VPN, proxy (including residential), and Tor exit-node detection plus city-level geolocation — resolved server-side from commercial IP intelligence and delivered together on every event.
VPN, proxy, and datacenter flags resolved server-side from commercial IP intelligence databases (IP2Location).
VPN, Tor, public proxy, web proxy, datacenter, spider, and residential proxy — all in real time.
Exit nodes identified from the same commercial IP intelligence database as the VPN and proxy flags; coverage follows the data vendor.
IP geolocation with timezone, ISP, and ASN metadata.
A STUN probe compares the address the browser reports with the connecting IP; a country mismatch is scored as a location contradiction.
5-minute, 1-hour, and 24-hour sliding windows to detect distributed attacks.
Anti-detect builds are caught by the contradictions they leave behind, not by a list of product names — and the finding arrives as a 0 to 100 score.
Our lightweight SDK collects 300+ browser signals asynchronously, with zero impact on user experience.
Server-side engine analyzes signals, runs weighted similarity matching, and computes confidence scores.
Get a stable visitor ID, bot detection results, smart signals, and IP intelligence in a single API response.
A few lines of code, one API response with everything you need.
// IP intelligence arrives on your server in the webhook eventapp.post('/webhook/tracio', (req, res) => { const event = req.body console.log(event.network.vpn) // true console.log(event.network.tor) // false console.log(event.geo.city) // "Berlin" res.status(200).send('OK')})IP Intelligence flags VPN, proxy, Tor, and datacenter connections server-side using commercial IP intelligence databases — IP2Location for VPN/proxy/Tor classification and MaxMind for geolocation and ASN. Each is surfaced as a clear network flag rather than a raw score, and the database-backed approach keeps flagging accurate even as VPN providers rotate their IP pools. 1.75 billion people now use VPNs globally — about one-third of all internet users.
Residential proxies are trickier than datacenter VPNs because they ride on real ISP addresses — most websites cannot detect them at all. The commercial IP intelligence database records them as their own channel type, and a connection recorded that way sets the boolean proxy field without the datacenter marker — that combination is what separates a resold consumer connection from ordinary residential traffic.
A location check is only meaningful when two independent answers exist for the same question. The first is the country the connecting IP resolves to. The second comes from the device: a WebRTC connection can leak an address the tunnel was meant to hide, and that leaked address resolves to a country of its own. When the two disagree, the contradiction adds a small weight to the risk score alongside the network flags — the visit is not blocked on that basis alone. Browser timezone and locale are collected as well, but they do a different job: timezone is one axis of the device profile, normalized so that two browser engines naming the same zone differently still resolve to one device rather than two. It is not compared against the IP-derived location.
Residential proxy prices dropped 70% in two years. Hidden traffic is now affordable for any fraudster.
Proxyway, 2025
See how teams use IP Intelligence to solve real-world problems.
Detect distributed attacks using rotating residential proxies. 21% of bot attacks use residential proxies as evasion tactic.
Learn moreValidate customer location and detect VPN/proxy usage during checkout to prevent fraudulent transactions.
Learn moreIdentify geographic impossibility patterns across shared accounts using velocity tracking.
Learn more3 lines of code and 5 minutes to integrate. VPN, proxy, and Tor detection on your real traffic in your next API call.
14-day free trial · Full platform access · 5-minute integration