IP Address Risk Checker

Got a signup, order or login that doesn't feel right? This free IP lookup shows where the address really is, who runs it, whether it's hiding behind a VPN, proxy or Tor, and a risk score from 0 to 100. Free, no signup.

Last updated: June 2026

Need this in your signup flow?

Run the same check in your signup form with Fidro's API. 200 a month free, no credit card.

See the free API

Your IP: 216.73.217.172

216.73.217.172

Risk score55 / 100

block

VPN

No VPN

Proxy

No proxy

Tor

Not Tor

ISP

Clean ISP

Threat

Flagged IP

Datacenter

Datacenter IP

Issues Found:

Known malicious IP
Datacenter/hosting IP

Check every signup, not just this one.

Fidro's API runs this check on every signup, adds the email and memory of who it has seen, and answers allow, challenge or block. 200 lookups a month, free.

Get a free API key Read the API docs

No credit card required. Cancel anytime. Or see a full api response for an ip like this first.

How it works

1

Paste an IP address

Paste any IPv4 or IPv6 address. Your own IP is already filled in.

2

Fidro checks it

Fidro looks up the location and network, and checks for VPN, proxy, Tor and abuse-list matches.

3

Read the report

Location, network, every check, and a risk score with a plain answer.

What the IP checker looks at

Every IP address is checked against multiple intelligence sources to give you a complete risk picture.

IP Geolocation

Country, region, city, postcode, timezone and coordinates: roughly where the IP is.

VPN Detection

Spots traffic from commercial VPN providers' server ranges.

Proxy Detection

Spots open proxies, which forward traffic so the real IP never reaches you.

Tor Exit Node Detection

Checks the Tor Project's own list of exit nodes, refreshed every day.

ISP & Network Info

Provider, organisation and ASN. Tells a home connection from a server in a datacenter.

Threat Intelligence

Checks the IP and its network against lists of addresses reported for spam and attacks, refreshed daily.

How to read your IP lookup results

Every lookup gives you two things: where the IP is and who runs it, and how risky it looks.

Location data

The location panel shows roughly where the IP is. Country is usually right; city is a good guess and can be some distance off, because the coordinates often point at the provider's nearest routing point rather than a home. Timezone is handy for spotting a user whose browser clock and IP disagree.

Network data

The network panel shows who runs the IP. Home broadband providers (Comcast, BT, Telstra) are normal for real people; hosting companies (AWS, DigitalOcean, OVH) usually mean a server, a script or a VPN. The ASN is the network's ID number, and it's how Fidro tells the two apart.

Risk score

The score runs from 0 to 100. 0 to 20 is low risk: an ordinary home or business connection. 21 to 50 is worth a look, usually because of a VPN or proxy. Above 50 is high risk: Tor, an IP on abuse lists, or several warning signs at once.

What is my IP address?

Your IP address is at the top of this page. It's the public address your internet provider gave your router, and every device on your home network shares it.

On a VPN, you'll see the VPN server's address instead of yours. That's the point of a VPN. Switch it off and refresh to see your real one.

Most home connections get a dynamic IP that changes now and then, often when the router restarts. Businesses often pay for a static IP that stays the same, which is useful for running servers.

How does an IP address lookup work?

An IP lookup asks databases that map blocks of addresses to places and owners. Those blocks were handed out by regional registries (ARIN for North America, RIPE for Europe, APNIC for Asia-Pacific and so on) to providers and companies, and the records are public.

Location databases combine those records with routing data and corrections to estimate where an IP is. They're reliable for the country, decent for the city, and not to be trusted for anything more precise.

For fraud prevention, location is only the start. Fidro also checks the IP against VPN ranges, open proxies, Tor exit nodes and abuse lists, and that's what turns a lookup into a risk score.

How VPN and proxy detection works

A VPN or proxy makes traffic look like it comes from somewhere else. That's fine for privacy, and it's also exactly how fraudsters hide.

Fidro spots them four ways:

IP range matching: commercial VPN providers run large, known blocks of addresses. Fidro refreshes its VPN ranges weekly.
Who owns the network: VPN servers run in datacenters. An IP from a hosting company like AWS or DigitalOcean, rather than a home provider, is a strong hint.
Tor exit nodes: the Tor Project publishes its exit nodes, and Fidro refreshes that list daily. Traffic from one of them is Tor traffic.
Abuse lists: IPs and networks reported for spam and attacks, refreshed daily, add weight to the score.

It matters most for checkout fraud and free tier abuse, where a hidden IP is one of the clearest warning signs.

IPv4 vs IPv6: what's the difference?

There are two versions of IP addresses in use today. IPv4 uses 32-bit addresses formatted as four groups of numbers separated by dots (e.g., 192.168.1.1). It supports about 4.3 billion unique addresses, which seemed like plenty in the 1980s but has since run out.

IPv6 uses 128-bit addresses formatted as eight groups of hexadecimal digits separated by colons (e.g., 2001:0db8:85a3::8a2e:0370:7334). It supports 340 undecillion addresses, more than enough for every device on earth to have its own.

This IP checker accepts both. Most networks now run the two side by side, called dual-stack, so many devices have an IPv4 and an IPv6 address at once.

What is Fidro?

Fidro is a fraud detection API for developers. One call checks an IP for VPNs, proxies and Tor, an email for disposable addresses, remembers who it has seen, and answers allow, challenge or block. One vendor instead of three.

This free IP checker runs on the same checks as the Fidro API. For production use, you can sign up for a free API key with 200 lookups a month at no cost. See how Fidro stacks up against IPQualityScore, MaxMind, and other providers.

Frequently Asked Questions

How do I check if an IP address is risky?

Paste the IP into the checker above. Fidro looks up where it is and who runs it, checks it for VPN, proxy, Tor and datacenter use and against abuse lists, and rolls it all into one risk score. You know in seconds whether a signup, order or login needs a closer look.

What makes an IP address high risk?

The strongest signs are a hidden location (VPN, proxy or Tor), a datacenter instead of a home connection, a history on abuse lists, and a location that doesn't match where the user says they are. One sign alone rarely proves fraud, which is why Fidro scores them together instead of handing you a single true or false flag.

What can you tell from an IP address?

Roughly where it is (country, region, city), which provider runs it, whether it's a home, business or hosting connection, and whether it belongs to a VPN, proxy or Tor network. Fidro also checks whether the address or its network appears on abuse lists.

Can someone find my exact location from my IP?

No. An IP gives an approximate location, usually a city at best, and often just the place where your provider routes traffic. It can't reveal a street address. If you're on a VPN, it shows the VPN server's location instead of yours.

How does VPN and proxy detection work?

Mostly by matching. The IP is compared against ranges known to belong to VPN providers, open proxies and hosting companies, and Tor exit nodes come from the Tor Project's own list. Fidro also looks at who owns the network, because VPN servers live in datacenters, not homes.

What is the difference between IPv4 and IPv6?

IPv4 addresses are 32 bits and look like 192.168.1.1, which allows about 4.3 billion of them. IPv6 addresses are 128 bits and look like 2001:0db8:85a3::8a2e:0370:7334, which allows practically unlimited addresses. IPv6 exists because IPv4 addresses ran out. This checker accepts both.

Why should businesses check IP addresses?

To catch fraud and abuse before it costs them. A shop can hold orders from VPN or proxy IPs, a SaaS product can spot free tier abuse from datacenter IPs, and anyone can check that a user's IP matches the country they claim to be in.

Is this IP checker free?

Yes, with no signup and a fair daily limit. For the same checks in your own app, Fidro's API has a free plan with 200 lookups a month, no credit card. Paid plans start at $29 a month for 5,000.

API

Put this check in your signup form.

One API call checks the IP for VPN, proxy and Tor use alongside the email, remembers who it has seen, and answers allow, challenge or block.

Also try our email checker, VPN detector, domain checker, and bulk email validator.

Comparing IP intelligence vendors? See Fidro vs MaxMind, IPQualityScore, and IPinfo.

curl -X POST https://fidro.io/api/validate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"ip": "203.0.113.42"}'