Know what is behind every request.
One call tells you whether a connection is hiding where it comes from, and whether the caller is a person, a verified crawler or an AI agent.
30,000 lookups a month on the free plan. No card.
GET /v1/demo/172.58.0.1
Every address here is real and the endpoint needs no key, so you can run the same call and read the same classes.
One engine, read three ways
The hard part is spotting connections that hide where they really come from: commercial VPNs, residential proxies, rented datacenter ranges, Tor. We built the engine that does that, and the three products are three readings of the same state.
Collectors
VPN, Tor, proxy and hosting range feeds, harvested on a schedule.
IP state
Everything observed about an address collapses into one scored record.
Verdict
A class and a confidence, served to all three products in milliseconds.
IP Detection
Is this connection hiding where it comes from?
Send an address and get back the kind of network behind it: a home ISP, a mobile carrier, a datacenter, a commercial VPN, a residential proxy or a Tor exit. Geolocation, ASN and WHOIS come back in the same call, with a 0 to 100 risk score and a confidence you can set a threshold on.
See IP DetectionA commercial VPN exit. The true origin is hidden.
Agentscan
A person, a crawler, or something wearing their clothes?
A user agent is a string anyone can send, so Agentscan does not take it at face value. It reads the origin of the request, the JA4 TLS fingerprint and the tells a headless browser leaves behind, then checks self-declared crawlers against reverse DNS and the ranges their operators publish. One of four classes comes back, with the action to take.
See AgentscanA person in a real browser. A human on a VPN is still a human, so origin alone never convicts.
A crawler that identified itself and passed verification, so the identity is not just a claimed user agent.
Automation that names itself, or an AI fetcher. Not hostile, but not a person either.
Automation with no good identity. Headless tells, a masked origin, or both.
The crawler directory holds 153 AI agent tokens. Each one is checked against what its operator publishes, not against what the request claims.
Provenance
Can you prove where someone was, months later?
Provenance runs the same origin check, applies the rule for the jurisdiction the user claims to be in, and seals the result into a hash-chained audit log. Every entry carries the hash of the one before it, so an edited or deleted record shows up as a broken link instead of quietly vanishing.
See Provenance- Allowattestation 80421
entry a41f8c2e · prev 9c02b7d1
- Step upattestation 80420
entry 9c02b7d1 · prev 71bd0a56
- Blockattestation 80419
entry 71bd0a56 · prev 00000000
Every check is sealed as it happens and exports as signed evidence for whatever date range you are asked for.
Three calls, one key
The first one needs no key at all. Paste it into a terminal and compare the answer with what your current tool says.
Read the API referencecurl https://ipscanner.io/v1/demo/8.8.8.8
{ "target": { "ip": "8.8.8.8", "kind": "ip" }, "verdict": { "classification": "datacenter", "anonymized": false, "confidence": 0.99 }, "isVpn": false, "isProxy": false, "isTor": false, "provider": "GOOGLE", "riskScore": 60, "geo": { "country": "US" }, "asn": { "number": 15169, "name": "GOOGLE" } }
8.8.8.8 is Google's public resolver. It sits in a datacenter and it is not an anonymizer, so isVpn stays false.
Seven addresses you can check yourself
An accuracy percentage is easy to print and impossible to verify from outside. Here are addresses anyone can look up instead, including the two that plenty of detection tools report as VPNs and should not.
| Address | Class | Network |
|---|---|---|
| 8.8.8.8 | Datacenter | |
| 1.1.1.1 | Datacenter | Cloudflare |
| 185.220.101.1 | Tor | Tor exit node |
| 146.70.0.1 | VPN | M247 Europe SRL |
| 73.0.0.1 | Clean residential | Comcast |
| 172.58.0.1 | Mobile | T-Mobile |
| 52.0.0.1 | Hosting | Amazon |
8.8.8.8 and 1.1.1.1 are public DNS resolvers in a datacenter. Reporting them as VPN exits is the kind of mistake that teaches a fraud team to stop trusting the score.
Start free, pay when the volume is real
One account covers all three products, and each one meters on its own, so a heavy month of bot checks does not eat into your lookups.
- Free
$0 / mo
30,000 lookups a month
- Starter
$29 / mo
50,000 lookups a month
- Pro
$99 / mo
500,000 lookups a month
- Business
$299 / mo
2,000,000 lookups a month
No card to start.
See full pricingTerms and questions
Questions
- By checking the address against the networks VPNs actually run on. Commercial VPN providers rent ranges from hosting companies, so the address resolves to a data centre rather than a residential ISP. IPScanner combines that ownership signal with routing behaviour and known-provider ranges, then returns a confidence score instead of a yes or no.
- Yes, but not from the user agent. An agent can send any string it likes. Agentscan fuses the IP origin with headless-browser tells, the JA4 TLS fingerprint and a reverse-DNS verified allowlist, and returns one of four verdicts: human, known_bot, ai_agent or malicious_automation.
- Country level is reliable. City level is usually within 25 to 100 km and gets worse on mobile networks, where one gateway can serve a whole region. Treat city as a signal, not a fact, which is why every response carries a confidence score.
- An IP address is personal data under the GDPR, so you need a lawful basis. Fraud prevention and network security are recognised legitimate interests under Recital 49. IPScanner processes lookups on your behalf as a processor, and the Privacy Policy sets out what is retained.
- Each product bills on its own meter. IP Detection starts free with 30,000 lookups a month, about 1,000 a day, Agentscan is free up to 5,000 checks a month, and paid plans run from $29. Prices are charged in your local currency where we support it.
Terms
- VPN Detection
- Spots IP addresses that route through an encrypted VPN tunnel to hide a user's real location.
- Proxy Detection
- Flags HTTP, SOCKS, public, residential, and data-center proxies that relay traffic through a middleman.
- Tor Detection
- Recognizes Tor exit nodes, the last relay before anonymized Tor traffic returns to the open internet.
- IP Geolocation
- Maps an IP to a country, region, and city, with ISP and timezone data, usually within 25 to 100 km.
- ASN Data
- Returns the Autonomous System Number and the organization that owns and routes a block of addresses.
- WHOIS Lookup
- Pulls registration and ownership records for domains and IP ranges.
- AI agent
- Software that browses on a person’s behalf. It arrives with a real browser fingerprint, so the user agent alone will not identify it.
Get a key and make your first call in a minute
The free plan covers 30,000 lookups a month, about 1,000 a day. No card, and your key is on screen as soon as you sign up.
Already have an account? Sign in