Detect proxies and VPNs in PHP and Laravel with a free API (no key)

<?php

namespace App\Support;

// Detect VPN, proxy, Tor and data center visitors in PHP with FFraud's free IP API. No key, no packages.
final class IpCheck
{
    private const API = 'https://api.ffraud.com/public/ip/';

    public function __construct(private string $cacheDir, private int $ttl = 300)
    {
    }

    /** The API's answer for one address, kept as a file for 5 minutes; null when the API cannot answer in time. */
    public function lookup(string $ip, int $timeoutMs = 2000): ?array
    {
        if (filter_var($ip, FILTER_VALIDATE_IP) === false) {
            return null;
        }
        $file = $this->cacheDir . '/ffraud-ip-' . md5($ip) . '.json';
        if (is_file($file) && filemtime($file) > time() - $this->ttl) {
            return json_decode(file_get_contents($file), true);
        }
        $ch = curl_init(self::API . rawurlencode($ip));
        curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_TIMEOUT_MS => $timeoutMs]);
        $body = curl_exec($ch);
        $ok = $body !== false && curl_getinfo($ch, CURLINFO_RESPONSE_CODE) === 200;
        curl_close($ch);
        if (!$ok) {
            return null;
        }
        file_put_contents($file, $body, LOCK_EX);
        return json_decode($body, true);
    }

    /** ['allow' | 'challenge' | 'block', reason], by FFraud's risk bands; the flags give the reason. */
    public static function verdict(?array $a): array
    {
        if ($a === null) {
            return ['allow', 'IP check unavailable'];
        }
        $why = match (true) {
            !empty($a['tor']) => 'Tor exit',
            !empty($a['vpn']) => 'VPN' . (!empty($a['vpn_provider']) ? " ({$a['vpn_provider']})" : ''),
            !empty($a['proxy']) => 'proxy',
            !empty($a['relay']) => 'privacy relay',
            !empty($a['hosting']) => 'data center' . (!empty($a['cloud_provider']) ? " ({$a['cloud_provider']})" : ''),
            default => 'no flag',
        };
        $risk = $a['risk'] ?? 'none';
        if ($risk === 'critical' || ($risk === 'high' && !empty($a['recent_abuse']))) {
            return ['block', $why];
        }
        if ($risk === 'high' || $risk === 'medium') {
            return ['challenge', $why];
        }
        return ['allow', $why];
    }
}

<?php
// Plain PHP: include this at the top of a page that creates accounts or takes orders.
require_once __DIR__ . '/app/Support/IpCheck.php';

use App\Support\IpCheck;

// REMOTE_ADDR is the visitor once your own proxy hands over the client address (nginx: the realip module).
[$action, $why] = IpCheck::verdict((new IpCheck(__DIR__ . '/cache'))->lookup($_SERVER['REMOTE_ADDR'] ?? ''));
if ($action === 'block') {
    http_response_code(403);
    exit('Requests from this network are not accepted.');
}
// 'challenge': ask for a CAPTCHA or a confirmed email before the account goes live.

<?php

namespace App\Http\Middleware;

use App\Support\IpCheck;
use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\Response;

// Blocks the addresses FFraud scores critical; a "challenge" verdict is left to the controller.
class CheckIp
{
    public function handle(Request $request, Closure $next): Response
    {
        [$action, $why] = IpCheck::verdict(app(IpCheck::class)->lookup((string) $request->ip()));
        if ($action === 'block') {
            abort(403, 'Requests from this network are not accepted.');
        }
        $request->attributes->set('ip_verdict', [$action, $why]);
        return $next($request);
    }
}

// bootstrap/app.php
->withMiddleware(function (Middleware $middleware): void {
    $middleware->trustProxies(at: ['10.0.0.0/8']); // your load balancer or proxy
    $middleware->alias(['ip.check' => \App\Http\Middleware\CheckIp::class]);
})

// app/Providers/AppServiceProvider.php, inside register()
$this->app->singleton(\App\Support\IpCheck::class, fn () => new \App\Support\IpCheck(storage_path('framework/cache')));

// routes/web.php
Route::post('/register', [RegisteredUserController::class, 'store'])->middleware('ip.check');

PHP 8.3.25, 2026-10-26T01:35:03Z
45.66.35.28  Tor exit              -> [block, 'Tor exit'] in 1078 ms
104.28.80.101  iCloud Private Relay -> [allow, 'privacy relay'] in 828 ms
62.169.130.76  PIA VPN server      -> [challenge, 'VPN (Private Internet Access)'] in 452 ms
15.193.8.246  AWS EC2              -> [allow, 'data center (Amazon Web Services)'] in 403 ms
8.8.8.8  Google DNS                -> [allow, 'data center (Google Cloud)'] in 433 ms
not-an-ip  garbage                 -> [allow, 'IP check unavailable'] in 0 ms
8.8.8.8 again: answered from the cache file in 0.42 ms
API down (1 ms timeout), 192.0.2.10 -> [allow, 'IP check unavailable']
middleware, Tor exit: abort(403, 'Requests from this network are not accepted.')
middleware, PIA VPN server: next() ran, ip_verdict ["challenge","VPN (Private Internet Access)"]
middleware, iCloud Private Relay: next() ran, ip_verdict ["allow","privacy relay"]
check-request.php, Tor exit: Requests from this network are not accepted.
check-request.php, PIA VPN server: page goes on: challenge, VPN (Private Internet Access)

PHP 8.3.25, 2026-10-26T01:35:29Z
empty cache, one API call (ms): 442.6 541.2 400.4 431.0 508.8 406.3 439.4 456.5 391.7 497.5 397.0 444.7
answer in the cache file (ms): 0.2 0.2 0.3 0.2 0.3 0.2 0.2 0.3 0.3 0.3 0.3 0.3
median empty cache: 441 ms (fastest 392, slowest 541)
median from the cache file: 0.30 ms (fastest 0.20, slowest 0.30)