What Does 'Is VPN' Mean in an IP Quality Score?

When you run an IP quality check and the result includes an is_vpn: true flag, what does that actually mean? The label sounds definitive, but the underlying reality is more nuanced. Understanding what the VPN flag does and doesn't tell you determines whether you use it wisely — as a risk signal that informs a proportional response — or clumsily, as a binary block that generates unnecessary friction for legitimate users.

What Triggers the VPN Flag

The is_vpn flag is set to true when the IP matches one or more entries in a database of known VPN exit nodes. These databases are built through several methods:

Explicit cataloguing of known providers. Major commercial VPN services (NordVPN, ExpressVPN, Surfshark, Mullvad, Private Internet Access, Proton VPN, and hundreds of others) operate fixed sets of server infrastructure. Their IP ranges are systematically catalogued by security research firms and continuously updated as providers add or change servers. If your IP is an exit node for any of these providers, the flag will be set.

ASN-level identification. Some VPN providers own their own ASNs or consistently use specific hosting providers. An IP from an ASN registered to a known VPN company is flagged even without individual IP enumeration.

Behavioural detection. Active probing of IP ranges for open VPN protocol ports (WireGuard on UDP/51820, OpenVPN on UDP/1194, IKEv2 on UDP/500) can identify VPN endpoints that aren't in any provider database yet.

Crowdsourced signals. Reports from customers encountering VPN traffic contribute to continuous database refinement.

What the VPN Flag Does NOT Mean

A VPN flag does not mean:

• The user is doing anything malicious
• The user is in a different country than the VPN exit location
• The traffic is automated or bot-generated
• The IP has any abuse history
• The connection should be blocked

VPN usage is a common feature of daily life for legitimate users: remote workers connecting through corporate VPNs, privacy-conscious consumers using commercial VPN services, journalists working in countries with internet restrictions, travellers using VPNs to access home services, and technical users who run their own VPN infrastructure for security.

The VPN flag is a signal that the traffic is anonymised and the true endpoint is unknown — nothing more and nothing less.

VPN Flag vs Fraud Score

The most important context for a VPN flag is the associated fraud score. These two pieces of data together tell a complete story:

• VPN=true, fraud score 5 — Someone using a reputable VPN with no history of abuse. This is a typical privacy-conscious user. Blocking this would generate significant false positives with no security benefit.
• VPN=true, fraud score 45 — VPN usage with some concerning signals. Worth extra authentication for sensitive operations but not a hard block.
• VPN=true, fraud score 85 — High-risk VPN exit with abuse history, possibly a known fraud-associated exit node. Strong case for blocking in high-risk contexts.
• VPN=false, fraud score 85 — High-risk residential or datacenter IP. The threat here may actually be more concerning in some contexts since residential proxies don't trigger VPN flags.

A VPN flag with a clean fraud score is less risky than no VPN flag with a high fraud score.

Types of VPN: Commercial, Corporate, and Self-Hosted

The is_vpn flag doesn't distinguish between types, but the distinction matters for risk assessment:

Commercial VPNs (NordVPN, ExpressVPN, etc.) are the most common trigger. They're used heavily by both privacy-conscious legitimate users and by fraudsters. The same exit node that a journalist uses for source protection might also be used by a fraudster doing carding. The flag correctly identifies the anonymisation; the fraud score provides the risk context.

Corporate VPNs route employee traffic through company infrastructure. Employees at large companies all appear to come from the same corporate IP range. This is often not detected as a VPN by consumer-grade databases, though some enterprise security tools specifically identify corporate gateway patterns.

Self-hosted VPNs on personal cloud VMs may or may not be in VPN databases, depending on whether security researchers have identified the IP. A personal WireGuard server on a DigitalOcean droplet might flag the IP as datacenter without triggering the VPN flag specifically.

Building VPN-Aware Policies

The right policy for VPN traffic depends on your service and risk tolerance:

• Block all VPN — Appropriate for services with strict geo-licensing requirements (streaming), services where false positives are tolerable, or services in regulatory environments requiring verified jurisdiction
• Step up authentication — Appropriate for financial services, account creation, and checkout flows where VPN is a risk signal but not a disqualifying one
• Log and monitor — Appropriate for services where VPN usage is expected and the signal is primarily for analytics and investigation use, not real-time blocking
• Allow freely — Appropriate for general-purpose services where privacy-conscious users are a valued part of the user base and the fraud score indicates low risk

The VPN flag is a tool for calibrated risk management. Used as a binary block, it alienates legitimate users unnecessarily. Used as a signal that adjusts risk scores and authentication requirements, it's a valuable component of layered fraud prevention.