Provero Logo

IP Fraud Detection

This endpoint performs IP fraud detection by evaluating indicators such as proxies, VPNs, bots, TOR nodes, device fingerprints, and other markers. It returns a detailed fraud risk profile.

Endpoint

POST
https://api.provero.io/api/fraud-check/ip

Headers

Authorization: Bearer REPLACE_WITH_API_TOKEN
Content-Type: application/json
Accept: application/json


Request Body

Field Type Required Description
ip string Yes The IP address to be validated.
user_agent string No User-Agent header string of the client.
user_language string No User language country code (e.g., "en").
Request Body example (JSON)
{
    "ip": "8.8.8.8",
    "user_agent": "Mozilla/5.0",
    "user_language": "en"
}

Code Examples

import requests

payload = {
    "ip": "0.0.0.0", # Replace with users IP address
    "user_agent": "REPLACE_WITH_USER_AGENT", # Example: "Mozilla/5.0 (...)"
    "user_language": "en" # Language code e.g. "en" for English
}

url = "https://api.provero.io/api/fraud-check/ip"
headers = {
    "Authorization": "Bearer REPLACE_WITH_API_TOKEN",
    "Content-Type": "application/json",
    "Accept": "application/json"
}

response = requests.post(url, headers=headers, json=payload)
print(response.status_code)
print(response.text)
<?php
$payload = [
    "ip" => "0.0.0.0", // Replace with clients IP address
    "user_agent" => "REPLACE_WITH_USER_AGENT", // Example: "Mozilla/5.0 (...)"
    "user_language" => "en" // Language code e.g. "en" for English
];

$curl = curl_init();
curl_setopt_array($curl, [
    CURLOPT_URL => "https://api.provero.io/api/fraud-check/ip",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POSTFIELDS => json_encode($payload),
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer REPLACE_WITH_API_TOKEN",
        "Content-Type: application/json",
        "Accept: application/json"
    ],
]);

$response = curl_exec($curl);
if (curl_errno($curl)) {
    echo 'Error:' . curl_error($curl);
}
curl_close($curl);
echo $response;
const payload = {
    ip: "0.0.0.0", // Replace with clients IP address
    user_agent: "REPLACE_WITH_USER_AGENT", // Example: "Mozilla/5.0 (...)"
    user_language: "en" // Language code e.g. "en" for English
};

fetch("https://api.provero.io/api/fraud-check/ip", {
    method: "POST",
    headers: {
        "Authorization": "Bearer REPLACE_WITH_API_TOKEN",
        "Content-Type": "application/json",
        "Accept": "application/json"
    },
    body: JSON.stringify(payload)
})
    .then(response => response.text())
    .then(result => console.log(result))
    .catch(error => console.error("Error:", error));
curl -X POST https://api.provero.io/api/fraud-check/ip \
  -H "Authorization: Bearer REPLACE_WITH_API_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "ip": "0.0.0.0", # Replace with clients IP address
    "user_agent": "REPLACE_WITH_USER_AGENT", # Example: "Mozilla/5.0 (...)"
    "user_language": "en" #  Language code e.g. "en" for English
  }'

Response Examples

Success
{
    "message": "IP fraud check passed",
    "result": {
        "value": "127.0.0.1",
        "proxy": true,
        "isp": "Reserved",
        "organization": "Reserved",
        "asn": "3",
        "host": "localhost",
        "countryCode": "N/A",
        "city": "N/A",
        "region": "N/A",
        "isCrawler": "",
        "connectionType": "Premium required.",
        "latitude": "0",
        "longitude": "0",
        "zipCode": "N/A",
        "timezone": "",
        "vpn": true,
        "tor": false,
        "activeVpn": false,
        "activeTor": false,
        "recentAbuse": true,
        "abuseVelocity": "Premium required.",
        "botStatus": true,
        "mobile": false,
        "fraudScore": 100,
        "highRiskAttacks": null,
        "sharedConnection": null,
        "dynamicConnection": null,
        "securityScanner": null,
        "trustedNetwork": null,
        "operatingSystem": "Mac 10.15",
        "browser": "Chrome 136.0",
        "deviceModel": "N/A",
        "deviceBrand": "Apple",
        "frequentAbuser": null
    }
}
Application Error
{
    "requestError": {
        "serviceException": {
            "messageId": "Error message",
            "code": "400"
        }
    }
}
Payment Required - Insufficient Balance
{
    "message": "Insufficient balance for validation request.",
    "service": "ip-fraud",
    "required_amount": "0.0200000000",
    "current_balance": "0.0000000000"
}

Response Body

Success structure

Field Name Type Example Always Present Description
message string IP fraud check passed Yes Top-level message returned when the fraud assessment completes successfully.
result object {"value":"127.0.0.1","proxy":true,"fraudScore":100} Yes Fraud intelligence payload describing the submitted IP address and related risk signals.
result.value string 127.0.0.1 Yes The IP address evaluated by the fraud detection service.
result.proxy boolean 1 Yes Whether the IP is identified as a proxy.
result.isp string Reserved Yes Internet service provider associated with the IP.
result.organization string Reserved Yes Organization attributed to the IP address.
result.asn string 3 Yes Autonomous system number associated with the IP.
result.host string localhost No Reverse-DNS or host label when one is available.
result.countryCode string N/A Yes Country code resolved for the IP address.
result.city string N/A No Resolved city for the IP address when available.
result.region string N/A No Resolved region, county, or state for the IP address when available.
result.isCrawler string No Crawler classification returned by the upstream provider when detected.
result.connectionType string Premium required. No Connection classification such as residential, corporate, or mobile when the provider exposes it.
result.latitude string 0 No Latitude associated with the IP address.
result.longitude string 0 No Longitude associated with the IP address.
result.zipCode string N/A No Postal or ZIP code associated with the IP address when available.
result.timezone string No Timezone associated with the IP address when available.
result.vpn boolean 1 Yes Whether the IP is associated with VPN usage.
result.tor boolean Yes Whether the IP is associated with the Tor network.
result.activeVpn boolean No Whether the provider considers the VPN endpoint actively in use.
result.activeTor boolean No Whether the provider considers the Tor endpoint actively in use.
result.recentAbuse boolean 1 No Whether the IP has recent abuse reports.
result.abuseVelocity string Premium required. No Provider-specific abuse intensity or rate indicator when available.
result.botStatus boolean 1 No Whether the IP/user-agent combination appears bot-like.
result.mobile boolean No Whether the IP is associated with a mobile network.
result.fraudScore integer 100 Yes Provider fraud score indicating the relative level of risk.
result.highRiskAttacks boolean|null No Whether the IP is associated with high-risk attack patterns when the provider exposes that signal.
result.sharedConnection boolean|null No Whether the IP is shared across many users when the provider exposes that signal.
result.dynamicConnection boolean|null No Whether the IP is flagged as dynamically assigned when available.
result.securityScanner boolean|null No Whether the IP is associated with security scanning activity.
result.trustedNetwork boolean|null No Whether the provider classifies the network as trusted.
result.operatingSystem string Mac 10.15 No Operating system inferred from the submitted user agent when available.
result.browser string Chrome 136.0 No Browser inferred from the submitted user agent when available.
result.deviceModel string N/A No Device model inferred from the submitted user agent when available.
result.deviceBrand string Apple No Device brand inferred from the submitted user agent when available.
result.frequentAbuser boolean|null No Whether the IP has been flagged as a frequent abuser when that signal is available.

Error structure

Field Name Type Example Always Present Description
requestError object {"serviceException": {"messageId": "Error message", "code": "400"}} No Returned when an internal application or request error occurs.
message string Insufficient balance for validation request. No Top-level error message returned when the account does not have enough balance.
service string ip-fraud No Service alias returned with a 402 insufficient-balance response.
required_amount string 0.0200000000 No Credit amount required to process the validation request.
current_balance string 0.0000000000 No Current available balance at the time the request was rejected.