Answer
Can Employers See Your IP Address When You Apply for a Job?
Published
Short answer: yes, and on two hiring systems widely used by US tech employers it is now documented. When an employer turns on Fraud Detection in Greenhouse, the system collects the IP address of each application and shows the recruiter a fraud report built from your address, email and phone number. Its documentation gives "an IP address linked to a data center rather than a residential location" as the example of a high risk signal. Ashby runs fraud checks on device, IP, email and phone as people apply, and since February 2026 it shows the recruiter the address itself. Neither system rejects anyone on its own. A person decides, with a warning icon next to your name.
So the connection you apply from is now part of the application. That is the practical answer to the VPN question too: a commercial VPN exits through a data center, which puts a real person on the same signal as a bot farm. Submit from a home line, a phone hotspot or ordinary Wi-Fi with the VPN off. ApplyLoop runs on your own Mac for this reason and sends 30 to 60 applications a day from the address you already have.
3
Kinds of signal in a Greenhouse fraud report: authentic, high risk, weak
5
Connection types its fraud vendor sorts an address into. Data center is one
10,532
IPv4 ranges AWS publishes as its own, on 30 September 2026
30 to 60
Applications a day ApplyLoop submits from your own home connection
What a fraud check sees, by how you connect
Seven ways an application reaches the form. The middle column is what the address is. The last column is what the documented checks can do with it.
| How you connect | The address they see | Signal it can raise |
|---|---|---|
| Home broadband | A residential line in your real city, on your real time zone. | Nothing from the address. This is the case the checks are built to pass. |
| Phone hotspot or mobile data | A mobile carrier address, shared with many other phones. | Mobile is its own connection type, separate from data center. The location can be coarse. |
| Cafe or library Wi-Fi, no VPN | The line the venue pays for, in the city you are sitting in. | Not a data center, so not the high risk example. The form is already encrypted by HTTPS. |
| Commercial VPN, exit in your own region | A server the VPN company rents in a data center. | The exact example Greenhouse gives for a high risk signal. |
| Commercial VPN, exit somewhere else | A data center server in a place you are not. | The high risk signal, plus a time zone that disagrees with your stated location. |
| Cloud apply bot | A rented server inside a cloud range the provider publishes. | The same high risk signal, on every application it sends for you. |
| ApplyLoop on your own Mac | Whatever your Mac is connected to. At home, that is your home line. | Nothing from the address, as long as your own VPN is off. |
What the hiring systems say in their own documentation
Greenhouse. Fraud Detection is part of its Real Talent suite, on the Plus and Pro tiers, and on Pro the report runs automatically. A third party service, IPQS, analyzes the phone number, email address, location and IP address, and returns the geolocation of the address, the organization that owns it and its connection type. The report sorts what it finds into three kinds: signals that the candidate looks authentic, such as an email address more than a year old, high risk signals, and weak ones, such as a time zone that does not match the reported location. A candidate with a high risk signal gets an icon next to their name, and a recruiter can tick a box to leave those candidates out of a search.
Ashby. It released fraud detection to all of its customers on 16 September 2025. Applicants are run through the checks as they apply, using signals related to device, IP, email and phone, and they land in one of two groups a recruiter can filter on: no fraud signals, or several. On 28 February 2026 it began showing the candidate IP address in the recruiter interface, where before it took a developer API call to see it.
The limits of what we know. Both vendors say a person makes the decision, and Greenhouse says in plain words that a fraud signal is not a definitive assessment. An employer has to switch the feature on, and nobody outside can see which employers have. We read these two vendors only. For any other hiring system this page makes no claim. And the address is one input among several: email age, phone type and device details are scored as well.
Should you use a VPN when applying for jobs?
Not for the submit step, for three reasons. One, the exit is a data center. A VPN company rents servers, and telling a rented server from a home line is a lookup. AWS alone publishes 10,532 IPv4 ranges as its own, fraud vendors sell a field that says whether an address belongs to a VPN or a hosting provider, and Cloudflare keeps a managed list of known VPN servers that a site can match in a single rule. Two, a far away exit adds a mismatch. An exit in another region gives your application a time zone that disagrees with the city on your resume. Three, the protection is already there. Application forms load over HTTPS, which encrypts what you type between your browser and the hiring system, so on cafe Wi-Fi the network owner learns which site you visited and not what you sent.
If you do not trust the network, use your phone as a hotspot, or save the application and submit it at home. If a VPN has to stay on, expect that a recruiter may ask where you are, and answer plainly: the guidance Greenhouse gives employers says weak signals are often explained by travel or remote work. What does not hold up is a VPN used to look like you are somewhere you are not. That is precisely the case this screening was built for. In January 2025 the FBI warned employers about North Korean IT workers getting hired remotely under false identities, and told them to verify identity during interviewing and onboarding. A real applicant behind a VPN is caught in a net meant for someone else.
Mac owners have one more case. With iCloud Private Relay on, an application filled in by hand in Safari arrives from an Apple relay address. Apple publishes those ranges, 285,179 of them on 30 September 2026, and keeps your region accurate by default. Whether a fraud vendor treats a relay address as ordinary or as anonymous is the vendor's call, and we have not tested it.
What we do about it, stated as a disclosure
We make one of the tools in the table above, so read this as an interested party. ApplyLoop installs on your own Mac and submits through Chrome on the connection the Mac already uses. From home, the address in the recruiter's fraud report is your home line, in your city, on your time zone. A cloud apply service cannot offer that, because its servers are the data center. The side by side is on cloud appliers compared with a local Mac.
Two things cut against the usual pitch, so here they are. ApplyLoop does not detect or switch off a VPN. If yours is on while it works, every application leaves through the VPN exit and the advantage is gone, so turn it off first. And a home address removes one signal, not all of them. A browser under automation has tells of its own, which we list layer by layer on how ATS bot detection works. What we control is pace and spread: 30 to 60 applications a day, never more than 3 to one company in 7 days, and a screenshot of every confirmation page. The per employer limit is explained on how many jobs to apply to per day.
Sources
- Greenhouse Support, Fraud Detection
Updated 20 August 2026, read 30 September 2026. Plus and Pro tiers, reports run automatically on Pro. A third party service analyzes phone number, email address, location and IP address. Three signal categories, with a data center address as the high risk example and a time zone mismatch as the weak one. Says the IP address is collected automatically for hosted job boards and embedded job posts.
- Greenhouse Support, Fraud Detection and Spam Blocklist: Security and Privacy FAQ
Updated 13 January 2026. Names IPQS as the vendor and lists what it returns: IP geolocation, IP organization, IP connection types, email and domain age, phone type and carrier. States that the feature makes no automated rejection decision, and describes the separate blocklist an employer can use to reject specific IP addresses at intake.
- Greenhouse Support, Operational readiness guide: Fraud Detection policy
Updated 12 February 2026. The guidance employers are given: investigate after the skills screen, remember that weak signals are often explained by travel or remote work, and ask the candidate a plain question such as their current time zone.
- Ashby, Introducing Fraudulent Candidate Detection and Management
16 September 2025. Released to all Ashby customers. Applicants are run through fraud checks as they apply, using signals related to device, IP, email and phone, and recruiters can filter on whether signals were found.
- Ashby, Candidate IP Address in Fraud Detection
28 February 2026. The candidate IP address is now displayed in the recruiter interface, in the fraud signal history for new applications.
- IPQS, Proxy detection API response parameters
The public documentation of the vendor Greenhouse names. An address is classified as Residential, Corporate, Education, Mobile or Data Center, and the VPN field is described as including data center ranges that can become active VPNs at any time.
- MaxMind, Anonymous IP database
A second, independent vendor selling the same distinction. Separate flags for an anonymous VPN provider, a hosting provider, a public proxy, a Tor exit node and a residential proxy.
- Cloudflare, Managed IP lists
Updated 16 April 2026. Cloudflare maintains a list of the IP addresses of known VPN servers that an Enterprise customer can match in a firewall rule, next to lists for anonymizers and open proxies.
- Amazon Web Services, public IP ranges
One file listing every range AWS owns: 10,532 IPv4 and 6,901 IPv6 prefixes when we counted on 30 September 2026. Telling a cloud server from a home line is a lookup against files like this one.
- Apple, Prepare your network or web server for iCloud Private Relay
Private Relay covers browsing in Safari, keeps the region of the relay address accurate, and publishes its egress ranges so a server can recognize them. The file held 285,179 ranges on 30 September 2026.
- FBI, North Korean IT Workers Conducting Data Extortion
Public service announcement I-012325-PSA, 23 January 2025. The reason this screening exists: the FBI tells employers to verify identity during interviewing and onboarding and to cross check applicants who share resume content or contact details.
Questions people ask
Can employers see your IP address when you apply for a job?+
Yes, on hiring systems that run fraud screening, and two widely used ones document it. When an employer turns on Fraud Detection in Greenhouse, the system collects the IP address of each application sent through its hosted job boards and embedded job posts, and a fraud report built from it appears on the candidate profile. Ashby runs fraud checks on device, IP, email and phone as people apply, and since February 2026 it shows the recruiter the address itself. Not every employer switches these features on, and an outsider cannot tell which ones have.
Should you use a VPN when applying for jobs?+
Not for the step where you press submit. A commercial VPN sends your traffic out through a server in a data center, and a data center address is the example Greenhouse gives for a high risk fraud signal. If the exit is in another region you add a second, weaker one: a time zone that disagrees with the location on your application. The thing a VPN is sold to protect is already covered, because application forms travel over HTTPS. Browse postings however you like, then turn the VPN off to submit.
Will a VPN get my application rejected automatically?+
Not by the fraud report itself. Greenhouse says its Fraud Detection feature makes no automated rejection decision and that signals are not a definitive assessment, and Ashby describes its recruiters deciding too. What a high risk signal does is put a warning icon next to your name and make you easy to filter out, since recruiters can exclude candidates with strong fraud signals from a search. Separately, a Greenhouse customer can keep its own blocklist that rejects applications from specific IP addresses at intake.
Can an employer tell where I am applying from?+
Roughly, yes. The vendor Greenhouse uses returns the geolocation, the organization and the connection type of the address, and Greenhouse lists a mismatch between device time zone and reported location as a weak signal. Its own guidance to employers says weak signals are often explained by travel or remote work and suggests simply asking the candidate. So an honest answer about where you are holds up. A location that your own connection contradicts is what the check exists to find.
Does iCloud Private Relay change what the employer sees?+
If you apply by hand in Safari with Private Relay on, the hiring system sees an Apple relay address in place of yours. Apple publishes those addresses in one file, 285,179 ranges on 30 September 2026, keeps your region accurate by default, and asks site owners to treat them like a shared carrier address. How a fraud vendor classes them is its own decision and we have not tested it. Private Relay covers Safari, so it does not apply to an application ApplyLoop submits through Chrome.
Is it risky to apply on public Wi-Fi without a VPN?+
Less than VPN advertising suggests. Application forms on the major hiring systems load over HTTPS, which encrypts what you type between your browser and the hiring system, so the network owner sees which site you visited and not your resume. If you do not trust the network at all, a phone hotspot gets you a mobile carrier address with no VPN in the path, or you can save the application and submit it from home.
Does ApplyLoop hide or change my IP address?+
No, and that is the design. ApplyLoop runs on your own Mac and submits through Chrome on whatever connection the Mac is using, so from home the employer sees your home line. It does not detect or switch off a VPN: if yours is on while ApplyLoop works, every application leaves through the VPN exit, so turn it off first. It paces 30 to 60 applications a day and never more than 3 to one company in 7 days.
Apply from the address you already have
ApplyLoop installs on your Mac, tailors every resume against the posting, and submits from your own connection. Every application comes back with a screenshot.
Get Started