IP fraud detection API

Assess the risk signals associated with an IP address.

Return a fraud score alongside available proxy, VPN, Tor and abuse indicators for your own decision rules.

Part of: Form verification Affiliate fraud detection Source audit Account protection

Try it free See a sample response From £0.02 per request, down to £0.01 at volume.

What it checks

You send the IP address a sign-up, order or form submission came from. Provero checks it against IP risk intelligence and returns a fraud score with the indicators behind it.

The result describes the connection: whether the address is associated with a proxy, VPN or the Tor network, whether it has recent abuse reports, whether the traffic pattern looks automated, and which network and organisation it belongs to. You decide what each signal means for the action in front of you.

You can also send the client's user agent string and language. The user agent adds device, browser and operating system context and is used in the bot assessment for the IP and user agent combination. Without it, the device fields have nothing to work from.

What it returns

Every response includes the fraud score, the proxy, VPN and Tor flags and the network owner. Other fields are returned when the data is available for that address.

Fraud score

An integer indicating the relative level of risk for the IP. A higher score means more risk indicators. It is not a probability that a particular customer is committing fraud.
Anonymised connections

Proxy, VPN and Tor flags, with active VPN and active Tor indicators where the data shows the endpoint is currently in use.
Abuse history

Recent abuse reports, frequent abuser and high-risk attack indicators, and an abuse velocity measure where available.
Automation indicators

Bot status for the IP and user agent combination, plus crawler and security scanner classifications where detected.
Network details

ISP, organisation, ASN and host name, with connection type, mobile network, shared connection, dynamic connection and trusted network indicators where available.
Device and location context

Operating system, browser, device brand and model inferred from the user agent you supply. Country, region, city, postcode and time zone associated with the IP.

Some fields depend on the data access on your account. When a field is not available, it can return null, N/A or a placeholder such as "Premium required." Treat these as unknown, not as a negative result.

IP signals in identity and fraud reviews

An IP result describes the connection, not the person. See how connection signals sit alongside identity data checks in KYC, IDV and fraud workflows.

KYC, IDV and fraud

When to use it

Sign-up and checkout

Check the submitting IP before an account is created or an order is accepted, and route higher-risk connections to extra verification.
Lead and form submissions

Flag leads submitted through anonymised or abuse-linked connections, so they can be reviewed before they are sold or contacted.
Free trials and promotions

Review sign-ups from connections with abuse history or automation indicators before credits, discounts or rewards are granted.
Reviewing historical traffic

Upload a file of IP addresses from past sign-ups or lead batches to see which sources carry anonymiser or abuse indicators.

See how IP checks expose fake affiliate leads

How to read the result

Result	What it indicates	What to consider
Fraud score	What it indicates: The relative risk of the connection, based on the indicators available for that IP.	What to consider: Set your own score bands from your traffic and the value of the action. A score that warrants review at payout may be acceptable for a newsletter sign-up.
VPN or proxy	What it indicates: The connection is routed through an intermediary. Many legitimate users use VPNs for privacy, and corporate networks often use proxies.	What to consider: Read it with the score and abuse indicators. For a high-value action, consider a step-up check rather than a block.
Tor or abuse history	What it indicates: The address is a Tor node or has been reported for abuse.	What to consider: A stronger reason for extra checks or manual review, depending on what the submission can do.
Bot, crawler or scanner	What it indicates: The IP and user agent combination looks automated, or the address is classified as a crawler or scanner.	What to consider: Treat it as an automation indicator. The absence of a bot flag does not prove a human is present, so keep your other controls in place.
No risk indicators	What it indicates: Nothing in the available data flags the connection.	What to consider: Proceed as your rules allow. A clean connection does not establish who the person is or that the submission is genuine.

Provero returns the indicators. The thresholds and actions are yours to set for each workflow.

API & bulk usage

Call the API at the moment of submission, using the IP address the request came from. To review existing data, upload a file of IP addresses through the bulk uploader and download the results.

ip is required. user_agent and user_language are optional.
Send the user agent from the same request as the IP if you want device and browser context.
To run IP fraud detection with other checks in one call, use Multi-validation with an ip block.

Example request and response

POST https://api.provero.io/api/fraud-check/ip

Request

{
  "ip": "203.0.113.42",
  "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
  "user_language": "en"
}

Response

{
  "message": "IP fraud check passed",
  "result": {
    "value": "203.0.113.42",
    "fraudScore": 88,
    "proxy": true,
    "vpn": true,
    "tor": false,
    "activeVpn": true,
    "activeTor": false,
    "recentAbuse": true,
    "botStatus": false,
    "isp": "Example Hosting Ltd",
    "organization": "Example Hosting Ltd",
    "asn": "64500",
    "countryCode": "NL",
    "city": "Amsterdam",
    "region": "North Holland",
    "connectionType": "Premium required.",
    "mobile": false,
    "operatingSystem": "Mac 10.15",
    "browser": "Chrome 136.0",
    "deviceBrand": "Apple"
  }
}

Illustrative example using a documentation IP address. The values are not a real result, and the response is shortened: the full response includes further fields, some of which return null or a placeholder when the data is not available. "IP fraud check passed" means the check completed, not that the IP passed a risk threshold.

View the IP fraud detection API documentation

Pricing

IP fraud detection starts at £0.02 per request and reduces to £0.01 at volume.

View tiers

Requests / month	Rate
0 – 10,000	£0.02
10,001 – 25,000	£0.017
25,001 – 50,000	£0.015
50,001 – 100,000	£0.013
100,001 – 300,000	£0.0125
300,001 – 500,000	£0.011
500,001+	£0.01

Paid from a prepaid balance that you can spend across any check. See current rates.

Need volume pricing? Email pricing@provero.io.

Related checks

No single check settles whether a record can be trusted. These are the ones people usually run alongside IP fraud detection, each answering a different question about the same record.

See every Provero check →

IP fraud detection FAQ

What does the fraud score mean?

It indicates the relative level of risk for the IP address, based on the indicators available for it. A higher score means more risk. It describes the connection, so it is not a probability that a particular customer is fraudulent. Read it with the individual flags and set your own bands for each workflow.

Will every VPN be treated as fraud?

No. VPN and proxy use is flagged and contributes to the score, but many legitimate users connect through VPNs and corporate proxies. Decide how to handle them based on the other indicators and what the submission can do, for example by adding a step-up check for high-value actions.

Which outputs are available?

Every response includes the fraud score, proxy, VPN and Tor flags, ISP, organisation, ASN and country code. Abuse, automation, connection type and location detail are returned where available, and some depend on your account's data access. Device, browser and operating system fields need the user agent string in the request.

Can it tell bots from real users?

It flags IP and user agent combinations that look automated, along with known crawlers and security scanners. These are indicators rather than proof, and the absence of a flag does not prove a human is present, so keep rate limiting and your other controls in place.

Can I check IP addresses in bulk?

Yes. Upload a file of IP addresses through the bulk uploader to review historical sign-ups or lead batches, then download the results. Use the API for checks at the moment of submission.

Does it identify the person behind the IP?

No. It assesses the connection and the network, not identity. If your process needs identity corroboration, that is a separate check, such as Mobile network KYC, which compares supplied details with mobile-network records.

How much does IP fraud detection cost?

It starts at £0.02 per request and reduces to £0.01 at volume on a prepaid, graduated balance. Free account registration includes credits so you can test it with your own data.

Start with this check

Create a free account, claim your credits and run IP fraud detection through the API or bulk upload. No card required.