A website says I’m using a VPN but I’m not: how sites classify IP addresses
Sites don’t see your device. They see an address, and they compare it with lists. Some of those lists are public, so you can check them yourself.
On this page
Sites decide from the address you connect from. Some inputs are public: the Tor exit list, Apple’s iCloud Private Relay egress list, and the address ranges cloud providers publish. Others are private vendor data about VPN exits and shared addresses. If your address is on a public list you can see why; if it isn’t, the label usually comes from a vendor, and your ISP or that vendor is who can change it.
What a site can actually see
When you open a page, the site receives the public IP address your traffic leaves from, plus whatever your browser sends. It cannot see whether a VPN app is installed. So “you are using a VPN” really means “this address looks like one we treat as a VPN”. Each vendor keeps its exact rules private, but several of the inputs are published openly.
The public lists
| List | Who publishes it | What it means if you are on it |
|---|---|---|
| Tor exit addresses | The Tor Project publishes a bulk list of current exit relays[1] | Your traffic leaves through Tor, or your address was recently a Tor exit |
| iCloud Private Relay egress ranges | Apple publishes them as a CSV and documents them for site operators[2] | Private Relay is on in Safari or your Apple device |
| Cloud and hosting ranges | Providers such as AWS publish their address ranges as JSON[3] | Your traffic leaves from a data centre, as it does with most VPNs and many proxies |
Apple is explicit about how it hopes sites treat its relays: “Consider treating these addresses like larger carrier-grade NAT or enterprise IP addresses”, because many users may share one relay address, and the address still represents the user’s coarse region.[2] Whether a given site follows that advice is up to the site.
The private signals
Commercial databases add their own judgement on top: addresses they have seen used by VPN services, ranges registered to hosting companies, and addresses with an unusual number of users behind them. That last one can catch ordinary homes. Under carrier-grade NAT, many customers share one public address through the RFC 6598 shared range on the provider side,[4] and a shared address can inherit a reputation from someone else.
How to tell which applies to you
- Turn off every relay you know about. VPN apps, browser VPN extensions, iCloud Private Relay, work device profiles.
- Check your address against the public lists. If you are on the Tor, Private Relay or cloud list, that is the reason, and turning the relay off is the fix.
- Look at your network type. If sources report your ISP as a hosting company, or place you in another country, the label probably comes from a vendor’s range data.
- Check for shared addressing. If your router’s WAN address starts with 100.64 through 100.127, you are behind carrier-grade NAT.
See which flags apply
The Truth Check tests your address against the Tor, Private Relay and cloud-range lists and shows the network type each source reports.
Open the Truth CheckWho can change it
- You, when a relay is on: turn it off for that site.
- Your ISP, when the range is shared or mislabelled: they can confirm how the range is used, publish a correct geofeed and talk to the service. Netflix’s own help for its VPN message ends with “contact your ISP” for this reason.[5]
- The site, for one stubborn service: support can see which rule fired, which no outside tool can.
Sources
- Tor bulk exit list · The Tor ProjectChecked 5 Oct 2026
- Prepare your network or web server for iCloud Private Relay · Apple DeveloperChecked 5 Oct 2026
- AWS IP address ranges · Amazon Web ServicesChecked 5 Oct 2026
- RFC 6598: IANA-Reserved IPv4 Prefix for Shared Address Space (Apr 2012) · IETF / RFC EditorChecked 5 Oct 2026
- Netflix says, “You seem to be using a VPN or proxy.” · Netflix Help CenterChecked 5 Oct 2026