Detect VPNs, proxies, bots, and Tor nodes for any IP address via MPP micropayment.
What it does
This endpoint wraps the Abstract API IP Intelligence service behind the Locus MPP (Micropayment Protocol) gateway. Given an IP address, it returns intelligence about whether that IP is associated with a VPN, proxy, bot, or Tor exit node. The endpoint accepts a POST request with a JSON body containing the target `ip_address` and an optional `fields` parameter to limit which fields are returned.
Payment is handled via the Tempo method (pathUSD on Tempo L2) at 6,000 base units per call. Assuming pathUSD uses 6 decimals, this translates to $0.006 (six-tenths of a cent) per lookup. The upstream API reference and documentation are available at Abstract API's site. The OpenAPI spec is well-defined with a clear request schema, though no response schema is provided in the probe material.
Note: The probe only tested HEAD and GET methods, both of which returned 404. The OpenAPI spec defines this as a POST endpoint, so the 404s on HEAD/GET are expected routing behavior, not evidence the endpoint is down. The endpoint is likely live when called with the correct POST method and payment headers.
Capabilities
Use cases
- —Detecting whether a visitor's IP is behind a VPN or proxy for fraud prevention
- —Filtering bot traffic by checking IP intelligence before processing requests
- —Enriching security logs with VPN/proxy/Tor classification per IP
- —Gating access to content or services based on IP threat signals
- —Real-time IP risk scoring in payment or signup flows
Fit
Best for
- —Agents needing per-call IP threat intelligence without API key management
- —Fraud detection pipelines that need VPN/proxy/Tor classification
- —Low-volume or bursty workloads where micropayment-per-call beats a subscription
Not for
- —High-volume bulk IP scanning (micropayment overhead adds up)
- —Use cases requiring full geolocation data beyond threat intelligence (check if fields parameter covers your needs)
Quick start
curl -X POST https://abstract-ip-intelligence.mpp.paywithlocus.com/abstract-ip-intelligence/lookup \
-H "Content-Type: application/json" \
-H "X-Payment: <tempo-payment-token>" \
-d '{"ip_address": "8.8.8.8"}'Example
Request
{
"fields": "is_vpn,is_proxy,is_tor,is_bot",
"ip_address": "8.8.8.8"
}Endpoint
Quality
The OpenAPI spec provides a clear request schema, pricing info, and upstream doc links. However, no response schema is available, the probe only tested HEAD/GET (not the required POST), so liveness is inferred rather than confirmed, and crawl pages returned no useful content. Response example is not available from any source.
Warnings
- —Endpoint liveness not directly confirmed — probe used HEAD/GET but the endpoint is POST-only; 404s are expected for wrong methods
- —No response schema provided in OpenAPI spec or crawl material
- —Price assumes pathUSD uses 6 decimals (standard for USD stablecoins) — not explicitly confirmed in probe
Citations
- —Endpoint is defined as POST with ip_address (required) and fields (optional) parametershttps://abstract-ip-intelligence.mpp.paywithlocus.com
- —Payment intent is 'charge' via Tempo method at amount 6000 in pathUSDhttps://abstract-ip-intelligence.mpp.paywithlocus.com
- —Upstream API reference at Abstract API docshttps://docs.abstractapi.com/ip-intelligence
- —Service description: Detect VPNs, proxies, bots, and Tor nodes by IP addresshttps://www.abstractapi.com/api/ip-intelligence-api