IP lookup and VPN detection API
Location, network, and connection type for any IPv4 or IPv6 address, with VPN, proxy, Tor, and data-center flags. Cloud ranges and Tor exits refresh every 6 hours.
1 credit per check · $4.95 per 1,000 on Starter, $2.00 on Volume. Always billed.
Request
{
"ip": "185.220.101.4"
}Response block
{
"verdict": {
"status": "risky",
"reason": "tor_exit"
},
"risk": {
"score": 80,
"level": "critical"
},
"details": {
"location": {
"country_code": "DE",
"city": "Berlin"
},
"connection_type": "datacenter",
"flags": {
"is_tor": true,
"is_vpn": false,
"is_proxy": false
}
},
"recommendation": {
"action": "block"
}
}What you get back
Every response has a verdict, a risk score, and a recommended action. These are the fields specific to this check; the API reference lists them all.
- location
- Country, region, city, postal code, coordinates, time zone
- network
- ASN, network name, ISP
- connection_type
- residential, mobile, business, or datacenter
- flags.is_vpn / is_proxy / is_tor
- Anonymity signals
- flags.cloud_provider
- aws, gcp, cloudflare, oracle, or digitalocean
- reverse_dns
- The address's PTR record
What it checks
- Country, region, city, time zone
- ASN, network, and ISP
- VPN, proxy, and Tor detection
- AWS, Google Cloud, Cloudflare, Oracle ranges
- Residential, mobile, business, or data center
- Reverse DNS
Try it in a minute
curl https://api.validationcheck.net/v1/ip \
-H "Authorization: Bearer $VC_KEY" \
-H "Content-Type: application/json" \
-d '{"ip":"185.220.101.4"}'const res = await fetch("https://api.validationcheck.net/v1/ip", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.VC_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
"ip": "185.220.101.4"
}),
});
const { data } = await res.json();
console.log(data.recommendation.action);import os, requests
res = requests.post(
"https://api.validationcheck.net/v1/ip",
headers={"Authorization": f"Bearer {os.environ['VC_KEY']}"},
json={
"ip": "185.220.101.4"
},
timeout=15,
)
print(res.json()["data"]["recommendation"]["action"])Use a free test key to get documented answers without spending credits.
Where teams use it
Account takeover
Step up verification when a login comes from Tor or a new country.
Promo abuse
Stop free-trial farming from data centers and VPNs.
Localization
Set currency and time zone from the visitor's location.
Questions
Is a VPN always bad?
No. Many real customers use one. We recommend review, not block, and save block for Tor and open proxies.
Do you support IPv6?
Yes. IPv4-mapped IPv6 addresses are checked as their IPv4 address.
How fresh is the data?
Tor exits and cloud ranges refresh every 6 hours.
Pairs well with
{
"status": "valid",
"reason": "mailbox_exists",
"smtp_check": "deliverable",
"is_disposable": false,
"is_role": false,
"action": "approve"
}Email validation
Know if an inbox is real before you send to it.
- Mailbox exists (SMTP)
- Disposable and burner domains
- Role inboxes like info@ and sales@
- Typo fixes: gmial.com → gmail.com
{
"status": "valid",
"reason": "carrier_confirmed",
"e164": "+14155552671",
"line_type": "mobile",
"ported": false,
"action": "approve"
}Phone validation
Valid, reachable, and what kind of line it is.
- Valid and possible, in 240+ regions
- Mobile, landline, VoIP, toll-free
- Carrier and porting (US/CA)
- E.164, national, and international formats
{
"status": "registered",
"reason": "new",
"domain": "example-deals.com",
"age_days": 4,
"is_newly_registered": true,
"action": "review"
}Domain age
Brand-new domains are where phishing lives.
- Created, updated, and expiry dates
- Age in days and an age band
- Newly registered flag (under 30 days)
- Registrar, nameservers, DNSSEC
Get started in 60 seconds
50 free trial credits. Free test keys. No card needed.