% |
| Romania | 42 | 1.5% |
| 44 other countries | 260 | 9.6% |
Source: Tor Project Onionoo, relays with the Exit flag that were running, published 2026-10-23 15:00:00 UTC.
Two AWS regions, us-east-1 and us-west-2, hold 40.4% of the 79,951,933 IPv4 addresses AWS publishes for EC2.
A proxy that runs on a rented cloud server has the cloud server's address. AWS publishes the ranges of its services in one file, and this table adds up the ranges marked EC2 for each region with overlapping ranges merged. The file was created at 2026-10-23 06:57 UTC. When an address sits inside a published range, the free result adds a Cloud provider row with the operator and the region.
| AWS region | EC2 IPv4 addresses | Share of EC2 addresses |
|---|---|---|
| us-east-1 | 21,536,672 | 26.9% |
| us-west-2 | 10,742,896 | 13.4% |
| eu-west-1 | 5,596,448 | 7.0% |
| eu-central-1 | 5,069,344 | 6.3% |
| us-east-2 | 4,962,064 | 6.2% |
| ap-northeast-1 | 4,299,552 | 5.4% |
| ap-southeast-1 | 2,598,176 | 3.2% |
| ap-southeast-2 | 2,306,848 | 2.9% |
| 35 other regions | 22,839,933 | 28.6% |
Source: AWS ip-ranges.json, EC2 ranges merged by region, read 23 October 2026.
IANA registers port 1080 as Socks and port 8118 as a Privoxy HTTP proxy, while 3128 and 9050, the usual ports of Squid and Tor, are registered to other services.
A proxy list often writes the port after the address. This table shows what the public port registry and the software's own documents say about five ports that proxies are often set to listen on. A port says what a program is set to listen on, and it does not prove what runs there. This checker removes the port and reads the address.
| Port | IANA registry entry | What the proxy software's documents say |
|---|---|---|
| 1080 | socks, Socks | RFC 1928: the SOCKS service is conventionally located on TCP port 1080. |
| 3128 | ndl-aas, Active API Server Port | Squid manual: Squid normally listens to port 3128. |
| 8080 | http-alt, HTTP Alternate (see port 80) | The registry names no proxy and points to port 80, the web port. |
| 8118 | privoxy, Privoxy HTTP proxy | The registry names the Privoxy HTTP proxy. |
| 9050 | versiera, Versiera Agent Listener | Tor manual: the SocksPort setting defaults to 9050. |
RFC 9110 requires an HTTP proxy to send a Via header, while RFC 7239 makes the Forwarded header optional and says to keep it off by default.
A check that reads request headers sees only what the proxy chooses to send, so this check reads the address and not headers. These are the rules the standards set for what a proxy says about itself. RFC 9110 is the HTTP standard of June 2022, and RFC 7239, from June 2014, defines the Forwarded header.
| Standard | What it says |
|---|---|
| RFC 9110, the Via header | A proxy must send an appropriate Via header field in each message that it forwards. |
| RFC 9110, the CONNECT method | CONNECT asks the recipient to set up a tunnel to the destination server and then restrict itself to blind forwarding of data in both directions. |
| RFC 7239, the Forwarded header | Forwarded is an optional header that discloses what a proxy alters or loses, and it should be turned off by default. |
| RFC 7239, X-Forwarded-For | RFC 7239 calls X-Forwarded-For a non-standard header field. |
| RFC 1928, SOCKS version 5 | A framework for client-server applications in both the TCP and UDP domains to use the services of a network firewall. |
The headline shows the strongest flag first, and it says so when no flag list came back.
This is how the free result chooses its headline from the flags the address record carries.
| Headline | When it shows |
|---|---|
| A Tor exit node | The address is on the Tor exit list, and that list was read. |
| Flagged as a proxy or VPN | The record carries a proxy or VPN flag. |
| A hosting or datacenter address | The record flags hosting or datacenter space, or the address sits in a published cloud range, and no stronger flag is raised. |
| Not flagged as a proxy, VPN or hosting address | The flags came back and none of them is raised. |
| No flags came back for this address | The record has no flag list, so the result shows Unknown instead of No. |
| This address is not on the public internet | The address is private or reserved, so no website sees it and there is nothing to read. |
A proxy check can answer five questions about an address and cannot answer four others.
The flags on an address cover some questions, and a connection test through the proxy covers the rest.
| Question | Can this check answer it? | Where the answer lives |
|---|---|---|
| Is the address flagged as a proxy or VPN? | Yes | The proxy flag on the address record |
| Is it in hosting or datacenter space? | Yes | The hosting flags and the published cloud ranges |
| Is it a Tor exit node? | Yes | The Tor Project's list of exit addresses |
| Does it have a reverse DNS name? | Yes | The reverse DNS record of the address |
| Which country is it in? | Yes | The location record of the address |
| Is the proxy online right now? | No | A connection test through the proxy |
| How fast is the proxy? | No | A speed test through the proxy |
| Does the proxy hide your address from a site? | No | A request sent through the proxy to a page that shows what it receives |
| Is it a residential proxy or a datacenter proxy? | No | A hosting flag says where the address lives, and no flag does not show a home connection |
A proxy check costs 1 credit, about $4.95 per 1,000 lookups on Starter and $2.00 on Enterprise.
These are the monthly plans on the pricing page. The proxy, hosting and Tor flags come back on the same check. Every plan starts with a 7-day free trial, and the same credits pay for every other 1Lookup check.
| Plan | About per 1,000 lookups | Monthly price | Proxy checks included |
|---|---|---|---|
| Starter | $4.95 | $99 | 20,000 |
| Growth | $3.52 | $299 | 85,000 |
| Professional | $3.20 | $799 | 250,000 |
| Enterprise | $2.00 | $1,999 | 1,000,000 |
The IP lookup API returns the proxy flags as JSON from one request.
Send the address to the IP lookup endpoint with your API key. Each request costs 1 credit, and every account can send up to 1,000 requests a minute. The proxy, hosting and reverse DNS flags are in risk_assessment.risk_factors, and the Tor, cloud and reserved-address flags are in insights.network_intelligence, whose coverage field says whether the Tor list was read.
curl -X POST https://app.1lookup.io/api/v1/ip \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"ip": "203.0.113.42"}'import requests
response = requests.post(
"https://app.1lookup.io/api/v1/ip",
headers={"Authorization": "Bearer YOUR_API_KEY"},
json={"ip": "203.0.113.42"},
)
data = response.json()["data"]
print(data["risk_assessment"]["risk_factors"])const response = await fetch('https://app.1lookup.io/api/v1/ip', {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_API_KEY',
'Content-Type': 'application/json'
},
body: JSON.stringify({ ip: '203.0.113.42' })
})
const { data } = await response.json()
console.log(data.risk_assessment.risk_factors)Response
{
"success": true,
"data": {
"request": { "type": "ip", "input": "203.0.113.42" },
"risk_assessment": {
"risk_factors": ["DATACENTER_IP", "NO_REVERSE_DNS"]
},
"insights": {
"location": { "country": "United States" },
"network_intelligence": {
"is_datacenter": true,
"is_tor_exit": false,
"is_bogon": false,
"coverage": "complete"
}
},
"metadata": { "credits_used": 1, "credits_remaining": 9998 }
}
}To run the same check on every address you collect, see our IP lookup API.
It reads each flag separately.
The proxy, hosting and Tor flags are separate fields, because an address can carry one of them without the others.
It says Unknown or Not checked when it cannot tell.
A missing flag list shows as Unknown, and a Tor check that did not run shows as Not checked, because neither is the same as No.
It never connects to the proxy.
The check reads a record, so the proxy is not contacted and its owner is not told.
It does not guess whether an address is residential.
The result shows flags the record carries and does not turn a provider's name into a residential or datacenter verdict.
Who uses this tool
Teams that rent proxies check the addresses before they use them.
A hosting or flagged address is what the sites you visit will also see, so it is worth knowing before you build on it.
Signup and fraud teams check the address behind a new account.
A proxy, hosting or Tor flag is one signal, and it sits beside the email, the phone number and the device.
Security teams check an address from their logs.
A login or request from an address in a log can be looked up in seconds to see which flags it carries.
People check an address they were handed.
An address from a proxy list, a provider's welcome email or a server log can be checked before it is trusted.
Frequently asked questions
How do I check whether an IP address is a proxy?
Enter the address in this checker. The headline names the strongest flag, and the fields under it show whether the address is flagged as a proxy or VPN, sits in hosting space, is a Tor exit node and has a reverse DNS name, with its country.
Can this proxy checker test whether a proxy is online or fast?
No. The check reads the flags on the address and never connects to the proxy, so it cannot say whether the proxy is online, how fast it is or whether it needs a login. A tester that connects through the proxy answers those questions.
Can I paste an address with its port?
Yes. A port after the address, such as 203.0.113.42:8080 or [2001:db8::1]:8080, is cut off before the lookup and is never tested. A port outside 1 to 65535 is refused, and a plain address works too.
What does a hosting or datacenter flag mean?
It means the address belongs to a hosting company or a cloud operator. The flag says where the address lives, and it does not say the proxy is broken or unsafe.
Why does my paid proxy show as a hosting address?
Because a proxy that runs on a rented server has the server's address, and the check reports where the address lives. A proxy that runs on a home or mobile connection sits on a different kind of address.
Can this checker tell a residential proxy from a datacenter proxy?
Not by itself. The free result shows the hosting flag and the cloud provider where the operator publishes its ranges, and an address with no hosting flag is only one the record does not flag. The result does not call an address residential.
Does the checker detect Tor?
Yes, for exit nodes. The Tor exit node field says Yes when the address is on the Tor Project's list of exit addresses, and Not checked when that list could not be read. A relay that is not an exit is not on the list.
Does a Tor exit node mean the traffic is malicious?
No. The Tor network is built for privacy, and a Tor flag only says the traffic arrives through it. Whether to allow it is a choice for each site.
How many Tor exit relays are there?
The Tor Project counted 2,688 relays with the Exit flag on 21 October 2026, and its relay data service listed 2,710 running exit relays in 52 countries on 23 October 2026. The United States hosts the most, with 998.
What is the difference between a proxy and a VPN?
A proxy forwards the traffic of one program or request, while a VPN usually carries all the traffic of a device to a VPN server. A website sees the server's address in both cases, which is why one flag covers both.
What is a reverse DNS name and why does the result show it?
It is the name set for an address in reverse DNS, the lookup from an address to a name. An address can have a name set or none, so the field shows which.
Why does the result say Unknown or Not checked?
Unknown means the record had no flag list, and Not checked means the Tor list could not be read for this answer. Neither is a No, because a flag that was not looked at is not a flag that is absent.
Does the person who runs the proxy know I checked it?
No. The check reads records only. Nothing is sent to the address, so its owner is never told.
How much does a proxy check cost per address?
A proxy check costs 1 credit per address in the API. That is about $4.95 per 1,000 on the Starter plan, $3.52 on Growth, $3.20 on Professional and $2.00 on Enterprise. The free tool on this page checks one address at a time with no signup, and every plan starts with a 7-day free trial.
Is there an API that checks whether IP addresses are proxies in bulk?
Yes. The IP lookup endpoint returns the proxy, hosting and Tor flags for each address, 1 credit a request. Every account can send up to 1,000 requests a minute.
Is this proxy checker really free?
Yes. Checking one address takes no signup. A free account opens the network and organization, the AS number and the city and region, and checking many addresses by API uses credits.