Where are they really?
Country, and the network they are on. If the checkout says one country and the address says another, you will know before you take the payment.
Live IP intelligence
Know who is behind an IP address before you let them in.
Fake signups. Bots draining your free tier. Chargebacks from the same handful of networks. Send us an address and get back the country, the network, whether somebody is hiding behind a VPN, Tor or a data centre, and whether that address has been caught doing it to other people.
- Free forever tier, no card
- Every score comes with its reasons
- Cancel in one click
Up to 1,000 checks a day on the free plan.
198.98.51.189
Example
80
Risk
High risk
TOR_EXIT Currently exiting Tor traffic HOSTING_ASN A server in a data centre, not a home ABUSE_L1 On a high-confidence blocklist
US
AS53667
Tor exit
Data centre
VPN exit
Tor exit
Tor relay
Datacentre
Residential proxy
Open proxy
Privacy relay
Cloud hosting
Known scanner
Abuse history
Bogon
Business network
Score
0 to 100
With the reasons behind it, every time.
Reason codes
20
Every one published, with its weight.
Answer time
< 10ms
Fast enough to sit in a checkout.
Free every day
1,000
No card, no trial clock.
One call, three answers
You do not need a data science team. You need to know whether to let someone in.
-
Send an address
One request from wherever you already check a signup, a login or a checkout.
-
Get the picture back
Country and network. Whether they are on a VPN, Tor, a proxy or a server. Whether that address has a history.
-
Decide your own way
A score, the reasons behind it and the weight each one carried. Where you draw the line is your call.
Are they hiding?
VPN, Tor, proxy, or a server in a data centre pretending to be somebody's living room. We keep them apart, because they mean very different things.
Have they done this before?
Whether this address has been caught attacking, spamming or defrauding other people, and how recently. A first offence and a repeat offender are not the same problem.
The whole scoring model, in public
Most risk scores are a number and a shrug. You block somebody, they email you, and you have nothing to tell them. Here is what moves ours and by how much. Nothing is hidden and there is no secret sauce.
- TOR_EXIT +55
- PUBLIC_PROXY +50
- ABUSE_L1 +45
- CROSSLAYER_RTT_DELTA +40
- VPN_KNOWN_PROVIDER +35
- OPEN_PROXY_PORT +35
- APPLE_PRIVATE_RELAY 0
- TOR_RELAY_NONEXIT -5
- MOBILE_CGNAT -10
Using a VPN is not a crime
A phone on a mobile network shares one address with thousands of other people. A Tor relay that is not an exit has never sent you any traffic. Apple's Private Relay is on by default for millions of iPhones. None of those tells you anything bad about the person on the other end, so none of them pushes the score up.
One problem cannot count three times
Four blocklists can all be describing the same botnet. If each one added to the score, one event would look like four. Each kind of evidence is capped, so the number stays honest.
-
0to19
Clean
Let them through. Do not add friction to somebody who has given you no reason to.
-
20to44
Low
Nothing here worth acting on. Watch it if you like.
-
45to69
Medium
Worth a second step. A code by email, a card check, a slower path.
-
70to100
High
Worth a hard stop on anything that costs you money.
Where you draw those lines is your call, not ours. A game and a bank do not want the same threshold, which is why you get the reasons and not just the number.
It is one request
No SDK to install, no build step, nothing to keep updated. If your language can make an HTTP request, you are finished in an afternoon.
{ "ip": "198.98.51.189", "country": "US", "asn": "AS53667", "tor": true, "vpn": false, "hosting": true, "score": 80, "band": "high", "reasons": ["TOR_EXIT", "HOSTING_ASN", "ABUSE_L1"] }
The shape above is what the scoring service is being built to return. It is not live yet, and this page will say so until it is.
Pay for what you actually check
Start on the free plan. Move up when it is paying for itself. Cancel in one click and keep whatever you have already paid for.
Free
€0/month
- 1,000 checks per day
- Up to 5 per second
- One address at a time
- Stops at the limit. Nothing unexpected on your card.
- A small credit link wherever you show a result to a person
Lite
€9/month
- 50,000 checks per month
- Up to 25 per second
- Check 50 at once
- Stops at the limit. Nothing unexpected on your card.
Basic
€39/month
- 400,000 checks per month
- Up to 100 per second
- Check 500 at once
- Keep going past it at €0.40 per 10,000
Advanced
€149/month
- 4,000,000 checks per month
- Up to 500 per second
- Check 10,000 at once
- Keep going past it at €0.20 per 10,000
Not a fan of subscriptions?
Buy a block of checks outright, by card or in crypto. Nothing recurring, no card kept on file, and they last 12 months.
| Pack | Checks | Standard | Pro |
|---|---|---|---|
| S | 100,000 | €7 | €19 |
| M | 500,000 | €29 | €79 |
| L | 2,000,000 | €99 | €279 |
| XL | 10,000,000 | €399 | €1,099 |
Prices in euro, before any tax that applies where you are. Pro packs unlock the full detail. Worth reading first: how refunds work.
Questions people actually ask
Do you keep the addresses I send you?
We process them to answer your question. We do not sell them, share them or build a profile out of them, and there is no second customer whose interests are different from yours. The privacy policy is specific about what is kept and for how long.
What happens when I hit my limit?
On the free and entry plans, checks stop until the window resets. Nothing unexpected appears on your card, but your integration does start getting refused, so it is worth knowing before you build against it.
On the larger plans you keep going and the extra is billed per ten thousand at the rate on the plan.
How is this different from a blocklist?
A blocklist tells you an address is on a list. It does not tell you whether the address is a phone on a mobile network shared by thousands of people, a server in a data centre, or somebody's home connection, and those three call for very different answers.
You get the evidence and the weight each piece carried, so you can disagree with us and still use the data.
Will this block my customers who use a VPN?
Only if you decide it should. A VPN is one reason code among 20, and the ones that mark ordinary privacy tools carry no weight or negative weight on purpose. Blocking half your iPhone users to catch one fraudster is a bad trade and we will not quietly make it for you.
Can I use it from the browser?
No. The key belongs on your server. Anything in front-end code is readable by the people you are trying to check, and a key in a public repository is a key somebody else is using.
Who am I buying from?
AESHA Technology Services Limited, company number 210193, registered at 1032 Office House of Francis Ilu de Port, Mahe, Seychelles. Card payments are handled by Stripe and your card details never reach our servers. The full details are on the legal notice.
Point it at one day of your traffic
Sign up, make a call, see what comes back. It costs nothing and takes about a minute.
Questions first? [email protected], read by the people who build it.