See the IP address websites see for you, and whether it looks like a home broadband connection or a rented server. Your own address is checked automatically when the page loads, and you can look up any other address as well.
Works with IPv4 (198.51.100.24) and IPv6 (2001:db8::1). Leave the box empty to check your own connection again.
A proxy check shows the address websites see for you and whether it belongs to a hosting, VPN or residential network. Your own connection is checked on page load; paste any other address to test it. Consumer ISPs own home and mobile addresses, hosting companies own the servers that proxies and VPN exits run on — the exact matched term is shown so you can judge the evidence, along with the network's AS number.
What Is a Proxy Check and What Does This Tool Do?
What does this tool do?
It reads the IP address your connection presents to the internet, finds the network that owns that address, and checks the network name against a list of hosting, cloud and VPN operators. It then shows the evidence it used: the provider, the organisation the range is registered to, the AS number and the location. For your own address it also compares the time zone that address maps to with the one your computer is set to, because a disagreement between those two is one of the clearest signs that your traffic leaves the internet somewhere other than where you are.
Why is this useful?
Websites treat you differently depending on the address they see. A shop may show different prices, a streaming service may block playback, a bank may ask for extra verification, and a forum may refuse a new account. Many of those decisions rest on one question: does this address belong to a home connection or to a rented server? If you use a VPN, or a work laptop that tunnels through head office, this tells you what those sites are seeing. If you use neither and the answer comes back as a hosting network, something may be routing your traffic that you did not set up; the table further down lists the other possible explanations.
Who uses this tool?
• People behind a VPN or proxy: confirm it is working before logging in to something that matters.
• Anyone blocked with "proxy detected": see what the site is actually reacting to.
• Remote workers: check whether a company laptop routes traffic through the office.
• Site owners and moderators: look up an address from the logs to judge a suspicious signup.
• Privacy-minded users: see the same thing about themselves that every site they visit can already see.
How Do You Use This Tool?
1. Let the page load. Your own address is looked up automatically, so the first result describes your current connection.
2. Read the status line. "Consumer ISP network" means an ordinary internet provider owns the address; "Hosting or proxy network" means a company that rents out servers does; "Cannot be judged" means no network name came back.
3. Check the matched term. When the status is flagged, the exact word that triggered it is shown, so you can weigh the evidence yourself.
4. Look at the time zone line. On your own address, a disagreement between the two zones is a strong hint that traffic is exiting somewhere else.
5. Check any other address by pasting it in and pressing Enter, then use Copy result to paste the whole set of rows into a ticket or an email.
Example output for three sample inputs
The addresses below are reserved for documentation (RFC 5737), so a real lookup of them would most likely return no network name. The rows show what the page logic produces when a lookup does return the names listed. Two operator names are real companies used for illustration; the third is invented.
| Sample input | Network name and AS | Status and matched term | Time zone line |
|---|---|---|---|
| 203.0.113.40, your own address, VPN on | M247 Europe SRL, AS9009 (Amsterdam, Netherlands) | Hosting or proxy network, term "m247" | Your device says Asia/Dhaka, this address maps to Europe/Amsterdam (GMT+6 against GMT+2) |
| 198.51.100.77, your own address, home broadband | Link3 Technologies Ltd, AS23688 (Dhaka, Bangladesh) | Consumer ISP network, no term matched | Both say Asia/Dhaka, which agree |
| 192.0.2.15, another address typed into the box | Cloudline Broadband Ltd (invented name) | Hosting or proxy network, term "cloud" | Row is labelled "Time zone" and shows only the zone the address maps to |
Reading them. Sample 1 is a strong match: M247 rents ranges to many VPN brands, and a gap of several hours between the two zones fits an exit on another continent. The offset gap shrinks by an hour when Europe leaves summer time. Sample 2 has a residential operator, no term and agreeing zones, so nothing visible sits between this browser and the internet. Sample 3 is the weak case: the flag comes from the word "cloud" inside a name that reads like an ordinary broadband provider, which is why the matched term is shown. A name that arrives blank, or as a placeholder such as "Unknown ISP", gives "Cannot be judged" instead of either verdict.
Where the address a website sees comes from
In every case except the first, the website sees whichever machine spoke to it last. The thick lines mark the encrypted part of the path: a plain proxy adds no encryption of its own, while a VPN encrypts everything from your device to its server.
How Do You Read the Results?
Status
One of three values: "Consumer ISP network", "Hosting or proxy network" or "Cannot be judged". The first two are decided by one thing: whether the network name contains a word associated with hosting, cloud or VPN businesses. It is a well-founded hint rather than a verdict, and the word it matched is always shown.
Normal: "Consumer ISP network" on a home or mobile line, or "Hosting or proxy network" when you knowingly use a VPN, proxy or cloud desktop. Worth a second look: a hosting result when you use none of those, or "Cannot be judged" for a connection you expected to be identified.
Matched term
The word that caused the flag. A brand name like "digitalocean" or "nordvpn" is a strong signal in practice. A broad word like "cloud" or "server" in an otherwise ordinary provider's name is much weaker, and this row exists so you can tell those two apart.
Normal: a specific provider or VPN brand. Worth a second look: a broad word ("cloud", "host", "relay", "virtual", "google", "microsoft") inside the name of an otherwise ordinary provider, which is often an innocent match. The list is checked in the order it is written, so when two terms would match, the one listed first is shown.
IP address
The address being described, marked IPv4 or IPv6, and noted as your own where it is. Behind a VPN this is the address every website records instead of your real one.
Normal: the same address other sites report for you, or the VPN's address while it is on. Worth a second look: an address that differs from what your VPN app says, which may point to a leak or a different exit. A private address such as 192.168.x.x is not reachable from the public internet, so a lookup is unlikely to return network details for it.
Network operator and organisation
The company that operates the network, and the company the address range is registered to. On this tool both rows usually show the same name, because the network name comes from a single field; they differ only when ipwho.is supplied the record. Registry (whois) data can tell them apart, but this page does not query it.
Normal: both name your internet provider. Worth a second look: an operator you have no relationship with and no VPN to explain it.
AS number
The long-lived identifier of the network that announces this address to the rest of the internet. Names change and AS numbers rarely do, which makes this a reliable field to quote in an abuse report or a support ticket.
Normal: the same number each time you check from the same line. Worth a second look: a number that changes between checks without you switching network (VPN apps that rotate exits and roaming mobile connections both do this), or "Not available".
Location
Where the address is registered or routed, not where the hardware sits. For a home line it is usually right to the city or region. For a VPN exit it tells you where the server is, not where you are.
Normal: the right country and a city within reach of you. Country is usually reliable (MaxMind's accuracy page explains the limits). Worth a second look: the wrong country. A wrong city on its own is common and not a warning sign.
Time zone check
Shown only for your own address, because it needs both halves of a comparison: the zone your operating system reports and the zone the address maps to. Agreement means your connection leaves the internet roughly where you are. Disagreement means it does not, and this is the one check on the page that can catch a proxy whose network name gives nothing away. Different zone names with the same UTC offset count as agreement. On any other address there is nothing on your side to compare against, so the row is labelled simply Time zone and reports the zone that address maps to.
Normal: both zones agree, or differ in name but share an offset. Worth a second look: a mismatch when you use no VPN or proxy. Check your device clock first, since a recently travelled laptop shows the same result. The device zone comes from Intl.DateTimeFormat().resolvedOptions().
What this tool cannot tell you
• It cannot read the headers your browser sent. Classifying a proxy as transparent, anonymous or elite depends on headers such as Via and the Forwarded family, and only the receiving server sees those. JavaScript running in a page has no access to the headers of its own request, so a page claiming that classification is usually guessing.
• There is no risk score and no blacklist history. A number out of 100, or a claim about how long an address has been "flagged", needs a commercial abuse database behind it. This page has none, so it does not pretend to.
• A hosting network is not proof of a proxy. Cloud desktops, company networks, carrier-grade NAT and web crawlers all produce the same signal. The tool reports it and leaves the conclusion to you.
• The term list is short and the match is a plain text search. A loose word such as "host", "relay" or "google" can match an ordinary provider, and a VPN brand that is not on the list passes as a consumer network. Treat the matched term as evidence to weigh, not as a lookup in a complete database.
• It cannot separate a proxy from a VPN from a plain server. All three end at an address on a hosting network; the difference lies on your side of the connection, out of sight from here.
• It describes one address at one moment. Addresses change, VPN apps rotate exits, and mobile networks reassign constantly, so an older result may no longer hold.
What Does Each Status Actually Tell You?
The status line is the part people misread most often. A hosting result is not a confession and a consumer result is not a clean bill of health. The table sets the three outcomes side by side.
| Aspect | Hosting or proxy network | Consumer ISP network | Cannot be judged |
|---|---|---|---|
| What the tool saw | A term from its list in the operator, organisation or AS name | At least one name, and no term from the list in any of them | No usable name at all |
| What it often suggests | The traffic may leave from a rented server, as VPN and proxy exits do | An ordinary provider appears to own the address | Nothing either way |
| Other things it can mean | A cloud desktop, a company network, a crawler, or a provider with a loose word such as "cloud" in its name | A residential proxy, or a VPN whose name is not on the list, can look the same | A gap in the registry data, a very new range, or an address that is not public |
| Sensible next step | Read the matched term and AS number, and for your own address compare the time zone line | Check the time zone line, and run the VPN checker if you expect a VPN | Try again later, or use the IP lookup for the raw registration fields |
How the Proxy Verdict Is Calculated
The verdict on this page is decided by two separate pieces of logic, not one. The status line comes from a keyword scan of the network name. The time zone line comes from a comparison between your own device and the looked-up address, and it only runs when the address is yours. Everything below follows the order the code runs in.
First, the network name is cleaned before it is read
The lookup returns three name fields for the address: the operator (isp), the organisation the range is registered to (org), and the AS name. Before any of them is scanned, each passes through a filter that clears placeholder strings — Unknown ISP, Not available, Not found, N/A, None, null. Those are the absence of an answer, not an answer, and treating them as a name would misclassify an address the tool knows nothing about. After the filter, the surviving strings are joined into one lowercase block and scanned against a maintained list of hosting and proxy terms, in the order the list is written. The first term in the list that appears anywhere in the text is the one reported under Matched term, so when several terms would match, the one listed earlier is shown.
The list runs across several kinds of operator, which is why a match is evidence rather than proof: generic hosting words (hosting, cloud, server, vps, colocation), wholesale hosts (digitalocean, ovh, hetzner, leaseweb, m247, choopa), cloud platforms (aws, azure, google, oracle), consumer VPN brands (nordvpn, surfshark, mullvad, protonvpn, expressvpn), and Tor-specific names (tor exit, torservers).
Second, the status line takes exactly one of three values
- Hosting or proxy network — at least one name field survived the filter and a term from the list matched. The exact term is printed underneath so you can tell a decisive match like nordvpn from a loose one like server in an otherwise ordinary provider's name.
- Consumer ISP network — at least one name field survived the filter and nothing in it matched the list. This is a real negative from a real name.
- Cannot be judged — no operator, organisation or AS name survived the filter at all. There was nothing to scan, and the row says so instead of falling back to the second verdict. This third branch exists because a blank name would otherwise land in the "clean" bucket and be reported as a consumer connection when the tool in fact knows nothing about the network.
The time zone comparison, and why it takes two passes
That check runs only against your own address, because both values have to be available and only one of them is on your side. The device value is read from your operating system by Intl.DateTimeFormat().resolvedOptions().timeZone — a string like Asia/Dhaka — and it stays in the browser; nothing about your device is sent anywhere to make the comparison. The other value is the zone the looked-up address maps to, as returned by the lookup service.
The comparison happens in two passes, not one. If the two zone names are identical, they agree and the row is marked green. If the names differ, the page falls back to comparing UTC offsets before declaring a mismatch, because Europe/London and Europe/Dublin do not share a name but both sit at the same UTC offset all year, and treating that as disagreement would produce constant false alarms for anyone near a time zone border. Only when the offsets also differ does the row turn red. There are two further outcomes the row states plainly rather than forcing into an agree/disagree bucket: the address may report no zone, or the browser may not expose its own. Both read as a limitation, not a verdict. The offsets are read for today's date, so a zone that observes summer time can briefly differ from its usual offset.
Where the remaining rows come from
Everything else comes from one request to ip.myipshow.com, which combines Cloudflare Radar and ipwho.is behind the scenes (see About the data below). Field names are read in a fixed order so the same response always produces the same rows: country_name before country, isp before connection.isp before org. A bare AS number — the service sometimes returns just 9009, sometimes AS9009 — is normalised to the AS… form so both rows read the same whichever form arrived. The HTTP status is checked before the body is trusted, but the body is read either way, because the service answers 400 and 502 with a JSON message that explains what went wrong, and showing you that explanation is more useful than a generic connection error.
For comparison purposes, the VPN checker runs a narrower scan built specifically around naming the VPN provider, and the IP lookup returns the same underlying fields without the hosting verdict attached.
When Would You Use This Tool?
Confirming a VPN is on
Before signing in to anything sensitive, check that the address shown is the VPN's and not yours. A VPN that quietly dropped is a common cause of a leak.
Understanding a block
When a site refuses you with "proxy detected", this shows what it reacted to. Switching to another exit, or turning the VPN off, is usually the fix.
Checking a work laptop
Corporate machines often route everything through head office. An address belonging to your employer rather than your provider tells you that is happening.
Reviewing a suspicious signup
Paste an address from your logs. A datacenter range deserves more scrutiny than a residential one, though neither proves anything on its own.
Explaining odd prices
Travel and shopping sites price by location. Seeing which country your address maps to explains a figure that does not match what a friend sees.
Filing an abuse report
Copy the result into your complaint. The AS number and operator name are what the receiving network needs to find the customer behind the address.
How Does Each Proxy Type Look From the Outside?
"Proxy" covers several arrangements, and they do not all leave the same trace. The table below sets out what each one does with your traffic and how it tends to appear in a check like this. The last row is the usual exception: a residential proxy borrows a real home connection, so it tends to look like one.
| Type | What it forwards | Encrypts your traffic | How it often appears here |
|---|---|---|---|
| HTTP or HTTPS proxy | Web requests only, per application | Not by itself, beyond the site's own HTTPS | Hosting network, if the proxy runs on a rented server |
| SOCKS5 proxy | Any TCP connection, per application | Not by itself | Hosting network, same as above |
| Transparent proxy | Everything, inserted by the network you are on | Not by itself | Often hard to see: the address may still belong to the ISP |
| VPN | Everything the device sends | Yes, from your device to the VPN server | Hosting network, often a wholesale provider such as M247 |
| Tor | Everything routed through the Tor client | Yes, in layers across relays | Hosting network, and the network name sometimes contains a term such as "tor exit" or "relay" |
| Residential proxy | Traffic routed through a real home connection | Depends on the provider | Consumer ISP network, because the exit is a real home line |
How Do Proxy, VPN and Tor Differ?
The three words get used interchangeably, and the difference decides what you are protected against. A plain proxy forwards requests and nothing more, so the site sees the proxy while your own network can still see where you are going. A VPN encrypts everything leaving your device, so your provider generally sees only a tunnel to one server. Tor does the same across three relays, each knowing only its neighbours, which is designed so that no single relay sees both who you are and where you are going.
From the outside all three produce the same observable fact, which is why this page reports the fact rather than guessing the cause. If your question is whether an address belongs to a known VPN provider, the VPN checker is built around that and names the provider where it can. For the full registration and location detail on any address, including a map of the approximate coordinates, use the IP lookup.
About the data
Network and location details come from MyIPShow's own endpoint at ip.myipshow.com, a Cloudflare Worker. For an address you type, it asks Cloudflare Radar for the network owner, AS number and country and ipwho.is for city-level location, then merges the answers; if one has nothing, the other fills in where it can. For your own address it reads the data Cloudflare attaches to your connection, and asks ipwho.is only if that has no city. Results for typed addresses are cached by Cloudflare for up to six hours (thirty minutes when no city was found); your own address is not cached. If neither source answers, the tool shows its error message rather than guessing. The page itself keeps nothing except the recent checks list, which lives in your own browser and is deleted by the Clear button. The time zone comparison uses Intl.DateTimeFormat, which reads the setting from your operating system and sends it nowhere. Geolocation is an estimate; see the sources below for its limits.
What Other Tools Work With This One?
Sources and Further Reading
• RFC 7239, Forwarded HTTP Extension (IETF): defines the Forwarded header, notes that proxies may omit it, and warns that its contents cannot be relied on. It also explains how Via differs.
• Intl.DateTimeFormat.prototype.resolvedOptions() (MDN): the browser feature behind the device time zone in the time zone check.
• IP geolocation accuracy (MaxMind): a vendor's own account of why country-level results are far more reliable than city-level ones.
• RFC 5737, IPv4 Address Blocks Reserved for Documentation (IETF): the source of the example addresses used on this page.
Frequently Asked Questions
How can I tell whether I am behind a proxy?+
Load this page and read the two lines that describe your own connection. If the network operator is your internet provider and the time zones agree, nothing is in the way. If the operator is a hosting company, or the address maps to a country you are not in, your traffic is passing through something before it reaches the internet.
Why does a website say I am using a proxy when I am not?+
Because the same signal has innocent causes. Mobile carriers put thousands of customers behind shared addresses, some providers route through cloud infrastructure, and address ranges get resold, so a range that once belonged to a hosting company can end up serving homes. Checking the operator and AS number here tells you which side of that line your address falls on.
Can this tool tell the difference between a proxy and a VPN?+
No, and a page running in a browser generally cannot. Both end at a server that speaks to websites on your behalf, so both usually present an address on a hosting network. The difference is in how your traffic reaches that server, which happens on your side of the connection and leaves little or nothing a web page can inspect. For example, a browser-only SOCKS5 proxy and a device-wide VPN can show the same kind of hosting-network result here, even though only the VPN tunnels everything your device sends, and VPN vs Proxy: Which One Do You Actually Need? explains which suits which job.
Why is there no risk score or blacklist check?+
A score would need a commercial abuse database behind it, updated constantly and paid for by the query. This tool does not have one, and inventing a number would be worse than showing none. What it gives you instead is the raw evidence: the operator, the organisation, the AS number and the word that triggered the flag.
What does the time zone check actually prove?+
It compares where your computer thinks it is with where your address says it is. A mismatch means those two disagree, which is normal when a VPN or proxy is on and unusual otherwise. It is not proof: a traveller who never changed their laptop clock will show a mismatch with no proxy involved at all.
Is it legal to use a proxy or a VPN?+
In many countries using one is legal and routine, and companies rely on them every day. Some countries restrict or license VPN use, and using one to get around a service's regional rules can break that service's terms even where the tool itself is legal. The answer depends on where you are, so check your local rules. This is general information, not legal advice.
Can a website still see my real IP address if I use a proxy?+
A correctly configured proxy or VPN hides it, but leaks happen. A proxy set only in the browser leaves other applications connecting directly, a dropped VPN can fail open, and DNS requests sometimes escape the tunnel. Checking your address after connecting is the simplest way to confirm the setup is doing what you think it is. For example, run this check before and after connecting: if both show the same address, nothing is being hidden, and How to Hide Your IP Address (5 Real Methods Compared) compares ways to fix that.
Why does my address show a city I do not live in?+
IP geolocation is an estimate built from registration records and routing data, not a measurement. Providers often register a whole region to one city, and traffic can be routed through a hub some distance away. Country level accuracy is usually reliable; city level is frequently wrong by tens or even hundreds of kilometres.
How the Proxy Check Works
What it measures: Whether the network behind an address looks like a hosting, cloud or VPN operator rather than a consumer internet provider, and, for your own address, whether your device's time zone agrees with the one the address maps to.
What it is based on: A proxy or VPN replaces your visible address with the server's, so a check can only judge the address it sees. The network name is compared against a hand-kept list of hosting and VPN terms. IP location data, which MaxMind and APNIC describe as an estimate, shows the proxy server's place and not yours.
Limits of the result: A result is an indicator, not proof. A residential proxy borrows a real home connection and looks ordinary, a cloud desktop or company network can be flagged by mistake, and the check cannot read request headers such as Via or Forwarded.
Sources: MaxMind accuracy guide · APNIC geolocation study · RFC 7239 (Forwarded)
Last reviewed October 2026 · Editorial Policy · How our tools work
Comments:
Post a Comment