See when a visitor is hiding behind a VPN, proxy, or anonymized IP.
Geolocation, ASN, and WHOIS come back in the same call, with a read on how risky the connection looks.
What do you want to detect?
Select all that apply
Please click to select services above.
One detection engine. Three products.
The hard part is spotting connections that hide where they really come from: VPNs, residential proxies, datacenters, and Tor. We built the engine that does it, then shipped three ways to use it.
IP Detection
The detection API that tells you whether a connection is masking its true origin.
- VPN, proxy, Tor and datacenter
- Geolocation, ASN and WHOIS
- One REST call, free tier
Provenance
Compliance-grade location attestation with a tamper-proof audit log.
- VPN, proxy and Tor origin detection
- Per-jurisdiction policy for Utah, the UK and the EU
- Tamper-evident audit log with evidence export
Agentscan
Tells humans, known bots, AI agents, and malicious automation apart in one request.
- Human, bot and AI-agent verdicts
- Verified Googlebot and a managed allowlist
- JA4 and headless tells, under 50ms cached
The shared engine behind all three
Collectors
VPN, Tor, proxy and range feeds harvested on a schedule
IP State
Observations collapsed into one scored verdict per IP
Verdict
Served to every product in milliseconds
What IPScanner Tells You About an IP
IPScanner checks an IP address and reports whether it routes through a VPN, proxy, or Tor exit node. For any IPv4 or IPv6 address it also returns geolocation, ASN data, and WHOIS details, plus a risk score that pulls those signals together. The verdict comes back fast enough to act on while a login or checkout is still in progress.
What Each Lookup Means
VPN Detection
Spots IP addresses that route through an encrypted VPN tunnel to hide a user's real location.
Proxy Detection
Flags HTTP, SOCKS, public, residential, and data-center proxies that relay traffic through a middleman.
Tor Detection
Recognizes Tor exit nodes, the last relay before anonymized Tor traffic returns to the open internet.
IP Geolocation
Maps an IP to a country, region, and city, with ISP and timezone data, usually within 25 to 100 km.
ASN Data
Returns the Autonomous System Number and the organization that owns and routes a block of addresses.
WHOIS Lookup
Pulls registration and ownership records for domains and IP ranges.
Who Uses It, and What For
An IP check is the network-layer piece of your defenses. It sits next to your firewall, EDR, and SIEM and stops bad traffic before it reaches an account.
Fraud Prevention
Block fake signups, chargebacks, and stolen-credential purchases that hide behind masked IPs.
Account Security
Catch account takeovers by spotting logins from unexpected VPNs, proxies, or new locations.
Bot & Abuse Defense
Stop scrapers, credential-stuffing, and trial abuse routed through data-center and proxy IPs.
Geo Compliance & Licensing
Enforce regional restrictions and confirm a user's true location where the rules require it.
Common Questions
What is IPScanner?
IPScanner checks an IP address and tells you whether it belongs to a VPN, proxy, Tor exit node, or another anonymizing service. The same lookup returns geolocation, ASN data, WHOIS records, and a risk score for any IPv4 or IPv6 address, all through one API.
What is the difference between a VPN and a proxy?
A VPN (Virtual Private Network) encrypts all of a device's traffic and routes it through a remote server, hiding both the data and the real IP address at the operating-system level. A proxy only reroutes traffic for a specific application or protocol (such as HTTP or SOCKS) and usually does not encrypt it. Both hide a user's real IP, which is why fraud and security teams watch for both.
How accurate is IPScanner detection?
It depends on what you are looking at. Data-center IPs, commercial VPNs, and Tor exit nodes are easy to spot, and we catch the large majority of them. Residential proxies are far harder because they ride real consumer connections, so we treat them as a risk signal rather than a hard yes or no. Every verdict ships with a confidence score, so you set the threshold that fits your tolerance.
Is there a free IP lookup API?
Yes. The free plan lets you wire VPN detection, proxy detection, geolocation, and ASN lookups into your app before you pay anything.
What can businesses use IP detection for?
Common uses are fraud prevention, account-takeover protection, free-trial and promo-abuse mitigation, bot detection, content-licensing and geographic compliance, and risk scoring across logins, signups, and payments.
Is IPScanner a cybersecurity tool?
Yes, though it works at a different layer than most. Endpoint, firewall, and email tools watch the device and the inbox. IPScanner watches the connection: it flags VPNs, proxies, Tor exit nodes, and high-risk IPs so your fraud and security teams can decide what to trust, all from one API.