A proxy is an intermediary server that forwards traffic between a user and the wider internet. Requests routed through a proxy appear to come from the proxy's IP, not the user's. Proxies have legitimate uses (corporate networks, content caching, geographic testing), but they also show up in fraudulent signups, scraping operations, and account-takeover attempts where the goal is to mask the real source.
A proxy check looks up an IP and returns whether it is acting as a proxy. The check returns a boolean signal plus context: country, hosting status, and whether the IP also shows up as a VPN. It is the standard input for any decision that depends on knowing whether a request is coming from a real user IP or an anonymizing intermediary.
When you submit an IP address, the check runs three steps:
Open-proxy lists and commercial proxy infrastructure change constantly, so the underlying data is refreshed continuously and a proxy that came online this week is reflected in the check. Most checks complete in under 200ms.
The check is a fraud-detection tool: it tells you when an inbound IP is acting as a proxy. If you are testing your own purchased proxies, you want a different category of tool entirely.
What it identifies: inbound proxy traffic across the proxy categories most commonly used to mask the source of requests. That includes anonymous and transparent proxies with a public footprint, datacenter proxies (cross-validated by the hosting and ASN-type signals), SOCKS4 and SOCKS5 proxies on public lists, residential proxies where behavioral signals are detectable, and whether the IP also shows up as a VPN or hosting endpoint. Best for signup fraud screening, scraping defense, ad fraud detection, account-takeover screening, and abuse investigation.
What it does not do: this is not a proxy validation tool. It will not tell you whether your purchased proxies are working, fast, or returning the country they claim. For that buyer-side workflow, tools like proxyscrape.com and proxy-seller.com are built for the job. It is also not a complete residential proxy detector — true residential proxies with no public footprint look indistinguishable from regular user traffic at the network level. For fuller anonymizer coverage, combine with the VPN Checker and Tor Checker.
A false result on the proxy check means "no proxy detected on this IP," not "the user is definitely not anonymized." For high-stakes decisions, combine proxy, VPN, Tor, and hosting signals rather than relying on any one alone.
Signup fraud screening: Catch fraudulent signups masking their real IP. Proxy traffic on signup is a strong indicator of fake accounts, promo abuse, and policy violations. Combine the proxy flag with VPN, Tor, and hosting status to filter the patterns most associated with bad actors.
Scraping and automation defense: Identify proxy-routed traffic hitting your endpoints. Scrapers, credential stuffers, and automated abuse rotate through proxy pools to evade rate limits and bot detection. The proxy flag plus hosting status gives you a fast, deterministic gate to apply at the edge.
Ad fraud and analytics hygiene: Proxy traffic distorts campaign attribution, geographic reporting, and ad delivery. Flagging it lets you exclude or annotate it in your data pipelines, keeping conversion metrics and audience reports cleaner.
Account-takeover screening: A login from a proxy IP that the legitimate user has never used is a strong risk signal. Combine the proxy flag with device fingerprinting, login history, and behavioral signals to flag suspicious sessions for step-up authentication.
curl --request GET \
--url https://ip-intelligence.abstractapi.com/v1{
"ip_address": "185.197.192.65",
"security": {
"is_vpn": true,
"is_proxy": true,
"is_tor": false,
"is_hosting": false,
"is_relay": false,
"is_mobile": false,
"is_abuse": false,
},
"asn": {
"asn": 136787,
"name": "PacketHub S.A.",
"domain": "packethub.tech",
"type": "isp",
},
"company": {
"name": "PacketHub S.A.",
"domain": "packethub.tech",
"type": "isp",
},
"domains": {
"domains": []
},
"location": {
"city": "Miami",
"city_geoname_id": 4164138,
"region": "Florida",
"region_iso_code": "FL",
"region_geoname_id": 4155751,
"postal_code": "33197",
"country": "United States",
"country_code": "US",
"country_geoname_id": 6252001,
"is_country_eu": false,
"continent": "North America",
"continent_code": "NA",
"continent_geoname_id": 6255149,
"longitude": -80.1946,
"latitude": 25.7689,
},
"timezone": {
"name": "America/New_York",
"abbreviation": "EST",
"utc_offset": -5,
"local_time": "12:07:51",
"is_dst": false,
},
"flag": {
"emoji": "🇺🇸",
"unicode": "U+1F1FA U+1F1F8",
"png": "https://static.abstractapi.com/country-flags/US_flag.png",
"svg": "https://static.abstractapi.com/country-flags/US_flag.svg",
},
"currency": {
"name": "US Dollar",
"code": "USD",
"symbol": "$"
}
}A proxy is an intermediary server that forwards traffic between a user and the wider internet. Requests appear to come from the proxy's IP address rather than the user's real one. Proxies come in several flavors: anonymous proxies hide the source, transparent proxies pass it along, datacenter proxies run on cloud or hosting infrastructure, and residential proxies route through real consumer connections to look like normal user traffic.
Abstract cross-references the IP against public open-proxy lists, behavioral signals (port patterns, connection counts, ASN type), and datacenter/hosting flags. The check returns true if the IP is acting as a proxy, plus context like country, hosting status, and whether the IP also shows up as a VPN. The result returns in under 200ms.
Some can, but not all. Residential proxies route through real consumer connections, so they look indistinguishable from regular user traffic at the network level. Major commercial residential proxy providers leave detectable patterns (ASN behavior, repeat-client signals) that can flag a portion of their traffic, but a true residential proxy with no public footprint is the hardest case in proxy detection. Treat a true result as a strong signal; treat a false result as "no proxy detected" rather than a guarantee.
A proxy forwards specific requests through an intermediary IP, often without encryption. A VPN is a commercial service that encrypts and tunnels all traffic from a device through a remote server. Tor is a volunteer network that routes traffic through three hops to anonymize the source. They overlap in purpose (masking the real IP) but differ in how they work and how they show up in detection. Abstract has separate checks for each.
This tool detects proxies in incoming traffic. Paste an IP from your logs or signup form, and the check tells you whether that IP is acting as a proxy. If you want to test whether your own purchased proxies are working (speed, anonymity, location accuracy), tools like proxyscrape.com and proxy-seller.com are built for that workflow. Different question, different tool.
Yes. The online tool is free with no signup required for individual lookups. For programmatic access, Abstract's IP Intelligence API offers a free tier with 1,000 requests per month. View pricing for higher-volume plans.