Some GeoIP2 products and services can identify many IP addresses that belong to different kinds of anonymizers, from VPNs to TOR exit nodes. Anonymous IP data includes:
End-users may use anonymizers for a variety of reasons. They may be privacy-conscious web users who do not want their personal information tracked. However, anonymizers may also be attempting to get around geofencing or to hide their identity while engaging in fraud and other malicious activities.
Anonymizer data, which is updated daily, can be found in the following GeoIP2 products and services:
- GeoIP2 Insights web services. Learn more about the features and pricing GeoIP2 Insights web service and purchase service credit on our main website.
- GeoIP2 Anonymous IP database. Learn more about the features of the GeoIP2 Anonymous IP database and get in touch with sales on our main website.
In addition, the minFraud Insights and Factors web services include anonymizer data along with a wide variety of additional data and risk scoring to help detect fraud. The minFraud services are better at detecting malware-compromised devices and botnets, which are frequently used by fraudsters. Learn more about anonymous IP data in the minFraud services.
Anonymizer detection
If the IP address has been flagged as any kind of anonymizer, it will be identified with this data point.
Regardless of what type of anonymizer is being used, these services will all effectively hide the IP address of the end-user. Someone using an anonymizer may simply be a privacy-conscious web user, but it is important to note that all IP geolocation and IP intelligence data associated with an anonymous IP will correspond to the web host running the anonymizer rather than the end-user.
For example, suppose someone located in Oregon in the United States is using a VPN to browse your website from their mobile phone. Suppose that this VPN is hosted in a data center in California in the United States. We may identify that IP address as an anonymizing VPN. If we geolocate this IP address and provide IP intelligence data for it, we would geolocate the IP address to California, rather than Oregon, and would provide IP intelligence data for a hosting facility rather than a mobile network.
If you feel that a customer’s IP address was incorrectly flagged as an anonymizer, please contact our support team, and we will have our data review team investigate the IP. Please do not ask the customer to contact us directly.
You can read the API specifications for our anonymizer detection on our developer portal:
Types of anonymizers
We identify five different kinds of anonymizers:
These different kinds of anonymizers operate in similar ways, taking advantage of the structure of the internet to effectively mask the IP address, and thus the geolocation, of the end-user. GeoIP2 products and services do not provide a way to find the IP address or geolocation of an end-user using an anonymizer. To learn more about anonymizer use as it relates to GeoIP2 accuracy, please check out our blog post, specifically the "VPNs and Other Proxies" section.
VPNs
Virtual private networks (VPNs) are usually a paid service, where a customer can browse the internet using an IP address provided by a third-party. This third-party acts as an intermediary for all browsing done by the user.
Many VPN users are privacy-conscious web users who are not necessarily engaged in any malicious activity.
You can read the API specifications for our VPN detection on our developer portal:
Hosting providers
Web hosting services can be used to create private proxies, and many VPN services use hosting providers instead of registering their own IP ranges. This means that if you see traffic associated with an end-user coming from a hosting provider, the end-user is probably using a VPN, even if we have not otherwise identified it as such.
You can read the API specifications for our hosting provider detection on our developer portal:
Public proxies
Public proxies tend to be easy to access and are openly published.
You can read the API specifications for our public proxy detection on our developer portal:
Residential proxies
Residential proxies are harder to detect than other kinds of proxies as these IPs appear to be associated with legitimate residential ISPs.
You can read the API specifications for our residential proxy detection in our developer portal:
TOR exit nodes
These are published IPs used as exit nodes for the TOR network. Traffic from these nodes have been relayed through several servers to preserve anonymity.
You can read the API specifications for our TOR exit node detection in our developer portal:
Other types of proxies
In addition to the anonymizers flagged above, there are other kinds of privacy-focused networks such as Apple iCloud Private Relay that protect the identity (and sometimes the more specific geolocation) of the end-user, but include additional oversight by the companies who manage these networks. Learn more about these networks.
This page was last updated on .