IP Risk API

The Beltic IP Risk API provides comprehensive IP address validation and risk assessment to help identify fraudulent users, proxy connections, VPNs, Tor networks, and other suspicious network activity. Our API analyzes IP addresses for fraud indicators, geographic location, network type, and anonymity services to help protect your platform from malicious users.

What is IP Risk Analysis?

IP risk analysis evaluates the reputation and characteristics of IP addresses to identify potential threats. Our system analyzes network information, geographic data, anonymity indicators, and historical abuse patterns to provide comprehensive risk scoring for any IP address.

How Does IP Risk Analysis Work?

Our IP risk analysis technology performs comprehensive checks that examine IP addresses from multiple angles. It features advanced network verification checks for issues like proxy detection, VPN identification, Tor network analysis, bot detection, and geographic risk assessment.

IP Risk Analysis API Use Cases

Fraud Prevention: Identify high-risk IP addresses associated with fraudulent activity, chargebacks, and malicious behavior to prevent financial losses.

Proxy & VPN Detection: Detect users hiding behind proxy servers, VPNs, and Tor networks to identify potential fraudsters and anonymous users.

Bot Traffic Filtering: Filter out automated bot traffic and crawlers to ensure only legitimate human users access your platform.

Geographic Risk Assessment: Analyze geographic location data to identify high-risk countries and regions for enhanced security.

Account Takeover Prevention: Detect IP addresses associated with credential stuffing attacks and account takeover attempts.

Endpoint

POST https://api.beltic.com/v1/ips/risk

Parameters

Authentication

Include your API key in the request header:

X-Api-Key: your_api_key_here

Example Request

curl --location 'https://api.beltic.com/v1/ips/risk' \
--header 'X-Api-Key: ApiKey' \
--header 'Content-Type: application/json' \
--data '{
    "ip_address": "1.1.1.1"
}'

Example Response

{
    "risk": {
        "fraud_score": 0,
        "recent_abuse": false
    },
    "network": {
        "isp": "Cloudflare",
        "asn": 13335,
        "organization": "Cloudflare",
        "host": "one.one.one.one",
        "timezone": "America/Denver",
        "mobile": false
    },
    "anonymity": {
        "proxy": false,
        "vpn": false,
        "tor": false,
        "active_vpn": false,
        "active_tor": false
    },
    "bot": {
        "is_crawler": false,
        "bot_status": false
    },
    "address": {
        "formatted_address": "Denver, Colorado, US",
        "country": "US",
        "city": "Denver",
        "state_or_province": "Colorado",
        "postal_code": null,
        "latitude": -33.86000061,
        "longitude": 151.21000671
    }
}

Response Field Definitions

The Beltic IP Risk API returns comprehensive data with each lookup to help your development team make informed decisions in your business logic. The "Fraud Score" provides valuable insights to identify high-risk IP addresses and network characteristics.

Fraud Score Risk Assessment

Consider results as high risk when:

• fraud_score is at least 90

Analyzing the overall Fraud Score is usually the best way to determine the user's overall risk. Fraud Scores >= 75 are suspicious and likely to be a proxy, VPN, or TOR connection, but not necessarily a fraudulent user. This could indicate that users are protecting their privacy online by browsing anonymously with a proxy connection or VPN service. Fraud Scores >= 90 are high-risk users likely to engage in malicious behavior. Scores in this threshold indicate recent or excessive abuse and fit the profile of a typical risky user.

We recommend also using additional risk data points such as bot_status, frequent_abuser, high_risk_attacks, recent_abuse, and abuse_velocity in your decision-making for further granularity. The connection_type, shared_connection, and dynamic_connection variables also play an important role in determining the best business logic for your audience.

Complete Field Reference

The API response is organized into the following main objects:

Risk Object

Network Object

Anonymity Object

Bot Object

Address Object

Error Responses

400 Bad Request

{
    "error": "Invalid IP address format",
    "message": "IP address must be in valid IPv4 or IPv6 format"
}

401 Unauthorized

{
    "error": "Unauthorized",
    "message": "Invalid or missing API key"
}