Checks · IP

IP check

Score an IP address: VPN / proxy / Tor / bot detection, hosting & abuse history, plus geolocation and ASN. Single-tier — there is no extended mode for IP.

POST /api/v1/check/ip

Body parameters

Field	Type	Required	Description
`ip`	string	required	IPv4 or IPv6 address. Invalid input → `400 invalid_target`.
`use_storage`	boolean	optional	Reuse your own prior result for free. Default `false`.
`external_id`	string	optional	Your own correlation id; stored with the check, echoed back in the response, and searchable in the mini-app history. Max 128 chars.

extended_check is ignored for IP. The IP check is always a single data block.

cURL

curl -X POST https://antifrauder.app/api/v1/check/ip \
  -H "X-API-Key: $ANTIFRAUDER_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "ip": "45.155.205.16" }'

Response

The standard envelope (including your externalId, echoed back when supplied); result is the IP view — the consolidated intel plus the fraud score. Same shape idea as phone/email.

200 — JSON

{
  "checkId": "665f1a9c8e4b2a0012ab34cd",
  "externalId": "order-12345",
  "charged": 5,
  "extended": false,
  "fromStorage": false,
  "balance": 4776,
  "result": {
    "intel": {
      "address": { "ip": "45.155.205.16", "asn": 9009 },
      "geo": { "country": { "code": "NL", "name": null }, "region": "North Holland",
               "city": "Amsterdam", "timezone": "Europe/Amsterdam" },
      "network": { "isp": "M247 Europe SRL", "organization": "M247",
                   "connectionType": "Data Center", "mobile": false, "hosting": true },
      "threats": { "vpn": true, "proxy": true, "tor": false, "bot": false,
                   "crawler": false, "recentAbuse": true },
      "reputation": { "fraudScore": 88 },
      "meta": { "sources": { "ok": 1, "total": 1 } }
    },
    "fraud": {
      "score": 100,
      "level": "critical",
      "negative": [
        { "code": "IP-R-01", "key": "vpn", "name": "VPN", "description": "The IP is a VPN exit node.", "points": 40 },
        { "code": "IP-R-02", "key": "proxy", "name": "Proxy", "description": "The IP is a known proxy.", "points": 50 },
        { "code": "IP-R-05", "key": "recent_abuse", "name": "Recent abuse", "description": "The IP was recently reported for abusive activity.", "points": 70 },
        { "code": "IP-R-09", "key": "hosting_provider", "name": "Hosting provider", "description": "The IP belongs to a hosting provider.", "points": 35 },
        { "code": "IP-R-07", "key": "high_provider_fraud", "name": "High provider risk", "description": "The data provider's own fraud score is high (≥85).", "points": 60 }
      ],
      "positive": []
    }
  }
}

Intel (result)

result.intel is the consolidated view, grouped by domain. IP is a single source, so values are direct (no vote wrappers).

Field	Type	Description
`address`	object	`ip` and `asn` (Autonomous System Number, `null` if unknown).
`geo`	object	`country{code,name}`, `region`, `city`, `timezone` (any may be `null`).
`network`	object	`isp`, `organization`, `connectionType` (e.g. `Data Center`, `Residential`), `mobile`, `hosting`.
`threats`	object	Boolean flags: `vpn`, `proxy`, `tor`, `bot`, `crawler`, `recentAbuse`.
`reputation`	object	`fraudScore` — the data provider's own 0–100 score (`null` if unavailable).
`meta`	object	`sources{ok,total}` — always `1/1` for IP.

Fraud score

Same 0–100 model and low / medium / high / critical bands as the other checks, and the same fraud.negative[] (risk) / fraud.positive[] (trust) split — each with a stable code. IP signals are all risk-bearing (no trust signals):

Code	Signal	Points	Trigger
`IP-R-04`	`bot`	+90	automated client
`IP-R-03`	`tor`	+80	Tor exit node
`IP-R-05`	`recent_abuse`	+70	recently reported for abuse
`IP-R-07`	`high_provider_fraud`	+60	provider score ≥ 85
`IP-R-02`	`proxy`	+50	known proxy
`IP-R-01`	`vpn`	+40	VPN exit node
`IP-R-09`	`hosting_provider`	+35	hosting-provider range
`IP-R-06`	`datacenter`	+30	datacenter / crawler
`IP-R-08`	`medium_provider_fraud`	+30	provider score ≥ 75
`IP-R-10`	`mobile_carrier`	+5	mobile carrier range

Retrieve & batch

GET/api/v1/result/ip?ip=45.155.205.16

GET/api/v1/result/:checkId

Latest stored result for that value / id, or 404 not_found.

CSV batch

POST/api/v1/batch/ip

multipart/form-data, file field (one IP per row, max 10 000). Poll GET /api/v1/batch/:jobId and download via GET /api/v1/batch/:jobId/result — same flow as the phone batch.