Skip to content

Anonymizer/VPN/Proxy IP Detected

The domain's IP is associated with anonymization services such as VPN providers, Tor exit nodes, or proxy networks.

See verdicts firing this signalOpen in API reference
Analyst Q&A

What this signal answers

The questions every analyst asks before acting on this signal.

What it detects01

What does 'Anonymizer IP Detected' mean?

The domain's IP is associated with anonymization services such as VPN providers, Tor exit nodes, or proxy networks.

Why it matters02

Is anonymizer usage always malicious?

No. But combined with other malicious signals it significantly increases the probability of malicious intent.

How analysts use it03

How should SOC teams act on this signal?

Use it as a supporting indicator in correlation analysis.

Often paired with:alert_only
Evidence shape

What Anonymizer/VPN/Proxy IP Detected looks like in the response

A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.

json
{
  "slug": "ip_anonymizer_usage",
  "name": "Anonymizer/VPN/Proxy IP Detected",
  "group": "threat_intelligence_feed",
  "subgroup": "ip_blacklist_reputation",
  "direction": "malicious",
  "evidence": {
    "blacklist_count": 7,
    "listing_sources": [
      "spamhaus",
      "abuseipdb",
      "uribl"
    ],
    "first_listed_days_ago": 3,
    "last_listed_days_ago": 0
  }
}
See in API reference
Siblings

Peers in IP Blacklist & Reputation

6 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.

Fast Emerging Blacklist IP

It indicates that the IP was listed on blacklist feeds very shortly after the IP block or infrastructure was registered …

MaliciousCore
High-Risk Blacklist Sources

It means the IP address appears in at least one threat intelligence blacklist, indicating it has been associated with su…

MaliciousCore
IP Blacklisted Recently (High Freshness)

It means the IP has appeared in one or more threat intelligence blacklist datasets, indicating that it has been associat…

Malicious
Known Organization IP Block

The domain's IP belongs to a registered ISP or organization block listed in threat intelligence feeds under the 'organiz…

Safe
Show 2 more in IP Blacklist & Reputation
In the wild

See Anonymizer/VPN/Proxy IP Detected fire on real IOCs

The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.

Open Verdict Gallery
Pre-filtered to Anonymizer/VPN/Proxy IP Detected. See real IOCs this signal caught and the verdicts the engine returned.
Verdicts ✓

Latest reports carrying this signal

Start free, in five minutes

1,000 verdicts/month on the free tier, LLM layer included. No card required.

Get an API keyBack to IP Blacklist & Reputation