Game servers
Stop ban evasion and alt farming at the connection
Ban evasion, alt farming and bot swarms arrive through the same two doors: commercial VPNs and cheap datacentre addresses. One check at login tells you which door a player came through.
The problem
A banned player does not go away, they come back through a VPN. Alt farming needs a fresh address for every account and the cheapest source of those is a datacentre. Both arrive looking like a new player to a server that only knows usernames.
Checking the address does not identify the person, and it is not meant to. It tells you whether the connection is the kind a player at home actually has, which is the one question a ban list cannot answer.
What to read in the response
| Field | Why it matters here |
|---|---|
hosting |
The strongest signal you have here. A person plays from a home connection, so a game client arriving from a datacentre is a bot, a proxy hop, or somebody deliberately hiding. |
vpn |
A commercial VPN. Common enough among honest players, including ones whose ISP throttles game traffic, that it deserves a challenge rather than a block. |
score |
A number from 0 to 1, weighing every signal together. Use it when you would rather keep one threshold than a rule per flag. |
A quirk worth knowing: hosting on its own contributes only 30 out of 100 to the score, and that is deliberate. Plenty of legitimate traffic is hosted, because servers call APIs. For a game client that reasoning does not apply, since nobody plays from a rack. Read the boolean directly here rather than waiting for the score to cross a line.
Wiring it up
const res = await fetch(`https://novpn.fr/v1/check/${address}`, {
headers: { Authorization: `Bearer ${process.env.NOVPN_KEY}` }
});
// 404 means the database has never seen this address. No opinion, so let them in.
if (res.status === 404) return allow();
if (!res.ok) return allow(); // fail open: a login queue is worse than a cheat
const check = await res.json();
if (check.hosting || check.score >= 0.85) return refuse();
if (check.vpn || check.score >= 0.5) return challenge();
return allow();Where to draw the line
Refuse account creation above 0.85, challenge between 0.5 and 0.85, let the rest through. Keep outright bans for behaviour rather than for an address: a shared campus connection and a VPN exit look similar from here, and only one of them is cheating.
What happens on an address nobody has seen
An address the database holds nothing on answers 404, not a low score. That is deliberate: there is no country, no operator and no ASN to return either, so a result would be a row of nulls dressed up as an answer. Treat it as no opinion rather than as clean, and decide for your own case whether to let the request through. The address goes into the scan queue and usually resolves within minutes, and the call is free on a paid plan.
Every field, every error code and the exact billing rules are in the documentation. Endpoints
Other things people use it for
Try it against your own traffic.
The free tier is a plan, not a trial. Sign up, copy your key, and make the first call before you decide anything.
Get started