Ask any IP intelligence service whether an address is a VPN and you get a boolean. That answer is the industry standard, and it quietly discards the most important thing about the finding: how the service knows.
There are at least three ways to conclude an address is a VPN exit, and they are not equally true.
The first is that the provider publishes it. Several commercial VPN operators maintain a public list of their own relays, because their customers need it. An address on that list is an exit node in the same sense that a street address is on a street — the operator said so, and nobody is better placed to know.
The second is that the address sits in a block obviously full of such nodes. Providers do not rent single addresses; they take an allocation and light up hosts across it over time. When several published exits share a small block, the addresses between them are very probably part of the same pool. Probably is doing real work in that sentence, and it is a different claim from the first.
The third is that the address belongs to a network whose business is VPN hosting. This is true in aggregate and unreliable per address, because those same operators sell ordinary hosting to ordinary customers. A company running its API on a rented server can share an upstream with a hundred exit nodes and have nothing to do with any of them.
All three arrive at your integration as true.
The error is not symmetric
The reason this matters is that the two ways of being wrong cost different amounts.
Missing a VPN user costs you one detection. Someone who wanted to hide their location succeeded, and depending on what you are protecting that may be anywhere between irrelevant and expensive.
Blocking a real customer costs you the customer. They were not hiding anything. They were on a corporate network, or a mobile carrier that routes oddly, or a small ISP that buys transit from a company you have decided is suspicious. They do not know why your checkout rejected them, they cannot appeal a decision they were never told about, and the failure is invisible to you — it looks like a conversion that did not happen.
A product that reports all three grades of evidence as the same boolean is not neutral about that trade-off. It has made the choice for you, in the direction that generates the more expensive error, and it has removed the information you would need to decide differently.
What grading changes
The fix is not more data. It is refusing to round the confidence away.
If a finding carries the grade of evidence behind it, a caller can act proportionately: refuse outright on a published exit node, add friction on a probable one, and merely log a network-level guess. The same corpus supports a strict policy and a permissive one, because the strictness became the caller's decision rather than a property baked into the data.
It also changes what growing the corpus means. A service measured on coverage alone has an incentive to keep widening its definitions, because a broader rule always matches more addresses and the false positives it creates are somebody else's problem. Once evidence is graded, weak inferences can be added without being laundered into facts — coverage grows and accuracy does not have to be spent to buy it.
Questions worth asking a vendor
If you are buying IP intelligence, three questions separate the products quickly.
Where did this specific finding come from? Not the general list of sources — the provenance of this address. A vendor that cannot answer per-finding is aggregating things it cannot distinguish.
What happens when two sources disagree? Overlapping ranges are normal. Whether the better-evidenced one wins, or simply the last one written, decides how accurate the whole dataset is at the edges.
When does a finding expire? Exit nodes are decommissioned constantly and their addresses return to general circulation. A corpus that only accumulates turns every retired node into a permanent false positive against whoever inherits the address next.
None of those questions are about coverage, and all of them predict how often the product will be wrong about a person who is not doing anything.