Know where your customers really connect from
A country check trusts the address it's given, and a VPN or a proxy puts a customer in a country they're not in. Look up the address at onboarding, log-in and payout, and send the masked ones to further checks.
- VPNProton VPNExtra verificationApplicant A-1093203.0.113.61
- ISPHome broadbandAllowedLog-in, J. Moreno198.51.100.23
- TorHeldPayout, account 7731192.0.2.201
- Datacenter ProxyBlockedLog-in, account 2210192.0.2.33
What it stops
Sanctions evasion
A customer in a restricted country who looks local through a VPN, which a country check alone misses.
Caught byis_vpnlocation.countryFake applicants
Synthetic identities opened in bulk from proxy pools and hosting servers.
Caught byis_resproxyis_hostingAccount takeover
Stolen log-ins tried from residential proxies, so each attempt looks like a home user.
Caught byis_resproxyis_torBonus abuse
Sign-up and referral rewards claimed again and again from new VPN exits.
Caught byis_vpnis_dcproxy
The fields that decide it
The four a rule here reads most, each marked with the plan that answers it.
location.countryThe address's country. On a VPN exit, it's the VPN's country, not the customer's.Unlimitedis_vpnA commercial VPN. A paid plan names which one.Unlimitedis_relayiCloud Private Relay or a company gateway such as Zscaler, kept apart from VPNs.Unlimitedis_resproxyA home connection resold as a proxy, which hides a log-in among real users.Paid plans
Where to check
- 01
Onboarding
Look up the address before KYC trusts the country on the application. A VPN or a proxy there goes to document checks or a manual review, and an ordinary address goes straight through.
- 02
Log-in
Step up a log-in that comes through a residential proxy, a datacenter proxy or Tor, with a one-time code or a device check. Account takeover runs through proxy pools so that each try looks like a home user.
- 03
Payouts
Hold a withdrawal, or a change of payout details, sent from an anonymizer until someone looks at it. It's the last point before money leaves, and the cheapest place to be sure.
Start free, then add every field
The same rule runs with no key and with one. Without a key the paid fields are left out of the answer, so the second check waits for your upgrade.
- 1
Call it with no key
UnlimitedThe snippet runs as it is: the VPN, Tor and relay flags, the location and the network, with no daily or monthly cap.
- 2
Sign up for a key
No cardYour account's first 100 lookups each day answer every field, so you can try the paid half of the rule on real traffic.
- 3
Upgrade for every lookup
From $19 a monthEvery paid plan answers every field on every lookup, proxies, hosting and the operator behind each flag, and up to 1,000 addresses a batch.
import { VPNDetection } from "vpndetection";// No key needed. With one, every field answers.const client = new VPNDetection({ apiKey: process.env.VPNDETECTION_API_KEY });export async function screenApplicant(applicant) {const r = await client.lookup(applicant.ip);if (r.isVpn || r.isTor) {return requireDocumentCheck(applicant);}// Proxies and hosting answer on a paid plan.if (r.isResproxy || r.isDcproxy) {return sendToReview(applicant, r);}}
Common questions
Can this be our sanctions control?
Not on its own. It tells you when an address hides its country, which is a reason to check further: keep your sanctions screening, and treat a masked address as unverified.
Will customers on iCloud Private Relay be flagged as VPNs?
No. Private relays and company gateways such as Zscaler come back as is_relay, apart from is_vpn, so a rule can let them through or ask a little more of them.
Do you keep the addresses we look up?
Each request is recorded with its time, the address looked up and the key that sent it, and kept for 13 months for billing questions, support and abuse investigation. We don't build profiles from lookups or add them to our datasets.
Can we run lookups inside our own network?
Yes. The databases are licensed per dataset, bundled with Enterprise plans, and download daily as CSVGZ, and MMDB where one is built, so lookups never leave your servers.
Is there an SLA?
Enterprise contracts carry agreed response times and a named contact. Live availability is on the status page, and the official clients retry a server error for you.
Unlimited lookups, no sign-up.
Paste it into a terminal. Any address answers its VPN, Tor and relay flags, where it is and which network announces it, with no daily or monthly cap.
{"ip": "146.70.116.130","is_vpn": true,"is_relay": false,"is_tor": false,"location": {"country": "AT", ...},"asn": { "asn": 9009, ... }}