IP checker

What the check looks at

Datacenter and hosting, matched against 44,000 cloud and hosting CIDR ranges. Proxy and VPN flags from live IP intelligence. Tor exit nodes, against the public exit list, refreshed regularly.

Plus the descriptive half: geolocation (country, region, city, timezone and coordinates), the ISP, ASN and organisation behind the address, and the reverse hostname, which is often the giveaway on a hosting range nobody has catalogued yet.

The four flags are not equally interesting

Datacenter or hosting is the strongest of the four. Nobody lives in an AWS range. A signup from one was started by a machine somebody rented, and while there are honest reasons for that (a corporate proxy, or a VPN endpoint the customer runs themselves), it has the best ratio of signal to noise of anything here.

Commercial VPN is the one people over-weight badly. Millions of ordinary people run one, and remote workers sit behind corporate tunnels all day. Blocking it costs you real users at a rate that is easy to underestimate, because the ones you turn away do not complain. They leave, and they never appear in your numbers.

Tor means someone deliberately anonymised themselves. Worth a review, not a rejection. Journalists and the merely cautious use it too.

Residential proxyis the one built specifically to defeat all of the above: real consumer traffic, routed through somebody’s home connection, often without their knowledge. It is the hardest to catch and the most likely to be genuinely malicious, because almost nobody ends up on one by accident.

Why the ASN beats the country

Country tells you where an address is registered. The ASN tells you what kind of network it is, and that is the more useful fact almost every time.

A residential address in a market you do not sell to is usually a customer on holiday. A hosting-provider address is someone running accounts at scale, and that stays true whichever country it happens to be registered in. Geo-blocking a country turns away real people to catch a pattern that simply moves next door. ASN classification catches the pattern itself.

The stronger version is first-party: track which ASNs have produced abuse in your own historyand weigh accordingly. A network that is 80% fraud for you is worth more than any vendor’s global reputation score, because it is measured on your traffic and your definition of abuse.

What an IP cannot tell you

It cannot tell you how many people are behind it. Carrier-grade NAT puts thousands of mobile users on one address; an office or a university puts hundreds on another. Any rule of the form “more than N accounts from one IP is fraud” will eventually ban a school.

It cannot tell you who someone is. Addresses rotate, and a residential one can change between two visits by the same person on the same evening. That is the gap device identity exists to close: the IP describes the route, the device describes the visitor.

And geolocation is looser than the city field suggests. It is accurate to the country almost always and to the city often enough to be useful, but it is inferred from registry and routing data rather than measured, so treating a city mismatch as proof of anything will cost you.

Checking it at signup

The check above is one endpoint of the Kaidn API:

curl -X POST https://api.kaidn.io/v1/check/ip \
  -H "x-api-key: $KAIDN_API_KEY" \
  -H "content-type: application/json" \
  -d '{"ip":"203.0.113.42"}'

# {
#   "ip": {
#     "fraud_score": 90,
#     "is_datacenter": true,
#     "is_proxy": true,
#     "is_vpn": true,
#     "vpn_provider": "NordVPN",
#     "is_tor": false,
#     "asn": "9009",
#     "isp": "M247 Europe SRL",
#     "country_code": "US"
#   },
#   "summary": "203.0.113.42 is a NordVPN exit, a datacenter/hosting address (M247 Europe SRL) — not a typical residential user (Ashburn, United States) — fraud score 90/100."
# }

Or send it through POST /v1/score alongside the email and the device, and get one verdict with the reasons behind it. That is the version worth building, because no single one of these flags should decide anything on its own.