Browser Extension

The VPNDetection extension looks up the IP addresses on the pages you already work in: an alert in your SIEM, a ticket, an abuse report, a log line someone pasted into a chat. Select an address and it tells you whether it's a VPN, a proxy, a Tor exit or a hosting provider's, with the country it's in and the network that announces it.

Add it to Chrome from the Chrome Web Store.

Look up an address

Select an IP address, right-click it and point to VPNDetection: IP address lookup, where Chrome puts the extension's two items. Look up "…" on VPNDetection opens the answer over the page: a sentence saying what the address is, a pill for each detection, the country with its flag and local time, and the network that announces it. Open "…" on vpndetection.io opens the address's full report in a new tab, which is also one click from any answer.

Alt+Shift+V does the same without the menu. The extension's settings choose whether the shortcut opens the answer over the page or the full report, and Chrome's own shortcuts page, chrome://extensions/shortcuts, changes the keys.

It reads an address the way logs and tickets write it: with a port (203.0.113.5:443, [2001:db8::1]:443), in brackets, or defanged as 203.0.113[.]5, 203.0.113(dot)5 or 2001:db8[:]:1. A selection holding several addresses answers each one, up to 10.

The extension's toolbar button opens a search box for an address you type, and under it the answer for your own connection.

Without an account, and signed in

Without an account, on the Unlimited tier, each answer says whether the address is a VPN, a Tor node or a relay, where it is and which network announces it, with no daily limit. Sign in and the extension looks up with one of your organization's API keys: on a paid plan every answer carries every field, and an account on no paid plan tries them, 100 lookups a day. Pricing lists the plans.

Click Sign in in the toolbar popup or in the extension's settings. Chrome opens a sign-in window on vpndetection.io, so the extension never sees your password. Sign in, pick which API key the extension uses and approve, and the window closes itself. Approving needs permission to share your organization's API keys: signed in without it, lookups answer as they do without an account.

Sign out from the avatar menu in the toolbar popup, or disconnect the extension from the console under Settings > Sessions & devices > Connected applications. The extension checks once a day that its sign-in still stands, so a disconnect reaches it within a day. Neither changes the key itself, which stays valid until you rotate it: rotate it in the console if the browser it was shared with is lost.

Page marks

Turn on Mark the addresses on every page in the extension's settings and every IP address on the pages you visit is underlined. Rest the pointer on one to look it up. Chrome asks for access to the pages you visit when you turn it on, and nothing else in the extension asks for it. The addresses are found in the page itself, and one leaves the page only when you rest the pointer on it. Defanged addresses aren't marked: select them instead.

The toolbar popup has a switch for the site you're on, which takes effect at once on its open tabs. The settings list each site you turned off, to mark it again.

What it asks for

What leaves the page is the address you look up, sent to the VPNDetection API with the name of the store the extension came from, and your API key once you're signed in. The API keeps a record of each lookup to meter your plan, support you and investigate abuse, as our privacy policy says, and we don't sell it. Answers are kept for an hour, or until the browser closes, so looking an address up again within the hour costs no lookup.

When a lookup doesn't answer

The same lookups from a terminal: CLI. From an AI assistant: MCP Server.