Detect VPN and proxy users in JavaScript and Node.js (free API, no key)

// Detect VPN, proxy, Tor and data center visitors in Node.js with FFraud's free IP API. No key, no packages.
const API = "https://api.ffraud.com/public/ip/";
const cache = new Map(); // address -> { at, answer }, kept 5 minutes

// The API's answer for one address, or null when it cannot answer in time.
export async function ipCheck(ip, timeoutMs = 2000) {
  if (!ip) return null;
  const hit = cache.get(ip);
  if (hit && Date.now() - hit.at < 5 * 60 * 1000) return hit.answer;
  try {
    const res = await fetch(API + encodeURIComponent(ip), { signal: AbortSignal.timeout(timeoutMs) });
    if (!res.ok) return null;
    const answer = await res.json();
    if (cache.size > 10000) cache.clear();
    cache.set(ip, { at: Date.now(), answer });
    return answer;
  } catch {
    return null;
  }
}

// What to do with the request, by FFraud's risk bands; the flags say why.
export function verdict(a) {
  if (!a) return { action: "allow", why: "IP check unavailable" };
  const why = a.tor ? "Tor exit"
    : a.vpn ? `VPN${a.vpn_provider ? ` (${a.vpn_provider})` : ""}`
    : a.proxy ? "proxy"
    : a.relay ? "privacy relay"
    : a.hosting ? `data center${a.cloud_provider ? ` (${a.cloud_provider})` : ""}`
    : "no flag";
  if (a.risk === "critical" || (a.risk === "high" && a.recent_abuse)) return { action: "block", why, risk: a.risk };
  if (a.risk === "high" || a.risk === "medium") return { action: "challenge", why, risk: a.risk };
  return { action: "allow", why, risk: a.risk };
}

import { ipCheck, verdict } from "./ip-check.mjs";

// app.set("trust proxy", ...) to the proxies you run, so req.ip is the visitor; then
// app.post("/signup", ipGuard(), handler). A "challenge" verdict is left to the handler.
export function ipGuard() {
  return async (req, res, next) => {
    req.ipVerdict = verdict(await ipCheck(req.ip));
    if (req.ipVerdict.action === "block") return res.status(403).json({ error: "Requests from this network are not accepted." });
    next();
  };
}

import { ipCheck, verdict } from "../../../lib/ip-check.mjs";

export async function POST(request) {
  // On Vercel, and behind your own nginx, x-real-ip holds the visitor's address.
  const v = verdict(await ipCheck(request.headers.get("x-real-ip")));
  if (v.action === "block") return Response.json({ error: "Requests from this network are not accepted." }, { status: 403 });
  // A "challenge": ask for a CAPTCHA or a confirmed email before the account goes live.
  // create the account here
  return Response.json({ ok: true, challenge: v.action === "challenge" });
}

Node v22.19.0 2026-10-26T01:22:41.468Z
45.66.35.28  Tor exit              risk critical flags: tor, hosting     -> {"action":"block","why":"Tor exit","risk":"critical"}  633 ms, API calls: 1
104.28.80.101  iCloud Private Relay risk low      flags: relay, hosting   -> {"action":"allow","why":"privacy relay","risk":"low"}  148 ms, API calls: 1
62.169.130.76  PIA VPN server      risk medium   flags: vpn, hosting     -> {"action":"challenge","why":"VPN (Private Internet Access)","risk":"medium"}  130 ms, API calls: 1
15.193.8.246  AWS EC2              risk none     flags: hosting          -> {"action":"allow","why":"data center (Amazon Web Services)","risk":"none"}  558 ms, API calls: 1
8.8.8.8  Google DNS                risk none     flags: hosting          -> {"action":"allow","why":"data center (Google Cloud)","risk":"none"}  225 ms, API calls: 1
8.8.8.8 again within 5 minutes: API calls: 0
express, Tor exit: {"status":403,"json":{"error":"Requests from this network are not accepted."},"nextCalled":false,"ipVerdict":{"action":"block","why":"Tor exit","risk":"critical"}}
express, iCloud Private Relay: {"nextCalled":true,"ipVerdict":{"action":"allow","why":"privacy relay","risk":"low"}}
route POST, PIA VPN server       -> 200 {"ok":true,"challenge":true}
route POST, Tor exit             -> 403 {"error":"Requests from this network are not accepted."}
route POST, AWS EC2              -> 200 {"ok":true,"challenge":false}
route POST, no x-real-ip header  -> 200 {"ok":true,"challenge":false}
API down, 203.0.113.9: {"action":"allow","why":"IP check unavailable"}