Detect VPN, Proxy & Tor in PHP

No dedicated call needed — the flags ride along with a normal lookup.

<?php

use IpApiIo\Client;

$client = new Client(apiKey: getenv('IP_API_IO_KEY'));

$info = $client->lookup('185.220.101.1');
$f = $info['suspicious_factors'];

var_dump($f['is_vpn']);        // VPN service
var_dump($f['is_proxy']);      // open / anonymizing proxy
var_dump($f['is_tor_node']);   // Tor node
var_dump($f['is_datacenter']); // hosting / datacenter IP (often a bot)
var_dump($f['is_spam']);       // known spam source
var_dump($f['is_crawler']);    // known crawler / bot
var_dump($f['is_threat']);     // listed on a threat feed

if ($f['is_vpn'] || $f['is_proxy'] || $f['is_tor_node']) {
    // require step-up verification (CAPTCHA, 2FA)
}

A dedicated check against the live Tor node list, with a count of matching nodes.

$tor = $client->torCheck('185.220.101.1');

var_dump($tor['is_tor']);         // true
echo $tor['tor_node_count'];      // number of matching Tor nodes