EasyGeoIP

Detection methodology · Updated July 24, 2026

How EasyGeoIP reaches a VPN verdict

Every positive label should be traceable to observable evidence. This page documents the free sources, scoring rules, update process, and known gaps.

Design objective: precision before coverage

EasyGeoIP is designed to avoid calling ordinary residential or business users a VPN. Without a commercial anonymous-IP database, complete coverage is impossible. We therefore prioritize exact matches and disclose weak evidence rather than inflating a hidden score.

The result “No VPN evidence” only means that the currently available sources did not return a positive signal. Dedicated addresses, residential proxies, small private gateways, new servers, and providers without public relay inventories may be missed.

Evidence hierarchy

  1. Exact official relay match. An exact address in a locally cached provider relay list supports a confirmed provider verdict.
  2. Tor exit match. Tor exits are checked against a locally cached list generated for the EasyGeoIP service endpoint.
  3. Hosting ASN. A curated ASN classification describes network context only. It never confirms VPN use by itself.
  4. Reverse DNS. Terms such as vpn, proxy, relay, or wireguard are heuristic support and can be stale or misleading.

Current verdict rules

Tor detectedExact Tor exit match · confidence 100
VPN detectedExact known-provider relay match · confidence 100
VPN or proxy likelyHosting ASN plus privacy-related reverse DNS · confidence 78
VPN signal foundReverse-DNS heuristic without hosting confirmation · confidence 55
No VPN evidenceNo positive signal · no confidence percentage

Location and network data

Country, region, city, coordinates, time zone, and accuracy radius normally come from the locally installed GeoLite2 City database. ASN and organization normally come from GeoLite2 ASN. The application rejects stale MMDB builds and supports narrow, dated prefix corrections when a reassigned network is independently verified. Geolocation describes an address range and can point to a network gateway rather than a device.

EasyGeoIP does not send the visitor's address to MaxMind, Mullvad, Tor, or another lookup API during a page request. Scheduled server jobs download datasets in advance.

Update and integrity process

Database downloads use TLS, connection and total timeouts, gzip validation, a recognizable MMDB marker check, restrictive file permissions, and an atomic replacement in the destination directory. Network-list downloads also replace files atomically.

The interface shows source modification dates when files are available. A stale or missing source reduces coverage; it does not silently change a weak signal into a confirmed one.

What EasyGeoIP does not claim

  • It cannot prove that no VPN exists.
  • It does not identify a person's exact location or household.
  • It does not perform a DNS leak test without controlled DNS infrastructure.
  • It does not treat hosting ownership as malicious activity.
  • Affiliate configuration never changes detection logic.

Corrections and reproducibility

If an exact relay match is wrong, include the address, observed label, and evidence shown by the tool when contacting [email protected]. Do not send account credentials or private browsing information.

The detection logic is intentionally deterministic: the same local datasets and IP produce the same evidence. Future benchmark reports should publish false-positive rate and coverage separately.