vpn detection api: real‑time IP Lookup for fraud prevention

Why real‑time IP checks matter

Fraudsters often mask themselves behind VPNs, proxies, or the Tor network. When a user logs in or submits a transaction, you need to know if the IP is a clean residential address or a suspicious relay. If you can detect that quickly, you can throttle, ask for additional verification, or reject the request outright.

Geoverio’s IP Lookup module at a glance

One API key covers all modules, so you don’t add a separate key for this call.
Free tier gives you up to 1,000 requests per month, enough for low‑volume sites or testing.
Predictable pricing: $0.005 per request after the free tier.
Docs are plain and to the point; no fluff.

Endpoint and parameters

The core call is https://api.geoverio.com/v1/ip/lookup. It expects a single query string:

ip=203.0.113.45

That’s all you need to start. The response returns a JSON blob with several flags and a risk score.

Response payload explained

{
  "ip": "203.0.113.45",
  "location": {"country":"US","region":"CA","city":"San Diego"},
  "network": {"owner":"Google Cloud","asn":12345},
  "proxy": true,
  "tor": false,
  "vpn": true,
  "risk_score": 78
}

proxy – true if the IP belongs to a known proxy service.
vpn – true if the IP is a VPN exit node.
tor – true if the IP is a Tor relay or exit node.
risk_score – an aggregated metric (0‑100) that considers proxy, VPN, Tor, and other risk factors. Higher means more suspicious.

Integrating into a workflow

Below is a minimal Node.js example that demonstrates how to call the API and act on the response. The logic is easily ported to any language.

const fetch = require('node-fetch');
const API_KEY = 'YOUR_API_KEY';
async function checkIp(ip) {
  const res = await fetch(`https://api.geoverio.com/v1/ip/lookup?ip=${ip}&api_key=${API_KEY}`);
  if (!res.ok) throw new Error('API error');
  const data = await res.json();
  return data;
}

async function handleLogin(request) {
  const ip = request.ip;
  const result = await checkIp(ip);
  if (result.vpn || result.proxy || result.tor || result.risk_score > 70) {
    // Flag for 2FA or block
    request.flag = 'suspected';
  }
}

Notice the API key is passed as a query parameter. In production you might prefer an Authorization header for added security, but the key is short and safe as a query string for most use cases.

Performance considerations

The endpoint responds in under 50 ms on average. That latency is negligible for a login flow. If you need to process many IPs per second, the free tier will quickly hit the limit, so plan to use the paid plan or cache results locally.

Caching strategy

Store the response in Redis keyed by IP for 24 hours.
For known residential ranges, cache longer.
Invalidate cache after any change in risk policy.

Limitations to be aware of

The risk score is an aggregate. It may not perfectly match your internal risk model.
VPN and proxy detection rely on public databases. New exit nodes can appear before they’re catalogued.
Tor detection is only for exit nodes; hidden services are not covered.

Combining with other Geoverio modules

Once you have the IP context, you can enrich the user profile further. For example:

Use sales_tax_finder to determine tax applicability.
Leverage address_autocomplete to validate shipping addresses.
Invoke payroll to calculate employee net pay, useful for internal audits.

All these calls use the same API key, so billing stays predictable.

Putting it all together

A realistic fraud‑prevention pipeline might look like this:

User submits credentials.
Fetch IP info via IP Lookup.
If proxy or vpn is true, prompt for 2FA.
Check risk_score and compare to threshold.
If below threshold, proceed. If above, block or require additional verification.
Record all data in your audit logs for later analysis.

Because the call is atomic and the response small, the overhead on your server is minimal. You can also batch multiple IP checks in a single HTTP request if you build a small wrapper service.

Getting started

Sign up at geoverio.com. The free tier lets you experiment with up to 1,000 requests per month. If you hit the limit, upgrade in minutes and continue without interruption.

Documentation is available under the “Developer” section. The API reference lists all fields, sample requests, and error codes. Reach out to support if you need help tuning your risk thresholds.

With Geoverio’s IP Lookup, you can add reliable VPN, proxy, and Tor detection to your security stack without reinventing the wheel.