IP screening can identify whether an IP address is associated with a VPN and/or hosting infrastructure. These are separate signals and should not be interpreted as dependent on each other.

VPN

VPN = True indicates that the IP address has been identified as being used as a VPN exit point. This means the user’s original IP address and potentially their actual location may be obscured.

A VPN does not necessarily indicate suspicious activity. Legitimate examples include corporate VPNs, privacy services, and other network configurations.

Hosting

Hosting = True indicates that the IP address is associated with hosting, cloud, or data center infrastructure rather than a typical residential or mobile network.

Hosting traffic can be completely legitimate, particularly for API traffic, automated services, or corporate infrastructure. However, it may be less expected in certain end-user activities, such as a consumer completing a KYC flow.

How the signals can be combined

Importantly, VPN = True does not require Hosting = True. For example, a VPN may operate using an IP address associated with an ISP (Internet Service Provider) rather than a hosting provider.

Risk interpretation

Neither VPN nor Hosting should generally be treated as evidence of suspicious activity on its own. Instead, they can be used as risk indicators in combination with other information.

For example, greater scrutiny may be appropriate when VPN or hosting usage occurs together with other signals such as an unexpected IP country, unusual activity, or inconsistencies with KYC information.

The appropriate risk weighting ultimately depends on the use case and the expected behaviour of the customer or user being screened.