Proxies, VPNs and Tor all exist to make a connection look like it's coming from somewhere it isn't. One GET request tells you which kind of anonymity network an IP belongs to, whether it looks actively in use right now rather than just registered to a provider, and the hosting range behind it — so you can allow, challenge or block with actual evidence instead of a guess.
proxy
Whether the address is a known proxy server rather than a residential or business connection.
vpn, active_vpn
Whether the address belongs to a VPN provider's range, and separately, whether a VPN tunnel looks actively in use on it right now rather than simply registered to one.
tor, active_tor
Tor exit-node membership, and whether the address is currently routing live Tor traffic.
bot_status
Whether the traffic pattern looks automated rather than human — VPN-hopping and credential-stuffing tools often show up here too.
ISP, organization, ASN
The ISP, organisation and autonomous system behind the address. Datacentre and hosting ranges, rather than a home or mobile ISP, are one of the strongest tells that a connection isn't what it appears to be.
fraud_score
A single 0–100 score that folds every signal above into one number you can threshold on.
GET /api/v1/check?ip=198.51.100.42
request.sh
curl -H "Authorization: Bearer fn_your_key" \ "https://fraudnova.com/api/v1/check?ip=198.51.100.42"
response.json
{
"success": true,
"data": {
"fraud_score": 82,
"proxy": true,
"vpn": true,
"active_vpn": true,
"tor": false,
"active_tor": false,
"bot_status": false,
"country_code": "NL",
"ISP": "Example VPN Provider",
"ASN": 64501
},
"credits_remaining": 4986
}
Streaming rights, regional pricing and export-controlled content all depend on where a visitor really is. A VPN or proxy flag on the connecting IP is your cue to re-check location claims before serving territory-locked content.
Someone burning through your free tier over and over looks like a fresh signup each time — until you notice every one arrives through a different VPN exit IP. Flag active_vpn plus a high score at registration and route it to review or a stricter verification step.
Clicks and impressions arriving from hosting-provider ranges rather than home or mobile ISPs rarely convert. The ISP/organization/ASN fields let you separate real audience traffic from bot farms and click services running out of a datacentre.
Score any IPv4 or IPv6 address for fraud risk in one request.
Catch disposable, undeliverable and leaked addresses before they cost you.
Flag VOIP and prepaid lines before you spend on SMS verification.
25 free credits after you verify your email. No card, no subscription.
Create a free account