Welcome to Guarda: IP Intelligence for Real Traffic Decisions
An introduction to Guarda — what our IP intelligence API checks, how the risk score is built, and how teams use it to separate real users from proxies, VPNs and bots.
Why we built Guarda
Every online product eventually meets the same problem: a request arrives, and you have a few milliseconds to decide how much to trust it. The account might be genuine. It might be the fifth signup from a rented datacenter IP in the last minute. The only thing you reliably have at that moment is the connection itself — the IP address, the network behind it, and what that network is normally used for.
Guarda exists to turn that thin signal into something you can act on. We look up an address, classify the network it belongs to, and hand back a verdict plus the evidence behind it.
What a lookup actually returns
A single call to the API gives you:
- Connection type — residential, mobile carrier, business, or hosting/datacenter.
- Anonymiser flags — proxy, VPN, TOR exit node, or open relay.
- Network identity — ASN, organisation name, and the range the address sits in.
- Geolocation — country, region and city, with an honest note that city-level data is an estimate, not a fact.
- Risk score — a 0–100 summary of everything above, so you can write one threshold instead of ten rules.
The important part is that the evidence travels with the score. If an address is flagged, you can see whether that was because it belongs to a cloud provider, because it appears on a TOR exit list, or because the hosting ASN has a history of automated abuse. Scores that cannot be explained are scores nobody trusts in a production review queue.
Classification over labels
One thing we care about more than most: calling a network what it actually is. A Google DNS resolver or a Cloudflare address is not a VPN. It is infrastructure. Labelling all non-residential traffic "VPN" is the fastest way to lose a fraud team's confidence, because the first time an analyst checks a familiar IP and sees a wrong label, every other verdict becomes suspect.
So Guarda separates hosting/datacenter from commercial VPN, and both from residential proxy. Those three things carry very different risk in practice, and they deserve different responses.
How teams use it
The patterns we see most often:
- Signup protection. Score at registration; send high-risk addresses to email or phone verification instead of an outright block.
- Payment risk. Combine the IP verdict with billing country mismatch and card velocity. IP alone should never decline a payment, but it is an excellent tie-breaker.
- Content and licensing. Detect commercial VPN exits where geographic rights genuinely require it.
- Analytics hygiene. Strip datacenter traffic from reporting so your conversion numbers describe humans.
Designed for the hot path
The API is a single HTTP call with a key, JSON in and JSON out, and results are cached so repeated checks of the same address do not cost you a round trip. Batch lookups exist for log analysis and backfills. You can try any address on the homepage without an account before you write a line of code.
What comes next on this blog
We will keep this blog practical: how detection signals actually work, where they fail, what false positives cost, and how to build policies that block abuse without punishing the customer on hotel Wi-Fi. If there is something you want covered, tell us — this is the reference we wished existed when we started.
Welcome aboard.