Skip to content
LR Defender
Book a demo

NETWORK RISK

Know what the connection is hiding. VPN, public proxy, datacenter and Tor, with an action you can use.

Every lookup returns the network type, its ASN and operator, verdicts for VPN, public proxy, datacenter and Tor, and an action: allow, challenge or block, with the rationale. In the browser, the SDK's timing check can also name a proxy that no list covers. When no source can rule out a residential proxy, the answer says unknown.

Book a demoCheck your connection
Network risk / this connectionLive, this browser

  1. Address and location

    not run yet
    the address this browser connects from

  2. ASN and operator

    not run yet
    the network that announces the address

  3. VPN

    not run yet
    on a VPN list, or none found

  4. Public proxy

    not run yet
    on a public proxy list, or none found

  5. Datacenter

    not run yet
    in a hosting or datacenter range, or none found

  6. Tor

    not run yet
    a published Tor exit, or none found

  7. Residential proxy

    not run yet
    unknown when no source covers the address

  8. Action and rationale

    not run yet
    allow, challenge or block, with the reason

This looks up the address this browser connects from, with the network check your server would call. The SDK's timing and WebRTC checks are not part of it. See what we collect

  • Four network verdicts
  • An action with each answer
  • The rationale, every time
  • Unknown is never clean

How it works

Sources, combined.

Location and network data from MaxMind, the published Tor exit lists and several reputation feeds, combined by a scoring model into one verdict.

Location and network data
Published Tor exit lists
Reputation feeds
A scoring model weighs them
One verdict: VPN, public proxy, datacenter, Tor, and an action

An action, not just a flag.

Every answer ends in allow, challenge or block, with the rationale that produced it, so your team can see why an address was stopped.

Network / Lookup / 198.51.100.7Example data
198.51.100.7block

Rationale

  1. 1The address is announced by AS64503, an operator of commercial VPN servers.
  2. 2The address falls in a hosting range published by the operator.
  3. 3No source covers residential proxy status for this address, so it is unknown, not clean.

Honest about residential proxies.

Residential proxies borrow real home connections, and no list covers them all. In the browser, a timing check can still name one: the proxy ends our connection, so our echoes travel an extra leg to the browser, and the browser cannot shorten it. When nothing names one, the answer says unknown.

Network / Lookup / 198.51.100.23Example data
  • VPN, public proxy, datacenter, Tornone found
  • Residential proxyno source covers this addressnot measured

Unknown is reported as unknown, never as clean.

Addresses kept out of logs.

Send addresses in a request body instead of a URL, one at a time or in batches, so they do not land in access logs along the way.

In the request body

  • 198.51.100.7
  • 203.0.113.9
  • 192.0.2.44

In the URL and access logs

No addresses

One address or a batch, in one request from your server.

API

Your server asks with its API key. Send one address or a batch in the request body, and each answer comes back with its verdicts, its action and the rationale.

Read the server API docsKeep your parser: the IP data API
Your server / network answerExample data
Address
198.51.100.7
ASN and operator
AS64503 · Example VPN Ltd (example.net)
Network type
VPN
VPN
fact
Public proxy
none found
Datacenter
fact
Tor
none found
Residential proxy
not measured
Action
block

Spec

Verdicts
VPN, public proxy, datacenter, Tor
Network facts
ASN, operator, country, city, time zone
Action
Allow, challenge or block
Rationale
On every answer
Residential proxy
In the browser, the timing or WebRTC check can name one; unknown when nothing does
Address in the URL
Not required: body form available
Batch lookups
Yes

Limits

FAQ

That is your call. The answer includes an action, and your rules can treat VPN traffic however your policy says.

In the browser, when the proxy adds a clear detour. A proxy ends our connection, so our echoes travel on to the browser and back, and the browser can make that leg longer but never shorter. When it is clearly longer than the connection allows, the answer says proxy. The browser's own WebRTC address can name one too, as below. A relay that adds less than about 25 ms is not named by the timing, and a lookup by address alone still says unknown.

Sometimes. WebRTC runs over UDP, which a proxy set in the browser does not carry, so the browser's own WebRTC address can show the line the visit started from. When that line belongs to another network operator than the proxy's exit, the answer names a proxy, reports a WebRTC leak and gives that line's country as the true country. A browser that keeps WebRTC off shows nothing, and a WebRTC address that matches the exit proves nothing.

We match against the published Tor exit lists. The dashboard shows when each feed last refreshed.

Yes. The IP data API answers in the shapes common providers use. See how

See what we collect and keep

Read the network behind every request.

Book a demoTalk to an engineer