IP Detection
IP detection API: VPN, proxy, Tor and datacenter in one lookup.
Every address gets one of nine network classes, a confidence score and the organization that owns it, plus geolocation and ASN in the same response. A datacenter is reported as a datacenter, not as a VPN.
- 9
- network classes returned
- 500
- addresses per bulk request
- 3,000
- free lookups a month
- 99.9%
- uptime target
Why it matters
A boolean is not an answer
Most detection APIs hand you one flag and leave you to guess what it meant. A cloud server, a corporate VPN and a Tor exit are not the same risk, and treating them as one number is how real users get blocked and real abuse gets through.
- A flag that says only true or false gives you nothing to write a rule against.
- Cloud and hosting ranges reported as VPN send legitimate server traffic into your block list.
- Residential proxies look like ordinary broadband unless something is watching the ranges.
- Without a confidence value you cannot tell a certain verdict from a guess.
How it works
Six sources, collapsed into one verdict per address
The same engine feeds Provenance and Agentscan, so all three agree on what an address is.
Harvested exit lists
VPN exit nodes and the Tor consensus are pulled on a schedule, so a new exit is known in hours rather than after a quarterly data drop.
Datacenter and hosting ranges
Aggregated cloud, hosting and colocation prefixes, kept separate from VPN ranges because they are a different kind of traffic.
Organization classifier
The owning organization from WHOIS and BGP data is matched against a table of known operators, so Comcast, Hetzner and Mullvad each land in the right class.
Scored IP state
Every observation about an address collapses into a single stored state with a score, which is what the API serves. Repeat lookups do not re-derive it.
Geolocation and ASN
City, country, coordinates, the autonomous system number and its name come back in the same response, so one call answers where and who.
Confidence and method
Each verdict says how sure it is and which evidence produced it, so you can set your own threshold instead of trusting ours.
Behind every address
One lookup, the whole story behind an IP
VPN, residential proxy, Tor, hosting or a plain home connection, with the network name and a risk score your rules can use.
Network classes
Nine classes, grouped four ways
The class is the string the API returns. Read it directly rather than mapping a boolean back to a guess.
- Clean residential
An ordinary broadband subscriber on a consumer ISP, with nothing between them and you.
- Mobile network
A carrier network where addresses rotate and are shared, so one bad session should not condemn the address.
- Datacenter or hosting
A server, not a person. Worth a second look on a signup form, but a normal origin for an API client. It sets anonymized to true unless it is known infrastructure, such as a public resolver.
- VPN, proxy, Tor or relay
The connection is masking where it really comes from. A private relay such as iCloud's still keeps the user's region.
API
One GET, or none at all.
The keyed endpoint returns the full verdict. The demo endpoint answers the same question without a key, so you can try it before you sign up.
curl -H 'Authorization: Bearer YOUR_API_KEY' \ 'https://ipscanner.io/v1/vpn/146.70.172.2'
The keyed endpoint returns the full verdict. No key yet? The demo endpoint answers the same question for any address:curl https://ipscanner.io/v1/demo/8.8.8.8
Check our work
Verdicts on addresses you already know
An accuracy percentage is unfalsifiable. These eight are not: you know what they are, so you can tell straight away whether the engine does.
- 8.8.8.8hostingGoogle
- 1.1.1.1hostingCloudflare
- 9.9.9.9hostingQuad9
- 52.0.0.1hostingAmazon
- 185.220.101.1torTor exit node
- 146.70.172.2vpnM247
- 73.0.0.1residential cleanComcast
- 172.58.0.1mobileT-Mobile
Public resolvers and cloud ranges come back as datacenter or hosting, never as vpn. That distinction is the whole point.
Use cases
Where the class does the work
Fraud and abuse scoring
Feed the class and the risk score into your own model instead of hard-coding a single vendor flag.
Geo and licensing rules
Enforce a territory knowing whether the location came from a clean residential line or through an exit node.
Signup and login risk
Step up verification for anonymized origins and leave everyone else alone, which is what keeps conversion intact.
Analytics hygiene
Strip datacenter and bot traffic out of your numbers so the funnel you are optimizing is made of people.
FAQ
Questions, answered
Ship IP Detection this week
One REST call, a free tier to start, and the same engine behind every IPScanner lookup.
No credit card to start