How to Identify If an IP is using Custom DNS service like google or Cloud flare

  1. What is the Indication that the IP is from a custom DNS
  2. How can I identify if an IP is from a VPS or VPN service

Sorry for the late reply.

What is the Indication that the IP is from a custom DNS

To find out the IP addresses of DNS resolvers:

{
  "ip": "1.1.1.1",
  "hostname": "one.one.one.one", <-----------------------
  "city": "Brisbane",
  "region": "Queensland",
  "country": "AU",
  "loc": "-27.4820,153.0136",
  "org": "AS13335 Cloudflare, Inc.",
  "postal": "4101",
  "timezone": "Australia/Brisbane",
  "anycast": true <----------------------
}
{
  "ip": "9.9.9.9",
  "hostname": "dns9.quad9.net", <-----------------------
  "city": "Zürich",
  "region": "Zurich",
  "country": "CH",
  "loc": "47.3789,8.5204",
  "org": "AS19281 Quad9",
  "postal": "8004",
  "timezone": "Europe/Zurich",
  "anycast": true <----------------------
}
{
  "ip": "208.67.222.222",
  "hostname": "dns.opendns.com", <-------------------
  "city": "Wright City",
  "region": "Missouri",
  "country": "US",
  "loc": "38.8276,-91.0201",
  "org": "AS36692 Cisco OpenDNS, LLC",
  "postal": "63390",
  "timezone": "America/Chicago",
  "anycast": true <----------------------
}

If it is a DNS resolver, it will likely have the DNS keyword in the hostname and it will be an anycast IP address. You can check out RDNS database for a comprehensive list of hostnames: Snowflake

How can I identify if an IP is from a VPS or VPN service

You can checkout our IP to Privacy data for
that.

The VPN IP address will be marked as "vpn": true and the hosting IP addresses will have "hosting": true.