Catch checkout fraud without turning shoppers away
Plenty of shoppers use a VPN for privacy. Card testers, coupon farms and resale bots come through proxy pools and hosting servers instead. One lookup at checkout tells them apart.
- Residential ProxyHoldOrder #10482198.51.100.17
- ISPHome broadbandApproveOrder #10483203.0.113.8
- HostingAWSRefuseOrder #10484192.0.2.66
- VPNSurfsharkAsk for 3-D SecureOrder #10485203.0.113.52
What it stops
Card testing
Bots trying stolen cards through proxy pools, so each attempt looks like a new shopper.
Caught byis_resproxyis_dcproxyCoupon abuse
One person opening account after account from new VPN exits to reuse a first-order discount.
Caught byis_vpnis_resproxyResale bots
Limited drops bought out by bots on residential and datacenter proxies.
Caught byis_dcproxyis_resproxyChargebacks
Orders placed behind a proxy, later disputed as unauthorized.
Caught byis_resproxyis_tor
The fields that decide it
The four a rule here reads most, each marked with the plan that answers it.
is_resproxySeen in a residential proxy pool, with how many days of the last 90.Paid plansis_dcproxyAn address a datacenter proxy service sells.Paid plansis_hostingA hosting server, where checkout bots run.Paid plansis_vpnA commercial VPN: worth a second check rather than a refusal.Unlimited
Where to check
- 01
At checkout
Look up the address before you capture payment. Approve an ordinary address, ask a VPN for 3-D Secure, and hold a residential proxy or a hosting server for review, so a real shopper on a VPN still gets through.
- 02
At sign-up
Check new accounts where coupon farms open them. A first-order discount claimed from a proxy or a hosting address can wait for a card, or for a person to look.
- 03
On limited drops
Gate the queue for a limited release before a bot reaches it. Resale bots run on datacenter and residential proxies, which every paid plan flags, with when each address was last seen.
Start free, then add every field
The same rule runs with no key and with one. Without a key the paid fields are left out of the answer, so the second check waits for your upgrade.
- 1
Call it with no key
UnlimitedThe snippet runs as it is: the VPN, Tor and relay flags, the location and the network, with no daily or monthly cap.
- 2
Sign up for a key
No cardYour account's first 100 lookups each day answer every field, so you can try the paid half of the rule on real traffic.
- 3
Upgrade for every lookup
From $19 a monthEvery paid plan answers every field on every lookup, proxies, hosting and the operator behind each flag, and up to 1,000 addresses a batch.
import { VPNDetection } from "vpndetection";// No key needed. With one, every field answers.const client = new VPNDetection({ apiKey: process.env.VPNDETECTION_API_KEY });export async function beforeCapture(order) {const r = await client.lookup(order.ip);// Proxies and hosting answer on a paid plan.if (r.isResproxy || (r.isHosting && !r.isRelay)) {return holdForReview(order);}if (r.isVpn) {return requireThreeDSecure(order);}}
Common questions
Should I block every VPN at checkout?
Usually not, since plenty of shoppers use one for privacy. Ask a VPN for 3-D Secure, and keep refusals for residential proxies and hosting servers, where card testers and bots run.
Does it work with my store?
Any store that can make an HTTP request before it takes payment: a check is one GET per order. There's middleware for Express, Next.js, Django, Laravel, Rails and ten more frameworks, and a WordPress plugin.
How fresh is the proxy data?
Every dataset rebuilds daily. A residential proxy's evidence covers a rolling 90 days, and last_seen says the last day the address was in a pool, so a rule can act on recent sightings alone.
Will a lookup slow checkout down?
A check is a single GET, and the official clients keep each answer for an hour by default, so a returning shopper costs no extra lookup. Start it while the shopper types their card details and it's back before they pay.
What does it cost at our volume?
The VPN flag is free with no cap. Every paid plan answers every field, from Starter at $19 a month for 250,000 lookups to Max at $199 for 5,000,000, and Enterprise is priced to your volume.
Unlimited lookups, no sign-up.
Paste it into a terminal. Any address answers its VPN, Tor and relay flags, where it is and which network announces it, with no daily or monthly cap.
{"ip": "146.70.116.130","is_vpn": true,"is_relay": false,"is_tor": false,"location": {"country": "AT", ...},"asn": { "asn": 9009, ... }}