Kavra LabFree tool
IP fraud score, proxy & VPN check
Enter an IP address to get its fraud score from 0 to 100 and see whether it is a proxy, VPN, Tor exit, residential proxy or data center address, who operates the network, where it is registered and whether it has a recent abuse record. Every flag shows the confidence behind it.
—
Detection
- Proxy—Open, web or anonymous proxy
- VPN—Commercial VPN exit
- Tor exit node—Onion routing exit
- Residential proxy—Consumer IP rented out
- Data center—Hosting or cloud network
- Privacy relay—iCloud Private Relay class
- Recent abuse—Attacks, spam or brute force
- Known bot network—Declared crawler or agent
Network
- ASN
- —
- Operator
- —
- ISP / AS name
- —
- Connection type
- —
- Location
- —
- Time zone
- —
- BGP prefix
- —
- RPKI route
- —
- IP version
- —
- Reputation
- —
Proxy, VPN, Tor or relay
Recent attacks and abuse
History of this network
Hosting, cloud, data center
Bot and crawler networks
Reading the score
What the fraud score means
The score is the worst of five dimensions, from 0 to 100. It orders risk; it is not a probability. Use it to decide how much friction a request deserves.
- 0 – 29
Low risk
A consumer ISP or mobile network with no proxy, VPN or abuse signals. Let the request through without friction.
- 30 – 59
Suspicious
Hosting, a shared exit or a mixed reputation. Fine for browsing; for signups, logins and payments, combine with device checks or add a light step-up.
- 60 – 100
High risk
A Tor exit, a known proxy or VPN, or a network with recent attacks. Review valuable actions such as payouts, bonuses and account changes.
How it works
How the proxy and VPN check works
Every lookup is answered from Kavra's own IP intelligence: routing data, anonymizer datasets and threat feeds, merged into one profile per address with the evidence kept separate.
- 01
Network identity
We map the address to the network that announces it — ASN, operator, BGP prefix and RPKI validity — and classify it: residential, mobile, hosting, cloud, CDN, corporate or education.
- 02
Anonymizer evidence
Published Tor exit lists, VPN and proxy datasets and inferred proxy ranges mark anonymizers separately, each with its own confidence and source.
- 03
Abuse and reputation
Threat feeds and the recent behavior of the surrounding range add attack, spam and brute-force history. The score is the worst dimension, never a blind sum.
Definitions
Proxies, VPNs and data centers, explained
- Proxy
- A server that forwards your traffic and shows its own IP address to the website. Open and web proxies are free and widely abused; many are listed on public blocklists within days.
- VPN
- A virtual private network encrypts traffic to a provider's server and exits from the provider's IP. Commercial VPN exits are shared by thousands of users, so their reputation reflects everyone behind them.
- Tor exit node
- The last relay of the Tor network, where anonymized traffic reaches the open internet. Exit addresses are published, so Tor is detected with high confidence.
- Residential proxy
- A proxy that exits through a real home or mobile connection, often from devices enrolled through SDKs or malware. It is the hardest proxy type to spot and the favorite of account-farming and bonus-abuse operations.
- Data center IP
- An address that belongs to a hosting, cloud or server network rather than a consumer ISP. Scripts, scrapers and headless browsers usually run here.
- ASN
- An autonomous system number identifies the network that announces an IP range on the internet — an ISP, a mobile carrier, a cloud provider or a company.
Beyond the IP
An IP is one signal. Fraud needs the whole picture.
Residential proxies and antidetect browsers are built to pass IP checks. Kavra adds the device, the browser environment, the connection and behavior to every visit, and returns an explained decision your backend applies. See how residential proxies are detected and the platform.
FAQ
IP lookup questions
Something else? Talk to our team.
What is an IP fraud score?
An IP fraud score rates how risky a connection from one IP address is, from 0 (clean) to 100 (high risk). Kavra builds it from five dimensions — anonymity (proxy, VPN, Tor), threat (recent attacks and abuse), reputation (the history of the surrounding network), infrastructure (hosting and cloud) and automation (bot networks) — and reports the worst of them, lowered only for verified operators and consumer privacy relays.
How do I check if an IP address is a proxy or VPN?
Type the address into the lookup above and press Check IP. The Detection panel shows Proxy, VPN, Tor exit node, Residential proxy and Privacy relay separately, each with the confidence behind it, because a commercial VPN and a rented residential proxy mean different things for fraud.
What is my IP address and is it flagged?
The page checks your own address when it opens: the result panel shows your public IP, its fraud score and any proxy, VPN or abuse flags. If you are on a VPN or a corporate network, you will see that network's address, not your home one.
Can residential proxies be detected by IP alone?
Only partly. A residential proxy routes traffic through a real household connection, so its IP looks like an ordinary ISP customer. IP data catches known proxy networks and reused exits; the rest is caught by checking the device, browser and connection behind the IP, which is what the Kavra platform does on every visit.
Why does a Google, AWS or Cloudflare IP show as a data center?
Because it is one. Cloud and hosting addresses are not residential customers, so a login or signup from them is unusual for a person. That is a risk signal, not proof of fraud: corporate VPNs, cloud desktops and privacy tools use the same networks.
Is a high fraud score a reason to block someone?
Not on its own. Use it to decide how much friction a request deserves: allow low scores, step up suspicious ones with a second factor, and review high-risk ones for valuable actions such as payouts. IP reputation is strongest combined with device and behavior signals.
Is this IP lookup free, and do you store the addresses I check?
Yes, it is free and needs no account. Lookups are answered from our own IP intelligence data and are not saved to any profile or database; like any web server we keep short-lived request logs for security.
See who is really on your site.
Run Kavra on your own traffic in observe-only mode. No risk to your customers, and a clear report of the fraud it finds.