IP Fraud Detection API

Spot the fraud before it gets in, proxies, VPNs, TOR, bots and abuse history in a single 0–100 score.

Try it free from £0.02 per request, down to £0.01 at volume

What it checks

IP Fraud Detection looks at the network a submission came from and asks how risky it is. It detects anonymising infrastructure (proxies, VPNs, TOR), automated traffic (bots, scanners, crawlers), and history of abuse, then distils it into a single 0–100 fraud score alongside the underlying signals. It answers a question format and validity checks can't: does this submission look like it's trying to hide where it's really coming from?

What it returns

0–100 fraud score , a single overall risk read for the IP, higher means riskier
Proxy / VPN / TOR , anonymising network detection, including active-use flags
Bot status , whether the traffic looks automated rather than human
Recent / frequent abuse , whether the IP has a history of abusive behaviour
High-risk attacks , association with known attack activity
Security scanner / crawler , whether the IP is a scanner or crawler rather than a real user
Connection type , residential, mobile, corporate, hosting/data-centre and similar
ISP / organization / ASN , the network operator behind the IP
Device / browser / OS , the device, browser and operating system context where available

When to use it

At sign-up and checkout, to catch fraudulent or automated submissions before they create accounts or place orders.
On lead and form submissions, to score source quality and flag traffic hiding behind proxies or data-centre IPs.
Before crediting a free trial or promotion, where bots and repeat-abuse IPs drive most of the loss.
As a top-of-funnel screen ahead of heavier KYC or manual review, so you only escalate the submissions that warrant it.

When not to use it

As a sole basis for blocking a real customer, a VPN or corporate proxy is common for legitimate users, so weigh the score against your other signals.
As an identity check, the IP tells you about the connection, not who the person is. Pair it with breach, email and name checks.
For offline or batch records with no originating IP, this check needs the IP the submission actually came from.
To explain a single signal in isolation, read the 0–100 score together with the underlying flags rather than reacting to one alone.

How to read the result

Use the 0–100 score as your headline, then look at the underlying flags to decide how to act.

Low score, residential connection: Looks like a genuine user. Accept and proceed as normal.
Medium score, VPN or proxy: Common for privacy-conscious real users. Allow but consider a step-up (e.g. extra verification) for high-value actions.
High score, data-centre or TOR with abuse history: Strong fraud signal. Challenge, step-up or suppress depending on the risk of the action.
Bot / scanner flagged: Automated traffic, not a person. Block from account creation, promotions and anything you don't want scripted.

Pricing

from £0.02 per request, down to £0.01 at volume

Requests / month	Rate
0 – 10,000	£0.02
10,001 – 25,000	£0.017
25,001 – 50,000	£0.015
50,001 – 100,000	£0.013
100,001 – 300,000	£0.0125
300,001 – 500,000	£0.011
500,001+	£0.01

Prepaid balance, spent across any check. Each request is charged at the rate for the volume band reached, and earlier requests keep their lower rate. See full pricing.

Need custom pricing? pricing@provero.io

API & bulk usage

Run IP Fraud Detection in real time at the moment of submission, or in bulk to score historical traffic and find abusive sources. Call it on its own, or combine it with other checks in a single request and get every signal back in one response.

Read the API reference →

Request

{
  "ip": {
    "ip": "8.8.8.8"
  }
}

Response

{
  "ip": {
    "value": "8.8.8.8",
    "fraudScore": 0,
    "proxy": false,
    "vpn": false,
    "tor": false,
    "isCrawler": false,
    "connectionType": "Residential",
    "isp": "Fibre Assets",
    "countryCode": "GB",
    "city": "Sheffield",
    "region": "England"
  }
}

Common Questions

IP Fraud Detection FAQ

What does the fraud score actually mean?

It's a single 0–100 read on how risky the IP looks, combining proxy, VPN, TOR, bot and abuse signals. Higher means riskier. It's designed to be read alongside the underlying flags, not in isolation.

Will it flag every VPN as fraud?

No. VPNs and proxies are detected and contribute to the score, but plenty of legitimate users use them. The score weighs them with other signals so you can allow real users while catching genuine abuse.

Can it tell bots from real users?

Yes. It returns bot status and flags security scanners and crawlers, so you can keep automated traffic out of account creation, promotions and other sensitive actions.

Does it identify the person behind the IP?

No. It assesses the connection and network, not identity. For identity and provenance, combine it with breach detection, email verification and name validation.

How much does IP fraud detection cost?

It starts at £0.02 per request and steps down to £0.01 at volume on a prepaid, graduated balance, with free credits to run a real sample of your own data through every check.

Start with this check

Create a free account, claim your credits and run IP Fraud Detection as a real-time API or a bulk upload. No card required.