Every address gets one of eight network classes, a confidence score and the organization that owns it, plus geolocation and ASN in the same response. A datacenter is reported as a datacenter, not as a VPN.
request
curl -H "Authorization: Bearer $IPS_KEY" \ https://ipscanner.io/v1/vpn/146.70.0.1 # No key yet? The demo endpoint needs none: curl https://ipscanner.io/v1/demo/146.70.0.1
response
{
"ip": "146.70.0.1",
"isVpn": true,
"isTor": false,
"networkClass": "vpn",
"anonymized": true,
"provider": "M247 Europe SRL",
"riskScore": 90
}Most detection APIs hand you one flag and leave you to guess what it meant. A cloud server, a corporate VPN and a Tor exit are not the same risk, and treating them as one number is how real users get blocked and real abuse gets through.
The same engine feeds Provenance and Agentscan, so all three agree on what an address is.
VPN exit nodes and the Tor consensus are pulled on a schedule, so a new exit is known in hours rather than after a quarterly data drop.
Aggregated cloud, hosting and colocation prefixes, kept separate from VPN ranges because they are a different kind of traffic.
The owning organization from WHOIS and BGP data is matched against a table of known operators, so Comcast, Hetzner and Mullvad each land in the right class.
Every observation about an address collapses into a single stored state with a score, which is what the API serves. Repeat lookups do not re-derive it.
City, country, coordinates, the autonomous system number and its name come back in the same response, so one call answers where and who.
Each verdict says how sure it is and which evidence produced it, so you can set your own threshold instead of trusting ours.
The class is the string the API returns. Read it directly rather than mapping a boolean back to a guess.
An ordinary broadband subscriber on a consumer ISP, with nothing between them and you.
A carrier network where addresses rotate and are shared, so one bad session should not condemn the address.
A server, not a person. Worth a second look on a signup form, but a normal origin for an API client.
The connection is masking where it really comes from. This is the group that sets anonymized to true.
The keyed endpoint returns the full verdict. The demo endpoint answers the same question without a key, so you can try it before you sign up.
request
curl -H "Authorization: Bearer $IPS_KEY" \ https://ipscanner.io/v1/vpn/146.70.0.1 # No key yet? The demo endpoint needs none: curl https://ipscanner.io/v1/demo/146.70.0.1
response
{
"ip": "146.70.0.1",
"isVpn": true,
"isTor": false,
"networkClass": "vpn",
"anonymized": true,
"provider": "M247 Europe SRL",
"riskScore": 90
}An accuracy percentage is unfalsifiable. These eight are not: you know what they are, so you can tell straight away whether the engine does.
Public resolvers and cloud ranges come back as datacenter or hosting, never as vpn. That distinction is the whole point.
Feed the class and the risk score into your own model instead of hard-coding a single vendor flag.
Enforce a territory knowing whether the location came from a clean residential line or through an exit node.
Step up verification for anonymized origins and leave everyone else alone, which is what keeps conversion intact.
Strip datacenter and bot traffic out of your numbers so the funnel you are optimizing is made of people.