To detect VPN, proxy, and Tor traffic in a Node.js app, look up the visitor’s IP address with an IP-intelligence API. For a short implementation, the ip-api.io JavaScript SDK documents a single lookup that returns all three flags. A positive flag identifies a network signal—not a person’s identity or proof of abuse—so use it as an input to a risk decision rather than an automatic ban.
Check an IP for VPN, proxy, and Tor flags
The ip-api.io guide lists Node.js 18 or later and a free API key as prerequisites. Install its ip-api-io package, keep the key in a server-side environment variable, and pass the visitor IP to lookup():
As an Amazon Associate I earn from qualifying purchases.
import { IpApiClient } from "ip-api-io";
const client = new IpApiClient({ apiKey: process.env.IP_API_IO_KEY });
const info = await client.lookup(ipAddress);
const flags = info.suspicious_factors;
if (flags.is_vpn || flags.is_proxy || flags.is_tor_node) {
// Apply your application's risk policy, such as step-up verification.
}The SDK documentation describes suspicious_factors.is_vpn, is_proxy, and is_tor_node as booleans. See the ip-api.io JavaScript SDK guide for current package, response, and setup details.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhen to make a separate Tor check
A regular lookup already includes the Tor boolean. The SDK also documents client.torCheck(ip), which returns is_tor and tor_node_count. Use that additional request when the matching-node count or an explicit Tor check is useful to your application; it is not required just to read the normal lookup’s Tor flag.
#1 Best Overall
- Available with the Cloud Labs which provide a hands-on, immersive mock IT infrastructure enabling students to test their skills with realistic security scenarios
- New Chapter on detailing network topologies
- The Table of Contents has been fully restructured to offer a more logical sequencing of subject matter
- Introduces the basics of network security—exploring the details of firewall security and how VPNs operate
- Increased coverage on device implantation and configuration
Get the visitor IP from a trusted source
Run the lookup on your server and derive the address from the trusted network path into your application. If traffic arrives through a CDN or reverse proxy, configure the application to trust only the infrastructure you control. Do not accept an arbitrary client-supplied forwarding header as the visitor’s IP: an attacker could set it themselves and cause you to classify the wrong address.
The correct client-IP header depends on the deployed proxy and its configuration. For example, the GetIPIntel project README mentions Cloudflare’s CF-Connecting-IP; that is an infrastructure-specific example, not a universal header. Verify the proxy’s documented behavior and configure trusted-proxy handling accordingly.
Rank #2
- equipped with atom n2600 d2700 processor, compatible with many freebsd based router systems, linux distros, or win.os supported, easy configuration and management
- Please note, this is a barebone only. A system memory, a storage drive and an operating system are needed to complete this system
- 13-19 inches 1u, 50w power, with power cord, make sure to use a big brand memory and ssd/hdd with quality assurance
- Designed with console, 2 x usb, 4 x lan, vga, power switch, size at 290 x 180 x 44mm
- There are 2 inside reserved fans on chassis, which could be removed freely or be turned on in a high temperature environment to ensure the best function of the product
Choose a free API based on its limits and signals
Free access does not mean every provider has the same setup, response, or allowance. The following are provider-described options, not an independently benchmarked ranking; check the linked pages for current terms before using them.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Provider | Documented Node.js entry point | Signals and stated free access |
|---|---|---|
| ip-api.io | JavaScript SDK; guide lists Node.js 18+ and a free API key | One lookup returns VPN, proxy, and Tor booleans; an optional Tor check returns a node count. Provider guide |
| IPLogs | No-signup API; provider says Node.js examples are available | Provider says it supports IPv4 and IPv6, returns multiple signals, and offers a bulk endpoint for up to 100 IPs per call. Its FAQ describes public endpoint access as fair use, with possible throttling. Provider site |
| VPNDetection | Keyless HTTP request or free API key; an official Node.js client is listed | The page states that keyless access allows 1,000 daily lookups per user. It also states a no-card free-key plan of 50,000 requests monthly and VPN-IP flags. The API page describes HTTP 429 handling. Provider site |
| GetIPIntel | Free API documentation linked from the project | Returns a probabilistic score for proxy, VPN, hosting, or bad-IP likelihood. The project author recommends evaluating sample data and tuning thresholds before taking automated action. Project site |
These allowances and terms are provider statements reported on their pages; they can change. Before production use, confirm the current rate limits, authentication requirements, IPv6 support, response fields, error and retry behavior, data retention, and permitted use. For a fair comparison, send the same labeled IPv4 and IPv6 sample to each candidate and record false positives and misses by category; also test latency and throttling at your expected request volume.
Rank #3
- SonicWall TZ270W Appliance Only - No Service Subscription (02-SSC-2823) - Combines enterprise-grade firewalling with integrated 802.11ac Wave 2 Wi-Fi to deliver secure wired and wireless connectivity in one compact device for small offices and clinics.
- Blocks zero-day threats and ransomware with Capture ATP sandboxing enhanced by RTDMI, plus IPS and anti-malware scanning for layered protection.
- Eliminates the need for separate access points in smaller spaces thanks to built-in high-speed wireless that is simple to deploy and manage.
- Supports VPN, SD-WAN, and TLS 1.3 decryption to secure hybrid cloud access and remote workers while maintaining usability and performance.
- Delivers gigabit performance with up to 750,000 concurrent connections to handle growth in users, devices, and SaaS applications.
Use detection as a risk signal, not a verdict
A VPN or proxy flag describes an IP or network path. It does not establish who is using the connection or why. The ip-api.io guide advises against blocking all VPN and proxy traffic and suggests step-up verification as a common response, with hard blocks reserved for stronger threat signals. That is a risk-management pattern, not a universal policy: choose an action that fits the consequences of a false positive in your app.
- Low impact: record the signal for monitoring or use it to prioritize review.
- Moderate concern: request an additional verification step before a sensitive action.
- Strong evidence of abuse: apply a block or other restrictive response under your own policy, considering additional signals rather than relying on the VPN flag alone.
IP classification is not complete coverage. Tor and VPN detection depends on maintained address intelligence and provider-specific signals. IPLogs says its Tor exit list is sourced from check.torproject.org and fetched hourly; ip-api.io describes its dedicated Tor check as using a live Tor node list. Those are descriptions of list-based detection, not guarantees that every anonymizing route will be identified.
Rank #4
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
IPLogs publishes a benchmark of a 0.3% false-positive rate and a 0.9% false-negative rate, based on approximately 1,100 addresses it says were validated against Team Cymru. These are IPLogs’ own figures, not independently verified results, and they do not establish performance for another provider, sample, geography, or workload. The provider also says peer-to-peer residential proxies using genuine consumer ISP connections are its hardest category and that it is researching behavioral heuristics. It suggests pairing IP intelligence with session behavior analytics, but that should be treated as a possible added signal, not a guaranteed fix. See the IPLogs FAQ and provider information.
Protect privacy and handle API failures
Sending an IP address to a third party is a data-handling decision. Review the provider’s current privacy policy and terms before submitting production traffic, and check whether its retention and permitted-use rules fit your application. IPLogs says it uses transient request logs for abuse detection, rotates logs automatically, and does not keep a persistent database of individual lookups or use tracking cookies, advertising integrations, or third-party analytics; confirm those statements in its current privacy policy.
Plan for unavailable services, exhausted allowances, and rate limits. VPNDetection’s API page says a 429 response may include Retry-After and distinguishes a transient limit from an exhausted allowance. Handle errors explicitly: avoid treating a failed lookup as a clean result, and decide whether your app should retry, defer a sensitive action, or continue with a documented fallback. Apply sensible timeouts and rate-limit your own lookup traffic so a provider outage does not silently determine access to your application.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
