IP Fraud Detection
This endpoint performs IP fraud detection by evaluating indicators such as proxies, VPNs, bots, TOR nodes, device fingerprints, and other markers. It returns a detailed fraud risk profile.
Endpoint
POST
https://api.provero.io/api/fraud-check/ip
Headers
Authorization: Bearer REPLACE_WITH_API_TOKEN
Content-Type: application/json
Accept: application/json
Request Body
| Field | Type | Required | Description |
|---|---|---|---|
ip
|
string |
Yes | The IP address to be validated. |
user_agent
|
string |
No | User-Agent header string of the client. |
user_language
|
string |
No | User language country code (e.g., "en"). |
Request Body example (JSON)
{
"ip": "8.8.8.8",
"user_agent": "Mozilla/5.0",
"user_language": "en"
}
Code Examples
import requests
payload = {
"ip": "0.0.0.0", # Replace with users IP address
"user_agent": "REPLACE_WITH_USER_AGENT", # Example: "Mozilla/5.0 (...)"
"user_language": "en" # Language code e.g. "en" for English
}
url = "https://api.provero.io/api/fraud-check/ip"
headers = {
"Authorization": "Bearer REPLACE_WITH_API_TOKEN",
"Content-Type": "application/json",
"Accept": "application/json"
}
response = requests.post(url, headers=headers, json=payload)
print(response.status_code)
print(response.text)
<?php
$payload = [
"ip" => "0.0.0.0", // Replace with clients IP address
"user_agent" => "REPLACE_WITH_USER_AGENT", // Example: "Mozilla/5.0 (...)"
"user_language" => "en" // Language code e.g. "en" for English
];
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.provero.io/api/fraud-check/ip",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_POSTFIELDS => json_encode($payload),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer REPLACE_WITH_API_TOKEN",
"Content-Type: application/json",
"Accept: application/json"
],
]);
$response = curl_exec($curl);
if (curl_errno($curl)) {
echo 'Error:' . curl_error($curl);
}
curl_close($curl);
echo $response;
$response = Http::withToken('REPLACE_WITH_API_TOKEN')
->acceptJson()
->post('https://api.provero.io/api/fraud-check/ip', [
'ip' => '0.0.0.0', // Replace with clients IP address
'user_agent' => 'REPLACE_WITH_USER_AGENT', // Example: "Mozilla/5.0 (...)"
'user_language' => 'en', // Language code e.g. "en" for English
]);
return $response->json();
const payload = {
ip: "0.0.0.0", // Replace with clients IP address
user_agent: "REPLACE_WITH_USER_AGENT", // Example: "Mozilla/5.0 (...)"
user_language: "en" // Language code e.g. "en" for English
};
fetch("https://api.provero.io/api/fraud-check/ip", {
method: "POST",
headers: {
"Authorization": "Bearer REPLACE_WITH_API_TOKEN",
"Content-Type": "application/json",
"Accept": "application/json"
},
body: JSON.stringify(payload)
})
.then(response => response.text())
.then(result => console.log(result))
.catch(error => console.error("Error:", error));
curl -X POST https://api.provero.io/api/fraud-check/ip \
-H "Authorization: Bearer REPLACE_WITH_API_TOKEN" \
-H "Content-Type: application/json" \
-H "Accept: application/json" \
-d '{
"ip": "0.0.0.0", # Replace with clients IP address
"user_agent": "REPLACE_WITH_USER_AGENT", # Example: "Mozilla/5.0 (...)"
"user_language": "en" # Language code e.g. "en" for English
}'
Response Examples
Success
{
"message": "IP fraud check passed",
"result": {
"value": "127.0.0.1",
"proxy": true,
"isp": "Reserved",
"organization": "Reserved",
"asn": "3",
"host": "localhost",
"countryCode": "N/A",
"city": "N/A",
"region": "N/A",
"isCrawler": "",
"connectionType": "Premium required.",
"latitude": "0",
"longitude": "0",
"zipCode": "N/A",
"timezone": "",
"vpn": true,
"tor": false,
"activeVpn": false,
"activeTor": false,
"recentAbuse": true,
"abuseVelocity": "Premium required.",
"botStatus": true,
"mobile": false,
"fraudScore": 100,
"highRiskAttacks": null,
"sharedConnection": null,
"dynamicConnection": null,
"securityScanner": null,
"trustedNetwork": null,
"operatingSystem": "Mac 10.15",
"browser": "Chrome 136.0",
"deviceModel": "N/A",
"deviceBrand": "Apple",
"frequentAbuser": null
}
}
Application Error
{
"requestError": {
"serviceException": {
"messageId": "Error message",
"code": "400"
}
}
}
Payment Required - Insufficient Balance
{
"message": "Insufficient balance for validation request.",
"service": "ip-fraud",
"required_amount": "0.0200000000",
"current_balance": "0.0000000000"
}
Response Body
Success structure
| Field Name | Type | Example | Always Present | Description |
|---|---|---|---|---|
message |
string |
IP fraud check passed | Yes | Top-level message returned when the fraud assessment completes successfully. |
result |
object |
{"value":"127.0.0.1","proxy":true,"fraudScore":100} | Yes | Fraud intelligence payload describing the submitted IP address and related risk signals. |
result.value |
string |
127.0.0.1 | Yes | The IP address evaluated by the fraud detection service. |
result.proxy |
boolean |
1 | Yes | Whether the IP is identified as a proxy. |
result.isp |
string |
Reserved | Yes | Internet service provider associated with the IP. |
result.organization |
string |
Reserved | Yes | Organization attributed to the IP address. |
result.asn |
string |
3 | Yes | Autonomous system number associated with the IP. |
result.host |
string |
localhost | No | Reverse-DNS or host label when one is available. |
result.countryCode |
string |
N/A | Yes | Country code resolved for the IP address. |
result.city |
string |
N/A | No | Resolved city for the IP address when available. |
result.region |
string |
N/A | No | Resolved region, county, or state for the IP address when available. |
result.isCrawler |
string |
No | Crawler classification returned by the upstream provider when detected. | |
result.connectionType |
string |
Premium required. | No | Connection classification such as residential, corporate, or mobile when the provider exposes it. |
result.latitude |
string |
0 | No | Latitude associated with the IP address. |
result.longitude |
string |
0 | No | Longitude associated with the IP address. |
result.zipCode |
string |
N/A | No | Postal or ZIP code associated with the IP address when available. |
result.timezone |
string |
No | Timezone associated with the IP address when available. | |
result.vpn |
boolean |
1 | Yes | Whether the IP is associated with VPN usage. |
result.tor |
boolean |
Yes | Whether the IP is associated with the Tor network. | |
result.activeVpn |
boolean |
No | Whether the provider considers the VPN endpoint actively in use. | |
result.activeTor |
boolean |
No | Whether the provider considers the Tor endpoint actively in use. | |
result.recentAbuse |
boolean |
1 | No | Whether the IP has recent abuse reports. |
result.abuseVelocity |
string |
Premium required. | No | Provider-specific abuse intensity or rate indicator when available. |
result.botStatus |
boolean |
1 | No | Whether the IP/user-agent combination appears bot-like. |
result.mobile |
boolean |
No | Whether the IP is associated with a mobile network. | |
result.fraudScore |
integer |
100 | Yes | Provider fraud score indicating the relative level of risk. |
result.highRiskAttacks |
boolean|null |
No | Whether the IP is associated with high-risk attack patterns when the provider exposes that signal. | |
result.sharedConnection |
boolean|null |
No | Whether the IP is shared across many users when the provider exposes that signal. | |
result.dynamicConnection |
boolean|null |
No | Whether the IP is flagged as dynamically assigned when available. | |
result.securityScanner |
boolean|null |
No | Whether the IP is associated with security scanning activity. | |
result.trustedNetwork |
boolean|null |
No | Whether the provider classifies the network as trusted. | |
result.operatingSystem |
string |
Mac 10.15 | No | Operating system inferred from the submitted user agent when available. |
result.browser |
string |
Chrome 136.0 | No | Browser inferred from the submitted user agent when available. |
result.deviceModel |
string |
N/A | No | Device model inferred from the submitted user agent when available. |
result.deviceBrand |
string |
Apple | No | Device brand inferred from the submitted user agent when available. |
result.frequentAbuser |
boolean|null |
No | Whether the IP has been flagged as a frequent abuser when that signal is available. |
Error structure
| Field Name | Type | Example | Always Present | Description |
|---|---|---|---|---|
requestError |
object |
{"serviceException": {"messageId": "Error message", "code": "400"}} | No | Returned when an internal application or request error occurs. |
message |
string |
Insufficient balance for validation request. | No | Top-level error message returned when the account does not have enough balance. |
service |
string |
ip-fraud | No | Service alias returned with a 402 insufficient-balance response. |
required_amount |
string |
0.0200000000 | No | Credit amount required to process the validation request. |
current_balance |
string |
0.0000000000 | No | Current available balance at the time the request was rejected. |