Signup and free-trial abuse

One person with a proxy list is not a hundred customers

Checking the network at registration costs a single call and closes the cheapest way there is to farm a free tier.

The problem

Free tiers are farmed by volume. A proxy list turns one person into as many accounts as they have addresses, and every one of them reads as organic growth in your dashboard right up until the infrastructure bill arrives.

The check belongs at registration, not on every request afterwards. One call per new account is nothing, and registration is the only moment where refusing costs you nothing either.

What to read in the response

Field	Why it matters here
`residential_proxy`	Traffic relayed through somebody's home connection. It is the expensive kind to buy and the hardest to spot, which is exactly why the accounts behind it are worth refusing.
`proxy`	True for HTTP, SOCKS and residential proxies together. Use it when you want one flag instead of three.
`score`	A number from 0 to 1, weighing every signal together. Use it when you would rather keep one threshold than a rule per flag.

The residential proxy flag is the one that should change your mind. A datacentre address on a signup form is often just a developer testing from a VM, and refusing it costs you a real user. A consumer connection being resold by the gigabyte is not an accident.

Wiring it up

import requests

def screen_signup(address: str) -> str:
    r = requests.get(
        f"https://novpn.fr/v1/check/{address}",
        headers={"Authorization": f"Bearer {NOVPN_KEY}"},
        timeout=2,
    )

    # Never seen, or we are having a bad day. Neither is the applicant's fault.
    if r.status_code == 404 or not r.ok:
        return "allow"

    check = r.json()

    if check["residential_proxy"]:
        return "refuse"
    if check["proxy"] or check["vpn"]:
        return "verify_email_first"

    return "allow"

Where to draw the line

Refuse on residential_proxy, hold for email verification on proxy or vpn, and let hosting through with a note on the account. Then watch what those accounts actually do for a fortnight before tightening anything.

What happens on an address nobody has seen

An address the database holds nothing on answers 404, not a low score. That is deliberate: there is no country, no operator and no ASN to return either, so a result would be a row of nulls dressed up as an answer. Treat it as no opinion rather than as clean, and decide for your own case whether to let the request through. The address goes into the scan queue and usually resolves within minutes, and the call is free on a paid plan.

Every field, every error code and the exact billing rules are in the documentation. Endpoints

Other things people use it for

Try it against your own traffic.

The free tier is a plan, not a trial. Sign up, copy your key, and make the first call before you decide anything.

Get started