Proxy, VPN, and Tor evidence without an abuse shortcut.

Which proxy or Tor evidence is actually covered for this address?

Inspect the named anonymity sources and their supported classes. A published Tor exit is distinct from a non-exit relay; a PUB-only proxy dataset miss does not exclude VPN or residential-proxy services.

Source availability depends on the current deployment and each returned record. These review dates do not establish when a particular IP was observed. Method axis-scope-2026-09-15 · Score ipjury-score-v3.

Proxy, VPN, Tor, privacy relay, and residential proxy are transport facts. They describe how traffic reached you, not whether the person sending it did anything wrong.

Direct evidence versus inference

The gap between "we can see this" and "this pattern usually means that" is the most important distinction on this axis, when reading this axis. IPJury identifies the named source and the scope of a returned finding.

Direct evidence

The operator publishes the fact. The Tor Project maintains a public list of exit addresses, and relay and privacy-relay providers publish the ranges they egress from. When an address appears on such a list, the finding is a lookup, not a guess.

Dataset evidence

A licensed dataset asserts that a specific address was observed operating as a proxy or VPN endpoint. A real observation by a party that saw something — but second-hand, with an age, and with a collection method usually not fully disclosed.

Inference

Nobody observed this address doing anything. A classifier reasoned from the network it sits in, from what its neighbours do, or from naming conventions. Legitimate context, and a poor basis for a decision on its own.

These do not average. An address on the published Tor exit list is a confirmed Tor exit. An address that merely sits in an ASN where VPN providers rent capacity is exactly that, and calling it a proxy finding is how a self-hosted mail server ends up labelled as anonymity infrastructure.

What this deployment can and cannot report

The anonymity axis currently reports proxy, Tor and privacy-relay evidence. A VPN-only classification and a residential-proxy classification are withheld, where the deployed sources do not support their public use. IP2Proxy LITE covers open/public proxies (PUB); a miss cannot exclude a VPN or residential-proxy service. Dataset scope and permission withholding are distinct limitations, neither of which is a negative observation. It is also why a clean result here reads "no direct anonymity evidence" over the signals that were actually assessable, and never as "no VPN".

Why a VPN finding is not an abuse finding

Anonymity and abuse are separate axes because they answer separate questions, and evidence on one carries no weight on the other. Commercial VPNs are used by journalists, remote employees under corporate policy, travellers on hotel Wi-Fi, and people who do not want their ISP building a browsing profile. Tor is used for censorship circumvention and for research. A confirmed anonymity finding tells a site operator something they may want to act on — rate limits, extra verification, a policy on relayed sign-ups — but it is not a record that anything happened.

The reverse also holds. An address with no returned anonymity evidence can still carry a direct abuse record. The result must be read from that separate evidence axis, not inferred from its network type.

The limits of detection

Absence of an anonymity flag proves very little, and this is the honest weak point of every tool in this category.

• Private endpoints cannot be reliably excluded here. A private VPN on a rented machine may have no entry in the covered lists. Missing published evidence does not prove that the machine is not forwarding traffic.
• Residential role does not rule out proxy use. Traffic may be forwarded through subscriber space. A network-role label cannot certify the particular connection, consent, household or exclusivity.
• Lists lag. New exit capacity appears before any dataset records it, and decommissioned ranges keep their labels after the service moves on.
• Address-family coverage varies. Read the source’s returned abstentions and withheld fields. Missing IPv6 data must not be treated as a confident negative finding.

Coverage and abstention

"No direct anonymity evidence observed" means the sources that responded held no such evidence. It is not a statement that the address is not a proxy, and IPJury will not restate it as one. When a source times out, is disabled by licence, or cannot answer for this address family, it abstains, and the abstention appears in the coverage axis so the denominator behind the finding stays visible.

For how anonymity evidence interacts with the network an address sits in, see the network role guide.