IP fraud-risk report with residential/datacenter/proxy/Tor verdict API

Fraud / abuse-prevention risk report for an IPv4 or IPv6 address: fuses ip-api.com geolocation (country, region, city), ASN + network operator, and the provider's hosting/proxy/mobile flags with live Tor-exit-list membership into a 0-100 risk score, a graded verdict (residential/low | mobile/low | unknown/medium | proxy/medium | datacenter/high | tor/critical), a connection type, an allow/step-up/deny recommendation, machine-readable reason codes, and the specific evidence. Validates the IP and rejects private/reserved ranges. Distinct from security-ip-reputation (criminal-netblock blocklists) — this answers connection trust for signups, checkout, and session-risk. Answers 'Is this IP a VPN, proxy, or datacenter?', 'Is this a Tor exit node?', 'Should I allow, step-up, or deny this user's IP?', 'Is this a real residential or mobile connection?'.

Price$0.1per request

MethodPOST

Route/v1/identity/ip-risk

StatusLive

MIME typeapplication/json

Rate limit60/minute

Cache3600s public

identityipfraudriskvpnproxydatacentertorgeolocationfingerprint

API URLhttps://x402.hexl.dev/v1/identity/ip-risk

Integration docs

Example request

{
  "ip": "8.8.8.8"
}

Example response

{
  "ip": "8.8.8.8",
  "ipVersion": "ipv4",
  "riskScore": 75,
  "verdict": "datacenter/high",
  "connectionType": "datacenter",
  "recommendation": "step-up",
  "reasonCodes": [
    "DATACENTER_HOSTING"
  ],
  "geo": {
    "country": "United States",
    "region": "Virginia",
    "city": "Ashburn"
  },
  "network": {
    "isp": "Google LLC",
    "org": "Google Public DNS",
    "asn": "AS15169 Google LLC",
    "asName": "GOOGLE"
  },
  "flags": {
    "torExit": false,
    "hosting": true,
    "proxy": false,
    "mobile": false
  },
  "evidence": [
    "hosting/datacenter ASN (AS15169 Google LLC)"
  ],
  "narrative": "HIGH: 8.8.8.8 is a datacenter/hosting IP (Google Public DNS), not a residential subscriber — typical of bots, scrapers, and VPNs. Step up verification.",
  "disclaimer": "Best-effort fraud-risk heuristics on public IP metadata. Provider proxy/hosting flags and the Tor exit list are not exhaustive and may lag; a low score is NOT a guarantee of legitimacy nor a high score a guarantee of fraud. Combine with other signals before allowing or denying."
}

Input schema

{
  "type": "object",
  "required": [
    "ip"
  ],
  "properties": {
    "ip": {
      "type": "string",
      "description": "Public IPv4 or IPv6 address to risk-score. Private/reserved ranges are rejected."
    }
  },
  "examples": [
    {
      "ip": "8.8.8.8"
    }
  ]
}

Output schema

{
  "type": "object",
  "additionalProperties": true
}