Stop paying for clicks no person made
Bots run on hosting servers and hide in residential proxy pools. Look up the address behind each click, install or lead, and keep invalid traffic out of your invoices and your reports.
- HostingGoogle CloudInvalidClick, ad 3391192.0.2.10
- ISPHome broadbandValidClick, ad 3391198.51.100.212
- Residential ProxyInvalidInstall, app 72203.0.113.33
- VPNSurfsharkReviewLead, offer 18203.0.113.98
What it stops
Click fraud
Bots clicking ads from hosting servers to drain a budget.
Caught byis_hostingis_dcproxyFake installs and leads
Affiliate conversions sent through proxy pools, each made to look like a new user.
Caught byis_resproxyis_mobproxyGeo fraud
Traffic sold as one country and delivered from VPN exits elsewhere.
Caught byis_vpnlocation.countryPadded reports
Impressions from data centers counted as audience.
Caught byis_hostingasn.type
The fields that decide it
The four a rule here reads most, each marked with the plan that answers it.
is_hostingTraffic from a hosting or cloud server, not a person's device, unless it's also a relay.Paid plansis_resproxyA home connection resold as a proxy, where bots pass for real users.Paid plansis_vpnA commercial VPN, which hides the visitor's real country.Unlimitedlocation.countryThe country, to hold a campaign to its targeting.Unlimited
Where to check
- 01
On each click
Look up the address behind a click before it's billed or counted. Clicks from hosting servers and proxy pools go to an invalid bucket, and an ordinary address counts as normal.
- 02
On each conversion
Check an install, sign-up or lead before an affiliate is paid. One from a residential proxy or a VPN goes to review, where a pattern across one affiliate's traffic shows.
- 03
In bulk
Send up to 1,000 addresses a call to POST /batch on a paid plan, or load the databases into your own pipeline. Either way, last month's traffic is scored before its invoice is paid.
Start free, then add every field
The same rule runs with no key and with one. Without a key the paid fields are left out of the answer, so the second check waits for your upgrade.
- 1
Call it with no key
UnlimitedThe snippet runs as it is: the VPN, Tor and relay flags, the location and the network, with no daily or monthly cap.
- 2
Sign up for a key
No cardYour account's first 100 lookups each day answer every field, so you can try the paid half of the rule on real traffic.
- 3
Upgrade for every lookup
From $19 a monthEvery paid plan answers every field on every lookup, proxies, hosting and the operator behind each flag, and up to 1,000 addresses a batch.
import { VPNDetection } from "vpndetection";// No key needed. With one, every field answers.const client = new VPNDetection({ apiKey: process.env.VPNDETECTION_API_KEY });export async function scoreClick(click) {const r = await client.lookup(click.ip);// Proxies and hosting answer on a paid plan.if ((r.isHosting && !r.isRelay) || r.isResproxy) {return markInvalid(click);}if (r.isVpn || r.isTor) {return sendToReview(click);}}
Common questions
Can it score traffic in bulk?
Yes: POST /batch takes up to 1,000 addresses a call on a paid plan, each costing what its single lookup costs. For real-time bidding, the databases download as MMDB for lookups on your own servers.
Is all hosting traffic invalid?
Not all of it. Privacy relays and company gateways run in data centers too, so many of their addresses are is_hosting as well as is_relay, and a person is behind each. Let is_relay through before you mark hosting traffic invalid.
Does it tell a VPN visitor's real country?
No. It says the address is a VPN, so the country it gives is the VPN's. Treat that traffic as outside a campaign's targeting.
How fresh is the data?
Every dataset rebuilds daily. A proxy's evidence covers a rolling 90 days, and last_seen says the last day the address was seen in a pool.
What does it cost?
The VPN flag and the country are free with no cap. Every paid plan answers every field, from Starter at $19 a month for 250,000 lookups to Max at $199 for 5,000,000, and Enterprise is priced to your volume.
Unlimited lookups, no sign-up.
Paste it into a terminal. Any address answers its VPN, Tor and relay flags, where it is and which network announces it, with no daily or monthly cap.
{"ip": "146.70.116.130","is_vpn": true,"is_relay": false,"is_tor": false,"location": {"country": "AT", ...},"asn": { "asn": 9009, ... }}