IP Report
194.126.177.6
Proton AG · AS209103 · Frankfurt am Main (Innenstadt III), Germany
Score 45 of 100, in the low risk band. Bands run 0 to 19 minimal, 20 to 49 low, 50 to 79 medium, 80 to 100 high.
Its risk score of 45/100 is low-to-moderate: some signal is present, but on its own it would not justify blocking a visitor.
Detection signals
Not detected: Tor, Proxy, Crawler
Summary
194.126.177.6 is part of a VPN service's infrastructure. Visitors arriving from it are relaying their traffic through the service, so the address says where the tunnel ends, not where the person is.
The address is announced by Proton AG (AS209103) and geolocates to Frankfurt am Main (Innenstadt III), Hesse, Germany.
Why this address scores 45
It falls within IP ranges operated by VPN providers, so the address conceals where its traffic really originates.
It sits in datacenter address space, where automated traffic vastly outnumbers human visitors.
Individually these are weak signals; together they lift the score to 45/100, which is enough to be worth noting but not enough to act on by itself.
Observation history
This address has been looked up through Predax 2 times, first on September 6, 2026.
Each lookup re-evaluates the address against current feeds, so the classification above reflects its most recent check, not a stale record.
Network & location
- ASN
- AS209103
- Country
- Germany (DE)
- Provider
- Proton AG
- Region
- Hesse
- CIDR
- 194.126.177.0/24
- City
- Frankfurt am Main (Innenstadt III)
- Network type
- hosting
- First seen
- 9/6/2026, 3:32:07 PM
- Last seen
- 9/6/2026, 5:02:49 PM
- Times seen
- 2
What to do with this
If you run a site and this address showed up
Blocking VPN and proxy addresses outright also blocks real customers who use privacy tools every day.
If a visitor from this address disputes a block, look at what they did — the request pattern — rather than where they came from. Unblocking a disputed VPN address is usually the right call unless the behaviour itself was abusive.
If you found this address in your logs
The real client behind this address is elsewhere; geolocation and per-IP identity are both misleading for it.
Expect many unrelated users to share this address over time. Rate limits keyed on it will throttle strangers together, so prefer account- or token-level limits for anything that matters.
Loading map...
Detection sources
- VPNHigh · 85%
Commercial VPN provider's published ranges. Traffic from a VPN exit. Could be a privacy-conscious user, or an adversary using a VPN to evade rate limits — context matters.