How to flag VPN and proxy signups with one HTTP call (no API key)

Fake accounts, free-trial abuse and spam signups often come from VPNs, proxies and cloud servers. A VPN on its own isn't proof of fraud (plenty of real people use one), but it is a useful signal to look at before you let an account do something expensive.

I run a small free tool for this called IPLogs, so treat this as a disclosure: I built it. The steps below work the same way with any IP lookup service.

1. Check one IP from the terminal

curl iplogs.com/45.142.26.2

The response is JSON:

{
  "ip": "45.142.26.2",
  "verdict": "vpn_detected",
  "score": 1,
  "is_vpn": true,
  "is_proxy": false,
  "is_tor": false,
  "is_relay": false,
  "is_hosting": false,
  "vpn_provider": "Mullvad",
  "asn": "AS197706",
  "org": "Keminet SHPK",
  "country": "Albania",
  "signals": ["vpn_relay_list", "vpn_aggregator_cidr"]
}

You get a verdict, a score from 0 to 1, separate flags for VPN, proxy, Tor, privacy relay and hosting, and the signals behind the result. Seeing the evidence matters: you can decide what to do with each flag instead of trusting one opaque number.

2. Use it in a signup handler

async function checkSignupIp(ip) {
  const res = await fetch(`https://iplogs.com/v1/check/${ip}`);
  if (!res.ok) return { review: false }; // fail open: never block signups on a lookup error
  const r = await res.json();

  const risky = r.is_vpn || r.is_proxy || r.is_tor || r.is_hosting;
  return { review: risky, score: r.score, flags: r };
}

Two choices worth making on purpose:

• Fail open. If the lookup is slow or down, let the signup through and review later. A broken check shouldn't lock out real users.
• Flag, don't ban. Send risky signups to email verification, a CAPTCHA or manual review. Don't block them outright.

iCloud Private Relay is reported separately (is_relay), so you can let Apple users through while still checking VPNs and datacenters.

3. Check the accounts you already have

Paste a log file or a user export into the bulk page. It picks the IPv4 and IPv6 addresses out of the text, checks up to 1,000 per run, and lets you copy the results as CSV or JSON. Private addresses are skipped. Only the addresses are sent, not the rest of the file.

Through the API, the bulk endpoint takes 100 addresses per call, so send longer lists in batches.

What it can't do

• It tells you whether an address looks like a VPN, proxy, Tor exit or datacenter. It can't tell you who is behind it or what they intend.
• Results are evidence, not proof. Use them next to other signals (email age, device, behaviour), not in place of them.
• Limits for the free service: 60 requests a minute and 2,000 full checks a day per calling IP. There is no paid plan and no SLA. If you need more, there is a contact address on the site.

Try it

Run curl iplogs.com/8.8.8.8, or paste your last 100 signup IPs into the bulk page and see how many look suspicious. If a result looks wrong, the result page has a "Report a problem" link. I read those.

Docs: https://iplogs.com/docs