About Guarda
Guarda is an IP intelligence service. We answer one question quickly and honestly: what kind of network is this connection coming from, and how much should you trust it?
Network ownership first
Every lookup starts with who actually owns the address: the ASN, the organisation behind it and whether the prefix belongs to an access network or a hosting provider.
Layered detection
Ownership is combined with hosting and datacenter ranges, known TOR exit relays, commercial VPN infrastructure and behavioural signals to produce a classification.
A score you can tune
The 0–100 risk score is a weighted sum of those signals, not a black box. You decide the threshold that blocks, the one that challenges, and the one that lets traffic through.
Built for real support queues
We optimise for the cases that actually cost teams money: a legitimate customer on a corporate VPN, a mobile user behind CGNAT, and a fraud ring behind residential proxies.
Data sources and methodology
We aggregate registry data (RIR allocations, ASN ownership and route announcements), geolocation providers, public infrastructure lists such as TOR consensus data, and our own classification of hosting and proxy ranges. Results are cached for a configurable window so repeat lookups are fast and consistent, and refreshed automatically as the underlying data changes.
Detection is deliberately conservative about the infrastructure that everyone relies on. Public resolvers and large cloud front-ends are reported as hosting or datacenter traffic rather than as consumer VPN exits, because calling them a VPN would be misleading and would push teams into blocking traffic they should not block.
Accuracy and false positives
No IP dataset is perfect. Address space is reassigned, VPN vendors rotate ranges, and mobile carriers move thousands of subscribers behind a handful of addresses. Our position is simple: an IP verdict should be one input into your decision, never the only one. Use it to add friction — a verification step, a manual review — rather than to hard block, unless the signal is unambiguous.
If you believe an address is misclassified, tell us with the address and what you expected. Corrections go into the pipeline rather than a queue nobody reads.
Privacy stance
We work with network metadata, not personal profiles. We do not sell lookup data, we do not build cross-site tracking identities, and account data is covered by our privacy policy. Free tools on this site run without an account and store nothing you type into them.