Threat intelligence
Proxy, VPN and TOR detection that explains itself
Knowing where an address sits is only half a decision. The other half is how the connection is being made — through a home broadband line, a rented server, a commercial VPN, or a residential relay someone is paying for by the gigabyte. Guarda returns both in the same response, along with the reasons behind the verdict so a human can review it later.
What we classify
Commercial VPN
Consumer VPN exits operated by subscription providers. Common, mostly harmless on its own, and a strong signal when it appears at checkout with a mismatched billing country.
Residential proxy
Traffic relayed through a real consumer connection, usually rented by the gigabyte. The hardest category to catch, because the exit looks like an ordinary household — we lean on rotation behaviour and known relay ranges rather than the address alone.
Public and web proxy
Open proxies and browser-based relays scraped from public lists. Almost never legitimate on a paid product.
TOR exit node
Published exit relays, refreshed continuously. Legitimate for privacy-conscious readers, rarely legitimate for payments or signups.
Hosting and cloud
Addresses that belong to datacenters rather than people. Correct geolocation, wrong assumption if you treat it as a human visitor.
Verified crawler
Search engine and monitoring bots confirmed by forward-confirmed reverse DNS, so your own indexing never gets caught by a blanket rule.
Reported abuser
Addresses seen in credential stuffing, scraping and spam reporting within a recent window. Age matters — an address burned six months ago is often a clean household today.
Fields you get back
| proxy_type | The single most specific label for the connection. |
|---|---|
| vpn / tor / public_proxy / web_proxy | Individual anonymiser flags, so you can weight them differently. |
| hosting | Datacenter or cloud infrastructure. |
| residential | Looks like an ordinary consumer line. |
| search_bot | Verified crawler. |
| abuser | Recent abuse reporting on this address. |
| risk | 0–100 composite score. |
| risk_level | Low, medium, high or critical banding. |
| risk_reasons | The specific signals that produced the score. |
| confidence | How firmly the detection layer stands behind the verdict. |
Score, then decide
A single flag is a poor rule. "VPN" blocks a large share of privacy-minded paying customers; "hosting" blocks every corporate proxy and half of the API integrations your own customers build. What works is combining the classification with account history and the value at stake.
We suggest three tiers. Log everything below your medium threshold and use it for analytics. Challenge in the middle band — a one-time code or a card verification costs a legitimate user twenty seconds. Reserve hard blocks for the narrow top band where several independent signals agree, and always give the user a way to reach support.
Because risk_reasons travels with the score, an analyst reviewing a disputed decision six weeks later can see exactly what fired instead of guessing.
Why freshness decides this category
Geolocation moves slowly; anonymiser data moves hourly. VPN operators add and retire exits constantly, cloud ranges get re-leased, and residential relay pools rotate by design. A dataset you download on the first of the month is at its least accurate exactly where accuracy matters most. Guarda resolves classification at request time, which is why we publish it as an API rather than a file.