Network Layer

Network Intelligence Engine

See through VPNs, proxies, and Tor. Every connection arrives flagged, located, and scored before it touches your application.

Start Free Trial API Docs

VPN Detection

Multi-Signal Detection

VPN detection combines a commercial IP intelligence lookup with browser-side consistency checks. The event exposes the outcome as booleans — vpn, proxy, tor, datacenter — while the underlying addresses stay internal.

MethodAccuracyDetail

IP Reputation97.2%Every connecting IP is looked up in a commercial IP intelligence database. Addresses recorded as VPN endpoints set the boolean vpn field; the same lookup also drives proxy, tor, and datacenter.

WebRTC Leak Analysis99.1%A STUN probe compares the WebRTC server-reflexive address with the IP of the HTTP connection. A mismatch on a VPN or proxy IP is scored as a network inconsistency; the addresses stay internal, and the API returns the vpn flag rather than an IP.

Response Example

{
  "network": {
    "vpn": true,
    "proxy": true,
    "tor": false,
    "datacenter": false
  }
}

Proxy Detection

Boolean Proxy Flag

Proxy traffic is identified by looking the connecting IP up in a commercial IP intelligence database that records the channel behind an address: datacenter, public and web proxies, residential proxies, search engine spiders, VPN, and Tor. Any of them sets the boolean proxy field — the API does not grade proxies by anonymity level, so a search engine crawler sets proxy exactly as a VPN does.

MethodDetail

Datacenter & HostingAddresses in hosting and datacenter ranges set proxy together with datacenter. On Business plans the event also carries the ISP name and ASN of the network.

Public & Web ProxiesOpen proxies and web-based proxy front ends are recorded as their own channel types in the database and set the boolean proxy field.

Residential ProxiesConsumer connections resold as exit points carry no datacenter marker, so the proxy field is what separates them from ordinary residential traffic.

Response Example

{
  "network": {
    "vpn": false,
    "proxy": true,
    "tor": false,
    "datacenter": true,
    "isp": "DigitalOcean, LLC",
    "asn": 14061
  }
}

Tor Detection

Database-Backed Tor Flag

Connections from addresses recorded as Tor nodes in the same IP intelligence database are flagged. The event carries a boolean tor field next to vpn, proxy, and datacenter — no relay list or node metadata is exposed.

MethodDetail

Tor Exit IP LookupThe connecting IP is matched against records typed as Tor. Coverage follows the database vendor: the product keeps no relay directory of its own.

TLS Client FingerprintThe JA4 hash of the TLS handshake classifies the client stack — Chromium, Firefox, Safari, or a non-browser HTTP client such as curl — and is compared with the User-Agent. It describes the client, not the network: the tor field itself comes from the IP lookup.

Response Example

{
  "network": {
    "vpn": false,
    "proxy": true,
    "tor": true,
    "datacenter": false
  }
}

Geolocation

City-Level Lookup

IP-to-location resolution for the connecting address. The event carries the country, city, coordinates, and timezone of the IP location.

MethodDetail

IP GeolocationLookups run against the MaxMind City database and yield country, city, coordinates, and the timezone of the address. The ISP name and AS number come from a separate ISP database and are delivered on Business plans.

Response Example

{
  "geo": {
    "country": "DE",
    "city": "Berlin",
    "lat": 52.52,
    "lon": 13.405,
    "timezone": "Europe/Berlin",
    "isp": "Deutsche Telekom"
  }
}

ASN Analysis

ASN & ISP Metadata

Every event carries the autonomous system number and the ISP name behind the connecting address on Business plans. Datacenter and hosting traffic is separated by the boolean datacenter field rather than by a network-type label.

MethodDetail

ASN & ISP LookupThe AS number and the ISP name behind an address are resolved from a separate ISP database and delivered as the asn and isp fields on Business plans.

Datacenter & Hosting TrafficAddresses recorded as datacenter or hosting set the boolean datacenter field together with proxy. Coverage follows the database vendor: the product keeps no hosting provider list of its own.

Response Example

{
  "network": {
    "vpn": false,
    "proxy": false,
    "tor": false,
    "datacenter": false,
    "isp": "Deutsche Telekom",
    "asn": 3320
  }
}

Integration Example

Network intelligence is included in every webhook event delivered to your server. No extra API calls needed.

Need IP reputation, VPN, and proxy classification packaged as a product surface? See IP Intelligence.

// Network signals arrive on your server in the webhook event
app.post('/webhook/tracio', (req, res) => {
  const event = req.body

  if (event.network.vpn) {
    // Apply enhanced verification
    requireMFA(event.visitorId)
  }

  if (event.network.datacenter) {
    // Flag for review — residential users don't use datacenter IPs
    flagForReview(event.visitorId, 'datacenter_traffic')
  }

  if (event.network.tor) {
    // Block or challenge based on your policy
    challengeUser(event.visitorId, 'tor_detected')
  }

  res.status(200).send('OK')
})

See Every Connection Clearly

Start identifying VPNs, proxies, and Tor in your traffic today.

Start Free Trial