How reliable are VPN, proxy, hosting and Tor classifications?¶

Classification services describe how an address is commonly used or labelled in a database. They are useful signals, not proof of what happened in one event.

The short version¶

A classification suggests a line of enquiry; it does not establish the route, user or purpose of the connection.

Why classifications differ¶

Services may use different:

• data sources;
• update schedules;
• definitions;
• historical coverage;
• confidence thresholds; and
• treatment of shared or changing infrastructure.

One service may call an address hosting, another may call it a proxy, and a third may return no label.

What to compare¶

Record the address, service, date, exact result and confidence information. Compare classifications with:

• registration and routing;
• the destination service's own records;
• provider responses;
• account and session evidence; and
• the event time.

Safe conclusion¶

A database classified the address as hosting infrastructure on the date checked. That classification helps identify the next record holder; it does not prove who used the address or why.