IP fraud detection API

This endpoint performs IP fraud detection by evaluating indicators such as proxies, VPNs, bots, TOR nodes, device fingerprints, and other markers. It returns a detailed fraud risk profile.

Endpoint

POST

https://api.provero.io/api/fraud-check/ip

Headers

Authorization:
Content-Type: application/json
Accept: application/json

Request Body

Field	Type	Required	Description
`ip`	`string`	Yes	The IP address to be validated.
`user_agent`	`string`	No	User-Agent header string of the client.
`user_language`	`string`	No	User language country code (e.g., "en").

Request Payload Example (JSON)

{
    "ip": "8.8.8.8",
    "user_agent": "Mozilla/5.0",
    "user_language": "en"
}

Request Examples

Choose language Bash (cURL) 5 examples

curl -X POST https://api.provero.io/api/fraud-check/ip \
  -H "Authorization: Bearer REPLACE_WITH_API_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{
    "ip": "0.0.0.0", # Replace with clients IP address
    "user_agent": "REPLACE_WITH_USER_AGENT", # Example: "Mozilla/5.0 (...)"
    "user_language": "en" #  Language code e.g. "en" for English
  }'

import requests

payload = {
    "ip": "0.0.0.0", # Replace with users IP address
    "user_agent": "REPLACE_WITH_USER_AGENT", # Example: "Mozilla/5.0 (...)"
    "user_language": "en" # Language code e.g. "en" for English
}

url = "https://api.provero.io/api/fraud-check/ip"
headers = {
    "Authorization": "Bearer REPLACE_WITH_API_TOKEN",
    "Content-Type": "application/json",
    "Accept": "application/json"
}

response = requests.post(url, headers=headers, json=payload)
print(response.status_code)
print(response.text)

<?php
$payload = [
    "ip" => "0.0.0.0", // Replace with clients IP address
    "user_agent" => "REPLACE_WITH_USER_AGENT", // Example: "Mozilla/5.0 (...)"
    "user_language" => "en" // Language code e.g. "en" for English
];

$curl = curl_init();
curl_setopt_array($curl, [
    CURLOPT_URL => "https://api.provero.io/api/fraud-check/ip",
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POSTFIELDS => json_encode($payload),
    CURLOPT_HTTPHEADER => [
        "Authorization: Bearer REPLACE_WITH_API_TOKEN",
        "Content-Type: application/json",
        "Accept: application/json"
    ],
]);

$response = curl_exec($curl);
if (curl_errno($curl)) {
    echo 'Error:' . curl_error($curl);
}
curl_close($curl);
echo $response;

$response = Http::withToken('REPLACE_WITH_API_TOKEN')
    ->acceptJson()
    ->post('https://api.provero.io/api/fraud-check/ip', [
        'ip' => '0.0.0.0', // Replace with clients IP address
        'user_agent' => 'REPLACE_WITH_USER_AGENT', // Example: "Mozilla/5.0 (...)"
        'user_language' => 'en', // Language code e.g. "en" for English
    ]);

return $response->json();

const payload = {
    ip: "0.0.0.0", // Replace with clients IP address
    user_agent: "REPLACE_WITH_USER_AGENT", // Example: "Mozilla/5.0 (...)"
    user_language: "en" // Language code e.g. "en" for English
};

fetch("https://api.provero.io/api/fraud-check/ip", {
    method: "POST",
    headers: {
        "Authorization": "Bearer REPLACE_WITH_API_TOKEN",
        "Content-Type": "application/json",
        "Accept": "application/json"
    },
    body: JSON.stringify(payload)
})
    .then(response => response.text())
    .then(result => console.log(result))
    .catch(error => console.error("Error:", error));

Response Examples

Choose response example Success 3 examples

{
    "message": "IP fraud check passed",
    "result": {
        "value": "127.0.0.1",
        "proxy": true,
        "isp": "Reserved",
        "organization": "Reserved",
        "asn": "3",
        "host": "localhost",
        "countryCode": "N/A",
        "city": "N/A",
        "region": "N/A",
        "isCrawler": "",
        "connectionType": "Premium required.",
        "latitude": "0",
        "longitude": "0",
        "zipCode": "N/A",
        "timezone": "",
        "vpn": true,
        "tor": false,
        "activeVpn": false,
        "activeTor": false,
        "recentAbuse": true,
        "abuseVelocity": "Premium required.",
        "botStatus": true,
        "mobile": false,
        "fraudScore": 100,
        "highRiskAttacks": null,
        "sharedConnection": null,
        "dynamicConnection": null,
        "securityScanner": null,
        "trustedNetwork": null,
        "operatingSystem": "Mac 10.15",
        "browser": "Chrome 136.0",
        "deviceModel": "N/A",
        "deviceBrand": "Apple",
        "frequentAbuser": null
    }
}

{
    "requestError": {
        "serviceException": {
            "messageId": "Error message",
            "code": "400"
        }
    }
}

{
    "message": "Insufficient balance for validation request.",
    "service": "ip-fraud",
    "required_amount": "0.0200000000",
    "current_balance": "0.0000000000"
}

Response Body

Success structure

Field Name	Type	Always Returned	Description
`message`	`string`	Yes	Top-level message returned when the fraud assessment completes successfully.
`result`	`object`	Yes	Fraud intelligence payload describing the submitted IP address and related risk signals.
`result.value`	`string`	Yes	The IP address evaluated by the fraud detection service.
`result.proxy`	`boolean`	Yes	Whether the IP is identified as a proxy.
`result.isp`	`string`	Yes	Internet service provider associated with the IP.
`result.organization`	`string`	Yes	Organization attributed to the IP address.
`result.asn`	`string`	Yes	Autonomous system number associated with the IP.
`result.host`	`string`	No	Reverse-DNS or host label when one is available.
`result.countryCode`	`string`	Yes	Country code resolved for the IP address.
`result.city`	`string`	No	Resolved city for the IP address when available.
`result.region`	`string`	No	Resolved region, county, or state for the IP address when available.
`result.isCrawler`	`string`	No	Crawler classification returned by the upstream provider when detected.
`result.connectionType`	`string`	No	Connection classification such as residential, corporate, or mobile when the provider exposes it.
`result.latitude`	`string`	No	Latitude associated with the IP address.
`result.longitude`	`string`	No	Longitude associated with the IP address.
`result.zipCode`	`string`	No	Postal or ZIP code associated with the IP address when available.
`result.timezone`	`string`	No	Timezone associated with the IP address when available.
`result.vpn`	`boolean`	Yes	Whether the IP is associated with VPN usage.
`result.tor`	`boolean`	Yes	Whether the IP is associated with the Tor network.
`result.activeVpn`	`boolean`	No	Whether the provider considers the VPN endpoint actively in use.
`result.activeTor`	`boolean`	No	Whether the provider considers the Tor endpoint actively in use.
`result.recentAbuse`	`boolean`	No	Whether the IP has recent abuse reports.
`result.abuseVelocity`	`string`	No	Provider-specific abuse intensity or rate indicator when available.
`result.botStatus`	`boolean`	No	Whether the IP/user-agent combination appears bot-like.
`result.mobile`	`boolean`	No	Whether the IP is associated with a mobile network.
`result.fraudScore`	`integer`	Yes	Provider fraud score indicating the relative level of risk.
`result.highRiskAttacks`	`boolean\|null`	No	Whether the IP is associated with high-risk attack patterns when the provider exposes that signal.
`result.sharedConnection`	`boolean\|null`	No	Whether the IP is shared across many users when the provider exposes that signal.
`result.dynamicConnection`	`boolean\|null`	No	Whether the IP is flagged as dynamically assigned when available.
`result.securityScanner`	`boolean\|null`	No	Whether the IP is associated with security scanning activity.
`result.trustedNetwork`	`boolean\|null`	No	Whether the provider classifies the network as trusted.
`result.operatingSystem`	`string`	No	Operating system inferred from the submitted user agent when available.
`result.browser`	`string`	No	Browser inferred from the submitted user agent when available.
`result.deviceModel`	`string`	No	Device model inferred from the submitted user agent when available.
`result.deviceBrand`	`string`	No	Device brand inferred from the submitted user agent when available.
`result.frequentAbuser`	`boolean\|null`	No	Whether the IP has been flagged as a frequent abuser when that signal is available.

Error structure

Field Name	Type	Always Returned	Description
`requestError`	`object`	No	Returned when an internal application or request error occurs.
`message`	`string`	No	Top-level error message returned when the account does not have enough balance.
`service`	`string`	No	Service alias returned with a 402 insufficient-balance response.
`required_amount`	`string`	No	Credit amount required to process the validation request.
`current_balance`	`string`	No	Current available balance at the time the request was rejected.