Fraud Detection API - IP, Email, Phone and URL Risk Score

Four fraud checks behind one key. Give it an IP, an email address, a phone number or a URL, and get back a score from 0 to 100 plus the evidence behind it. One flat row per lookup.

What this actor does

• Scores four kinds of value on one scale. IP addresses, email addresses, phone numbers and URLs all come back with a fraud score from 0 to 100 where higher is worse, so a threshold you tune on one service means the same thing on the others.
• Separates the kinds of proxy. Web proxy, VPN, active VPN, Tor, active Tor, data centre, residential, crawler and bot are distinct fields rather than one collapsed flag, because a corporate VPN, a residential proxy and a Tor exit node are three different findings that deserve three different responses.
• Validates email properly, not just syntactically. Deliverability, SMTP score, catch-all, disposable, generic, honeypot, spam trap score, frequent complainer, recent abuse, leaked in a breach, risky TLD, DNS and MX records, SPF and DMARC, domain age and trust, plus a suggested correction when an address looks like a typo of a real domain.
• Tells you whether a phone number is actually in service. Valid and active are different questions: a well-formed number in a real range can still be disconnected. You also get line type, carrier, VoIP and prepaid flags, do-not-call and TCPA list status, and an SMS pumping risk score, which is the one that matters if you send one-time codes.
• Scans URLs for phishing, malware and parking. Category, server, status code, final URL after redirects, technologies detected, domain age and rank, and separate phishing, malware, suspicious, spamming and adult flags.
• Normalises the score the provider does not. The URL service names its number a risk score while the other three call the same idea a fraud score. Both are written to one column here, so a single threshold filter works across a mixed set of runs.
• Refuses inputs that cannot work, before they cost anything. Every request is charged whether or not it returns a result, so a value that is not the kind this service looks up is refused locally and recorded as a refusal instead of being paid for.
• Reads the body, not the status code. This provider reports a refused key, a spent balance and a bad input with a normal HTTP 200. An actor that trusts the status code writes hundreds of empty rows and charges for them. This one decides on the body.
• Never puts your key in a log. The credential travels in the URL path with this provider, which makes every request URL a secret. Nothing here logs one.
• Never charges for a miss. Only rows carrying a resolved result are billed.

Input

Field	What it does
mode	Which service to run: IP, email, phone or URL.
queries	The values to score, one per line.
strictness	How aggressively the provider judges a value.
allowPublicAccessPoints	Stop penalising shared institutional networks.
lighterPenalties	Soften scoring to cut false positives.
userAgent	End user agent string, as an extra IP signal.
userLanguage	End user language, as an extra IP signal.
timeoutSeconds	How long the email service may spend per address.
fastMode	Skip the slowest email checks.
phoneCountries	Countries a national-format number might belong to.
extraParams	JSON query parameters passed through as written.
minFraudScore	Keep only rows scoring at or above this.
maxFraudScore	Keep only rows scoring at or below this.
requireValid	Keep only values the provider marked valid.
deliverability	Keep only these email deliverability levels.
excludeDisposable	Drop throwaway email domains.
excludeCatchAll	Drop catch-all domains.
excludeRecentAbuse	Drop values recently involved in abuse.
excludeProxies	Drop proxies, VPNs and Tor nodes.
excludeBots	Drop bots and crawlers.
requireActivePhone	Keep only numbers currently in service.
excludeVoip	Drop internet telephony numbers.
lineTypes	Keep only these phone line types.
unsafeOnly	Keep only URLs flagged unsafe.
countries	Keep only these countries.
connectionTypes	Keep only these IP connection types.
requestsPerMinute	Pace the run under your plan's rate limit.
skipNotFound	Leave misses and refusals out of the dataset.
maxResults	Hard cap on rows, and therefore on spend and run time.
apiKey	Your own API key. Stored as a secret.

Example output

{
  "found": true,
  "mode": "ip-reputation",
  "query": "8.8.8.8",
  "requestId": "kJ9NgHNPnB",
  "fraudScore": 0,
  "isProxy": false,
  "isVpn": false,
  "isTor": false,
  "isActiveVpn": false,
  "isActiveTor": false,
  "isCrawler": false,
  "botStatus": false,
  "recentAbuse": false,
  "frequentAbuser": false,
  "highRiskAttacks": false,
  "abuseVelocity": "none",
  "securityScanner": false,
  "trustedNetwork": true,
  "sharedConnection": false,
  "dynamicConnection": false,
  "isMobile": false,
  "isp": "Google LLC",
  "organization": "Google Public DNS",
  "asn": 15169,
  "host": "dns.google",
  "connectionType": "Corporate",
  "countryIso2": "US",
  "region": "California",
  "city": "Mountain View",
  "zipCode": "94043",
  "timezone": "America/Los_Angeles",
  "latitude": 37.4056,
  "longitude": -122.0775,
  "error": null,
  "raw": { }
}

Frequently asked questions

What does the fraud score mean?

It is a single number from 0 to 100 where higher is riskier, produced by the provider from every signal it holds about that value. Scores under about 75 are generally ordinary traffic, the 75 to 85 band is where suspicious activity starts, and above that is where most systems refuse or challenge. Those are starting points rather than rules: the right threshold depends on what you lose from a false positive against what you lose from a missed fraud, so run a sample of known-good and known-bad values through first and read the distribution before you set a cutoff.

What is the difference between the four services?

They take four different kinds of input and answer four different questions, so a run uses one at a time. The IP service answers whether a connection is what it claims to be: proxy, VPN, Tor, bot, and where it actually is. The email service answers whether an address will receive mail and whether it belongs to a real person. The phone service answers whether a number is valid, in service, and safe to send a code to. The URL service answers whether a link is dangerous. All four return a score on the same scale.

Why does the actor refuse some of my inputs before sending them?

Because this provider charges per request whether or not the request returns anything useful. A string with no at sign is not an email address, a string with fewer than seven digits is not a phone number, something that is neither four dotted numbers nor a colon separated hextet run is not an IP address, and a string with no dot in its host is not a URL. Sending those costs money and teaches you nothing. They are refused locally and written to the dataset as refusals with the reason, so a run that ignored part of its list does not look like a run whose provider found nothing.

Why did my run succeed but return nothing when my key was wrong?

It should not, and with this actor it does not. This provider reports a refused key, an exhausted balance and a malformed request with a normal HTTP 200 status and a body saying success false. An integration that checks the status code sees four hundred successful responses and writes four hundred empty rows. This actor decides on the body, tells the difference between a credential problem and a bad input from the message text, and ends the run cleanly with the reason as the run's status message when the credential is the problem.

What is strictness and should I raise it?

It controls how aggressively the provider judges a value. Zero is the balanced default, and each step up catches more genuine fraud while also flagging more legitimate traffic. Raise it one step at a time and compare what changed, rather than jumping to the maximum: at the top setting on the IP service you will catch nearly everything and also flag a good number of ordinary users on shared connections. If false positives are the bigger cost, leave strictness alone and turn on lighter penalties and allow public access points instead.

What is SMS pumping risk and why does it have its own field?

SMS pumping is a fraud where somebody triggers your one-time-code flow against premium-rate numbers they control and collects a share of the termination fees. It costs you real money without ever touching an account. The phone service returns a dedicated risk score for it, separate from the general fraud score, because the countermeasure is different: you are deciding whether to send a message at all rather than whether to trust a user.

Does the URL service follow redirects?

Yes, and the row records both ends: the address you submitted and the final address after redirects, along with the status code and the server. That matters because a shortened or cloaked link is safe-looking by design and the destination is the thing worth scoring.

Can I use a parameter this actor does not have a field for?

Yes. The extra parameters field takes a JSON object and appends it to the query string exactly as written. Each of the four services takes its own parameter set and the provider adds to them over time, so only the documented ones have named fields and anything else goes there. A parameter that does not apply to the service you are running simply has no effect.

Do I need my own API key?

Yes. This actor does not include data access. You use your own API key from IPQualityScore, which is the provider whose fraud scoring API this actor calls, taken from the settings page of your provider account and pasted into the apiKey field, where it is stored as an Apify secret. Your own plan, credit balance and terms apply.

What happens when a lookup returns nothing?

A negative answer is a result, not a miss: the provider telling you an address is undeliverable or a URL is malicious is exactly the question you asked, so that row is written and billed like any other. A miss is a value the provider would not answer for at all, and a refusal is an input that never left this actor. Both are written with found: false and never billed. Set skipNotFound to true to leave them out entirely.

How much does a run cost?

Pricing is pay per result: you are charged for each value scored into the dataset, and never for misses, for locally refused inputs, for rows dropped by the filters, or for duplicates. Apify platform usage is included in the per-result price. Your own API provider's credit balance is separate and billed by them.

Keyword map

fraud detection API, fraud score API, IP reputation API, proxy detection API, VPN detection API, Tor exit node detection, residential proxy detection, data centre IP detection, bot detection API, IP geolocation API, email validation API, email verification API, disposable email detection, catch all detection, spam trap detection, email deliverability check, phone validation API, phone number lookup, line type detection, carrier lookup, VoIP detection, active phone number check, SMS pumping detection, do not call list check, TCPA compliance check, malicious URL scanner, phishing detection API, malware URL check, link safety API, domain reputation API, account takeover prevention, bot signup prevention, chargeback prevention, ad fraud detection