IPipinfo
privacy detection extended

Returns extended privacy detection information with detailed methodologies.

The Privacy Detection Extended API provides detection methodology metadata to support risk scoring, confidence metrics, and IP reputation aspects. Uses multi-modal detection methods including internet measurement, IP behavior analysis, and internet records metadata. Includes detailed flags for VPN, proxy, Tor, relay, hosting, and service identification with confidence metrics.

get/{ip}/privacy_extended

Request

Path parameters

ipstring required

A single IPv4 or IPv6 IP address.

Response

Privacy Detection Extended response with detailed methodologies.

vpnboolean required

Indicates Virtual Private Network (VPN) service exit node IP address

proxyboolean required

Indicates an open web proxy IP address

torboolean required

Indicates a Tor (The Onion Router) exit node IP address

relayboolean required

Indicates a location-preserving anonymous relay service

hostingboolean required

Indicates a hosting/cloud service/data center IP address

servicestring required

Name of the privacy service provider - includes VPN, Proxy, and Relay service provider names

confidenceinteger

The level of confidence attributed to the best source associated with this range. Level 3 - Direct observation of commercial use (vpn_config). Level 2 - Direct observation of VPN software running on the range (census) + registrar information associated with VPNs or specific providers OR highly convincing device activity. Level 1 - Direct observation of VPN software running on the range (census) without known association to specific providers or VPNs in general OR suspicious device data not associated with hosting ranges

coveragenumber

For inferred ranges, represents the proportion of the range (in IP count) that we saw direct evidence of VPN activity on. For IPs/ranges we've fully directly observed VPN evidence on, this value is 1.0

censusboolean

Ranges where we've observed VPN software/ports on; we run scans on ports and protocols commonly associated with VPN software. Ranges with the census flag are those where these scans obtained positive results

census_portsinteger[]

The ports we've gotten positive results for when running our VPN detection census

device_activityboolean

Ranges on which we've observed device activity compatible with VPN usage (outside of known infrastructure area; simultaneous use around a large area; pingable and/or associated with hosting providers)

inferredboolean

Whether the range associated with the record is the result of direct observation or inference based on neighboring IPs

vpn_configboolean

Ranges where we confirmed VPN activity by directly running VPN software from almost 200 different providers and collecting exit IPs

whoisboolean

Ranges where we've observed VPN software/ports on AND have a WHOIS association with either VPNs in general or specific VPN providers

first_seenstring date

Date when the activity on an anonymous IP address was first observed. Date in YYYY-MM-DD format, ISO-8601. Within the 3-month lookback period

last_seenstring date

Date when the activity on an anonymous IP address was last/recently observed. Date in YYYY-MM-DD format, ISO-8601

Example response

{
  "vpn": true,
  "hosting": true,
  "service": "NordVPN",
  "confidence": 3,
  "coverage": 1,
  "census_ports": [],
  "first_seen": "2025-09-19",
  "last_seen": "2025-11-06"
}

Changes

No recorded changes to this operation across all 1 revision of this API.