All use cases

Block Account Takeover Attacks

A stolen password looks just like a normal login. Send each login to Fidro with the user_id and it checks the IP for VPNs and proxies, compares it with where that user has been before, and flags new countries and impossible travel, so you can challenge an account takeover before it lands.

What is Fidro?

Fidro is a fraud detection API for developers. One call checks the email, the IP and the network, remembers what it has seen before, and tells your code to allow, challenge or block, so you stop fake signups and stolen cards without building your own scoring. The free plan covers 200 validations a month, no credit card.

The problem

Stolen credentials, reused passwords and phished sessions let attackers walk in through the front door. A correct password proves nothing about who typed it.

How Fidro fixes it

Fidro adds a second look at every login. It checks the IP for VPNs and proxies, remembers each user's countries and IPs, and flags new_country_for_user and impossible_travel when a login doesn't fit, so you can ask for 2FA on that login only.

What you get

Login IP checks

Check every login against known VPN, proxy and Tor exit node lists.

New countries and impossible travel

Send event: login with the user_id and Fidro flags a new country for that user, or two countries within an hour as impossible_travel.

Shared IP detection

ip_many_users fires when five or more different user_ids log in from one IP in a day, the shape of a credential-stuffing run.

Real-time
Analysis speed
60 min
Impossible travel window
Every plan
Login memory included

Keep exploring

Try the free checkers on a real address, read every field in the docs, or see how Fidro compares.

All features API documentation Free email checker Free IP checker Compare Fidro

Frequently Asked Questions

How do I prevent account takeover attacks?
Call Fidro's /validate endpoint on every login with the IP, event: login and your user_id. Fidro checks the IP for VPNs and proxies, compares the login with the countries and IPs it has seen for that user, and returns a challenge when the login doesn't fit, so you can step up to 2FA for that request only.
What are signs of an account takeover?
A login from a country the user has never been in, two countries an hour apart, a VPN or proxy, or many different accounts logging in from one IP. Fidro flags each of these when you send the login with event: login and a user_id.
Can Fidro detect VPN usage on login?
Yes. Fidro recognises VPN providers, proxy networks, Tor exit nodes and datacenter IPs, so you can ask for extra verification when a login comes from a masked address.
Does Fidro replace two-factor authentication?
No, it works alongside 2FA. 2FA proves who someone is; Fidro tells you which logins deserve that extra step, so you can ask for it when a login looks wrong instead of every time.

Start catching bad signups in the next 5 minutes

Create your account, grab your API key, and send your first request. Free plan with 200 validations/month. No credit card. Cancel anytime.

Start for free Read the docs