Product · Privacy, Anonymity & Threat Intelligence
Explainable VPN, proxy, Tor, and residential relay detection with reason codes
Detect commercial VPN exits, open SOCKS/HTTP proxies, Tor exit relays, datacenter hosting proxies, and high-velocity scanners with deterministic evidence codes you can log and audit.
Anonymizer classes9 typesVPN, proxy, Tor, private relay & more
Evidence codesDeterministicreason_codes array on every match
Abuse velocity0 to 100Active honeypot & scanner scoring
False-positive SLA< 24h reviewDirect POST /v1/feedback pipeline
anonymity family
Four boolean flags plus specific anonymizer_type and reason_codes
Opaque risk scores make it impossible to explain why a legitimate customer was challenged. ipscope pairs calibrated confidence scores with explicit boolean flags and machine-readable reason_codes.
- is_vpn: Active commercial or self-hosted VPN exit nodes verified via WireGuard, OpenVPN, and IKEv2 handshakes.
- is_tor_exit: Synchronized hourly against the active Tor exit consensus.
- is_proxy & is_hosting: Open proxies, residential proxy relays, and cloud/VPS ranges.
- anonymizer_type: Distinguishes consumer privacy relays (private_relay) from high-risk anonymizers.
{
"security": {
"is_vpn": true,
"is_hosting": true,
"is_tor_exit": false,
"is_proxy": false,
"anonymizer_type": "vpn",
"confidence": 0.96,
"reason_codes": [
"vpn_handshake_confirmed",
"datacenter_asn_range"
]
}
}security_extensions family
Honeypot abuse velocity and internet-wide scanner recency
For fraud engines, WAF rules, and SIEM enrichment pipelines that need active threat telemetry beyond static anonymizer lists, security_extensions tracks live hostile traffic observations.
- abuse_velocity_score: Normalized 0 to 100 score derived from credential-stuffing and darknet honeypot hits.
- is_known_scanner: Flags addresses actively sweeping TCP/UDP ports across our sensor network.
- observation_recency_hours: Hours elapsed since the most recent confirmed anonymizer or scanner packet.
{
"security_extensions": {
"abuse_velocity_score": 84,
"is_known_scanner": true,
"observation_recency_hours": 2
}
}Security & threat intelligence fields
Fields returned in security and security_extensions.
| Field | Type | Family | Description |
|---|---|---|---|
| security.is_vpn | boolean | anonymity | True when the IP is an active commercial or self-hosted VPN exit node. |
| security.is_tor_exit | boolean | anonymity | True when listed in the active Tor exit relay consensus. |
| security.is_proxy | boolean | anonymity | True for open HTTP/SOCKS proxies and residential proxy relays. |
| security.is_hosting | boolean | hosting | True when routed by a cloud, VPS, or colocation provider ASN. |
| security.anonymizer_type | string | anonymity | vpn, proxy, tor_exit, tor_relay, hosting_proxy, apple_private_relay, or none. |
| security.reason_codes | string[] | anonymity | Deterministic evidence codes (e.g. vpn_handshake_confirmed). |
| security_extensions.abuse_velocity_score | number | null | security_extensions | Normalized 0 to 100 abuse velocity score. |
| security_extensions.is_known_scanner | boolean | null | security_extensions | True when observed performing internet-wide port scanning. |
| security_extensions.observation_recency_hours | integer | null | security_extensions | Hours since the most recent active security observation. |
Start with 30K free lookups a month.
No card, no trial clock. Upgrade when your traffic does, or download the database when you would rather keep it in-house.