---
updatedAt: 2026-09-23T10:07:56.000Z
agentTools:
  projectIndex: https://docs.sumsub.com/llms.txt
---

# Advanced IP check

Use digital footprint as an extra protection level.

The Advanced IP check lets you extract the IP address of the device your applicant uses for verification and run it through our databases to ensure it is genuine and secure.

With the Advanced IP check, you can:

* Ensure that cybercriminals do not intercept your applicant traffic.
* Reveal the applicant's location.
* Find out if your applicant uses a VPN to connect to the internet.

<Callout icon="📘" theme="info">
  ### Note

  The Advanced IP check is available at an additional cost. [Contact us](https://sumsub.com/contacts/) to learn more.
</Callout>

# How advanced IP check works

An IP address—short for Internet Protocol address—is a unique numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication. It serves as an identifier for the source and destination of internet traffic.

Your applicants' consent for personal data processing allows Sumsub to use built-in analytical tools to collect their IP addresses.

According to the internal logic, the system checks the data and returns a list of IP check parameters that represent the results of the check.

## IP address check automation

In the Dashboard, you can [create a client list](https://docs.sumsub.com/sumsub/docs/client-lists) with a set of values to manage matching applicants or transactions. When you create an **IP Ranges** list, you can set up conditions for automatic IP address checks.

The conditions of this check depend on the type of your list:

* **Blocklist** — IP addresses from that list will be automatically assigned with a **High risk** label.
* **Whitelist** — IP addresses from that list will be automatically assigned with a **Low risk** label.
* **Custom** — the system will not perform any automatic actions.

## Advanced IP check list

The following table explains the available Advanced IP check parameters.

<Table>
  <thead>
    <tr>
      <th>
        Check parameter
      </th>

      <th>
        Description
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        Abuse velocity
      </td>

      <td>
        Shows whether the IP address has been associated with frequent abusive behavior over the past 24–48 hours. The value can be High, Medium, Low, or empty if no abuse velocity data is available.
      </td>
    </tr>

    <tr>
      <td>
        Connection type
      </td>

      <td>
        Shows the type of network the applicant uses to connect to the internet. Possible values are `residential`, `cellular`, `business`, `hosting`, and `educational`.
      </td>
    </tr>

    <tr>
      <td>
        Hosting provider
      </td>

      <td>
        Shows whether the applicant's IP address belongs to a hosting provider rather than a regular internet service provider. A regular end user connecting from a hosting IP is unusual and often indicates a virtual machine or private proxy. Corporate VPNs also tend to fall into this category.

        The result of this check appears in two places:

        - In the **IP Check** block, it shows as one of three signals:
          - Not a hosting provider IP (no hosting provider detected).
          - Unable to verify hosting provider (no data available).
          - Hosting or data center IP (hosting provider detected).
        - In the **Risk labels** list, the **Hosting provider usage** label appears only when the IP check detects a hosting or data center IP.
      </td>
    </tr>

    <tr>
      <td>
        IP
      </td>

      <td>
        The IP address of the device used by the applicant during verification.
      </td>
    </tr>

    <tr>
      <td>
        Internet provider
      </td>

      <td>
        The company that provides internet access for the detected IP address.
      </td>
    </tr>

    <tr>
      <td>
        Location
      </td>

      <td>
        The country and city associated with the applicant IP address.
      </td>
    </tr>

    <tr>
      <td>
        Organization
      </td>

      <td>
        The legal name of the organization that owns or operates the detected IP address. This can match the internet provider or indicate another organization, such as a company, university, cloud provider, hosting provider, or data center.
      </td>
    </tr>

    <tr>
      <td>
        Timezone
      </td>

      <td>
        The timezone associated with the applicant IP address.
      </td>
    </tr>

    <tr>
      <td>
        Risk level
      </td>

      <td>
        Shows the overall risk level of the detected IP address. The value can be safe (GREEN), suspicious (YELLOW), or risky (RED).
      </td>
    </tr>

    <tr>
      <td>
        Relay
      </td>

      <td>
        Shows whether the applicant connects through a relay service, such as iCloud Private Relay or Cloudflare WARP, which routes traffic through an intermediary to mask the applicant originating IP address.<br /><br />This check result is reflected in two places:

        - In the **IP Check** block, it shows as one of three signals:
          - Not using relay (no relay detected).
          - Unable to verify relay (no data available).
          - Using relay (relay detected).
        - In the **Risk labels** list, the **Relay usage** label appears only when the IP check detects relay usage.
      </td>
    </tr>

    <tr>
      <td>
        Proxy
      </td>

      <td>
        Shows whether the applicant connects through a proxy server. A proxy is an intermediary server between the applicant device and the internet. It can hide the applicant original IP address or make the connection appear to come from another location. <br /><br />The value can be safe (GREEN), suspicious (YELLOW), or risky (RED).
      </td>
    </tr>

    <tr>
      <td>
        Residential Proxy
      </td>

      <td>
        Shows whether the applicant IP address is likely a residential proxy — an IP that appears to belong to a home internet connection but is actually being used to relay traffic for anonymization.

        This check's result is reflected in two places:

        - In the **IP Check** block, it shows as one of three signals:
          - Not a residential proxy.
          - Medium chance of residential proxy.
          - High chance of residential proxy.
        - In the **Risk labels** list:
          - **Medium chance of residential proxy** label appears when the IP check shows **Medium chance of residential proxy**, and none shows **High chance of residential proxy**.&#x20;
          - **High chance of residential proxy** label appears when the IP check shows **High chance of residential proxy**.
      </td>
    </tr>

    <tr>
      <td>
        VPN
      </td>

      <td>
        Shows whether the applicant connects through a VPN. A VPN routes internet traffic through another server and can hide the applicant’s original IP address or location. <br /><br />The value can be safe (GREEN), suspicious (YELLOW), or risky (RED).
      </td>
    </tr>

    <tr>
      <td>
        TOR
      </td>

      <td>
        Shows whether the applicant connects through the TOR network. TOR routes traffic through multiple intermediary servers to hide the user’s original IP address. <br /><br />The value can be safe (GREEN), suspicious (YELLOW), or risky (RED).
      </td>
    </tr>
  </tbody>
</Table>

The following connection types may appear in the IP check results.

| Connection type | Description                                                                                                                                                                                                                            |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Residential     | The IP address belongs to a regular home internet connection.                                                                                                                                                                          |
| Cellular        | The IP address belongs to a mobile network operator.                                                                                                                                                                                   |
| Business        | The IP address belongs to a corporate or business network.                                                                                                                                                                             |
| Hosting         | The IP address belongs to a server, cloud, hosting, or data center provider rather than a regular home or mobile internet connection. This may indicate that the applicant uses a VPN, proxy, remote server, or automated environment. |
| Educational     | The IP address belongs to an educational institution, such as a school, college, or university network.                                                                                                                                |

## Advanced IP check risk labels

The following [risk labels](https://docs.sumsub.com/sumsub/docs/applicant-risk-labels) are assigned to applicant profiles during the Advanced IP check and indicate certain characteristics of an applicant.

<HTMLBlock>{`
<style>
    .line {
        border-top: 1px solid rgb(0 0 0 / 10%);
        margin-bottom: -32px;
        margin-top: 50px;
    }

    [data-color-mode="dark"] .line {
        background-color: rgb(255 255 255 / 8%);
    }

    @media (prefers-color-scheme: dark) {
        [data-color-mode="system"] .line {
            background-color: rgb(255 255 255 / 8%);
        }
    }

    .footer-container {
        display: grid;
        grid-template-columns: repeat(2, 1fr);
        gap: 0px;
        margin-bottom: 0px;
        padding-top: 0px;
        max-width: 500px;
    }

    .footer-container h3 {
        font-size: 14px;
    }

    .footer-container basic {
        font-size: 12px;
        font-weight: 500;
        color: #5f666c;
        line-height: 24px;
    }

    .footer-container2 {
        display: grid;
        grid-template-columns: repeat(4, 1fr);
        gap: 0px;
        margin-bottom: 0px;
        padding-top: 0px;
        max-width: 800px;
    }

    .footer-container2 h3 {
        font-size: 14px;
    }

    .font-small-header {
        font-size: 14px;
        font-weight: 600;
    }

    --- .table-text {
        margin: 24px 0;
        border: 1px solid #e5e5e5;
        border-radius: 8px;
        overflow: hidden;
    }

    .wide-column {
        min-width: 180px;
    }

    table {
        border-collapse: collapse;
        width: 100%;
    }

    th {
        background-color: #f6f7f9;
        border: 1px solid #e5e5e5;
        padding: 8px;
        font-weight: bold;
        text-align: left;
    }

    @media (prefers-color-scheme: dark) {
        [data-color-mode="auto"] th {
            background-color: #303b42;
            border: 1px solid #e5e5e5;
        }
    }

    [data-color-mode="dark"] th {
        background-color: #303b42;
        border: 1px solid #e5e5e5;
    }

    td {
        border: 1px solid #e5e5e5;
        padding: 8px;
        text-align: left;
    }

    tr:nth-child(odd) {
        background-color: #fff;
    }

    tr:nth-child(even) {
        background-color: #f8f8f8;
    }

    .table-text h2 {
        font-size: 14px;
        margin: 0px;
        color: #384248;
    }

    @media (prefers-color-scheme: dark) {
        [data-color-mode="auto"] .table-text h2 {
            color: #ffff;
        }
    }

    [data-color-mode="dark"] .table-text h2 {
        color: #ffff;
    }

    .table-text p {
        font-size: 14px;
        margin: 0;
        color: #414552;
    }

    @media (prefers-color-scheme: dark) {
        [data-color-mode="auto"] .table-text p {
            color: #ffff;
        }
    }

    [data-color-mode="dark"] .table-text p {
        color: #ffff;
    }

    .table-text a {
        color: #377cf7;
        text-decoration: underline;
    }

    @media (prefers-color-scheme: dark) {
        [data-color-mode="auto"] .table-text a {
            color: #ffff;
        }
    }

    [data-color-mode="dark"] .table-text a {
        color: #ffff;
    }

    .table-text tr:first-child {
        margin-bottom: 20px;
    }

    ul2 {
        margin-left: -40px !important;
    }
    li2 {
        margin-bottom: 10px;
        display: flex;
        align-items: top;
    }
    .icongreen {
        margin-right: 10px;
        margin-top: 3px;
        min-width: 16px;
        height: 16px;
    }

    .iconred {
        margin-right: 10px;
        margin-top: 3px;
        min-width: 16px;
        height: 16px;
    }

    .flag-container {
        display: grid;
        grid-template-columns: repeat(3, 1fr);
        gap: 24px;
        padding-top: 0px;
    }

    .flag-container basic {
        font-size: 15px;
        color: #384248;
        line-height: 36px;
    }

    .flag-icon {
        width: 20px;
        height: 20px;
        margin-right: 5px;
    }

    .tag-green {
        display: inline-block;
        flex-direction: row;
        align-items: center;
        padding: 1px 4px;
        gap: 0px;
        background: #d0f1e8;
        border-radius: 4px;
        font-weight: 500;
        font-size: 12px;
        line-height: 16px;
        color: #115242;
        margin-top: 4px;
    }
    .tag-red {
        display: inline-block;
        flex-direction: row;
        align-items: center;
        padding: 1px 4px;
        gap: 0px;
        background: #ffd2ce;
        border-radius: 4px;
        font-weight: 500;
        font-size: 12px;
        line-height: 16px;
        color: #5e0214;
        margin-top: 4px;
    }
    .tag-purple {
        display: inline-block;
        flex-direction: row;
        align-items: center;
        padding: 1px 4px;
        gap: 0px;
        background: #eedbff;
        border-radius: 4px;
        font-weight: 500;
        font-size: 12px;
        line-height: 16px;
        color: #250960;
        margin-top: 4px;
    }
    .tag-grey {
        display: inline-block;
        flex-direction: row;
        align-items: center;
        padding: 1px 4px;
        gap: 0px;
        background: #edeff2;
        border-radius: 4px;
        font-weight: 500;
        font-size: 12px;
        line-height: 16px;
        color: #393f4e;
        margin-top: 4px;
    }
    .tag-yellow {
        display: inline-block;
        flex-direction: row;
        align-items: center;
        padding: 1px 4px;
        gap: 0px;
        background: #fff4c6;
        border-radius: 4px;
        font-weight: 500;
        font-size: 12px;
        line-height: 16px;
        color: #613400;
        margin-top: 4px;
    }
</style>

<div class="rdmd-table">
    <div class="rdmd-table-inner">
        <div class="table-text">
            <table>
                <tr>
                    <th>Label</th>
                    <th>API name</th>
                    <th>Description</th>
                </tr>
                <tbody>
                    <tr>
                        <td><div class="tag-yellow">VPN usage</div></td>
                        <td><code>vpnUsage</code></td>
                        <td>
                            <p>
                                Detects whether VPN connection is used.<br /><br />
                                Based on the \`RED\` VPN usage flag or risky ASN used.
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">TOR usage</div></td>
                        <td><code>torUsage</code></td>
                        <td>
                            <p>
                                Detects whether TOR connection is used.<br /><br />
                                Based on the \`RED\` TOR usage flag.
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">High risk IP</div></td>
                        <td><code>highRiskIp</code></td>
                        <td>
                            <p>
                                Indicates high risk IP addresses.<br /><br />
                                Based on the \`RED\` Risk level flag.
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">Devices from distant IP locations were used</div></td>
                        <td><code>distantIpLocations</code></td>
                        <td>
                            <p>
                                Login from different and distant IP addresses for a short period of time.<br /><br />
                                Based on the 100KM geographical distances between consecutive IP locations for applicant
                                actions with risky ASN used.
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">Mismatch between ID document country and IP country</div></td>
                        <td><code>idDocCountryVsIpCountryMismatch</code></td>
                        <td>
                            <p>
                                ID document country mismatches the country IP address.<br /><br />
                                Checks if there is any mismatch between the countries associated with the applicant's IP
                                address and ID documents.
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">Mismatch between applicant address and IP country</div></td>
                        <td><code>addressCountryVsIpCountryMismatch</code></td>
                        <td>
                            <p>
                                The physical address does not meet the IP address.<br /><br />
                                Checks if there is any mismatch between the address country and IP address country.
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <td>
                            <div class="tag-yellow">
                                Country of photo creation is different from IP and ID document countries
                            </div>
                        </td>
                        <td><code>exifCountryVsIdDocCountryOrIpCountryMismatch</code></td>
                        <td>
                            <p>
                                Country of photo creation is different from IP and ID document countries.<br /><br />
                                Checks if the country derived from the image metadata matches the applicant’s ID
                                document and IP country.
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">Failure to continue on another device</div></td>
                        <td><code>failedSessionContinuation</code></td>
                        <td>
                            <p>
                                The session was interrupted.<br /><br />
                                Based on the failed attempt to open a WebSDK link.
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">Multiple devices were used</div></td>
                        <td><code>multipleDevices</code></td>
                        <td>
                            <p>
                                Informs whether the applicant uses multiple devices (>1 device).<br /><br />
                                Set if multiple unique desktop devices were used.
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">Multiple mobile devices were used</div></td>
                        <td><code>multipleMobileDevices</code></td>
                        <td>
                            <p>
                                Informs whether the applicant uses multiple mobile devices (>1 mobile platform).<br /><br />
                                Set if multiple unique mobile devices were used.
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">Lengthy onboarding session</div></td>
                        <td><code>lengthySession</code></td>
                        <td>
                            <p>
                                The session lasts too long (>=10 minutes).<br /><br />
                                Set if the applicant ID uploading activity consists of two or more session attempts. It
                                calculates the time difference between the earliest and latest event timestamps. If the
                                time difference exceeds 10 minutes, this risk labels will be added.
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">Proxy usage</div></td>
                        <td><code>proxyUsage</code></td>
                        <td>
                            <p>Detects whether proxy is used. Triggered when the IP check shows <b>Using proxy</b>.</p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">Hosting provider usage</div></td>
                        <td><code>hostingProviderUsage</code></td>
                        <td>
                            <p>
                                Detects whether hosting provider is used. Triggered when the IP check shows
                                <b>Hosting or data center IP</b>.
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">Relay usage</div></td>
                        <td><code>relayUsage</code></td>
                        <td>
                            <p>Detects whether relay is used. Triggered when the IP check shows <b>Using relay</b>.</p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">Medium chance of residential proxy</div></td>
                        <td><code>mediumChanceResidentialProxy</code></td>
                        <td>
                            <p>
                                Indicates a medium chance that the IP address is a residential proxy. Triggered when the
                                IP check shows <b>Medium chance of residential proxy</b>.
                            </p>
                        </td>
                    </tr>
                    <tr>
                        <td><div class="tag-yellow">High chance of residential proxy</div></td>
                        <td><code>highChanceResidentialProxy</code></td>
                        <td>
                            <p>
                                Indicates a high chance that the IP address is a residential proxy. Triggered when the
                                IP check shows <b>High chance of residential proxy</b>.
                            </p>
                        </td>
                    </tr>
                </tbody>
            </table>
        </div>
    </div>
</div>
`}</HTMLBlock>

# Get started with advanced IP check

You can perform advanced IP check during both KYC and Transaction Monitoring. The setup depends on the selected flow.

## Advanced IP check during KYC

To start using the advanced IP check during KYC, complete the following steps.

### Step 1: Enable the setting

1. In the Dashboard, navigate to the **Verification levels** in the **Integrations** section.
2. Select the level of interest.
3. On the [Configurations](https://docs.sumsub.com/sumsub/docs/get-started-with-verification-level#set-configuration) tab of the **verification level settings**, open the [Fraud prevention](<doc: configure-verification-levels#fraud-prevention>) section, and enable the **IP insights** checkbox.

### Step 2: Verify applicants

Verify your applicants using the [WebSDK](https://docs.sumsub.com/sumsub/docs/web-sdk) or [MobileSDK](https://docs.sumsub.com/sumsub/docs/mobile-sdk).

<Callout icon="📘" theme="info">
  ### Note

  To perform advanced IP check during pre-KYC (e.g, on user sign up or login), create applicant via [this API method](https://docs.sumsub.com/sumsub/reference/create-applicant) and include the `creationTrackingData` object with the IP address.
</Callout>

## Advanced IP check during Transaction Monitoring

To start using the advanced IP check during the Transaction Monitoring, use one of the following methods:

* Send IP address via [this API method](https://docs.sumsub.com/sumsub/reference/submit-transaction-for-existing-applicant) when submitting a transaction for an **existing** applicant.
* Send IP address via [this API method](https://docs.sumsub.com/sumsub/reference/submit-transaction-for-non-existing-applicant) when submitting a transaction for a **non-existing** applicant.

# Review advanced IP check results

To view the Advanced IP check results:

1. In the Dashboard, go to the [Applicants](https://cockpit.sumsub.com/checkus#/applicants/individual?limit=10\&page=1) page and open the profile that you need.
2. Scroll down to the **IP check** section and review the results.

<Image src="https://files.readme.io/0aaed2fa0fd920d93399257e2acbacbf021baf3ddfa3fd0c0eafc830227a3ae5-new-IP-check.png" align="center" framed={true} />

Alternatively, you can use [this API method](https://docs.sumsub.com/sumsub/reference/get-ip-check-results) to get the results, as the following example demonstrates.

**Request**

```curl
curl -X GET \
    'https://api.sumsub.com/resources/checks/latest?applicantId=6735ad170942f455a3711bf3&type=IP_CHECK'
```

**Response**

```json
{
    "checks": [
        {
            "answer": "GREEN",
            "checkType": "IP_CHECK",
            "createdAt": "2025-05-28 15:42:24",
            "id": "142965bb-6775-4d85-a6ed-39aa94f7726a",
            "ipCheckInfo": {
                "ip": "33.199.219.172",
                "ipInfo": {
                    "ip": "33.199.219.172",
                    "countryCode2": "US",
                    "countryCode3": "USA",
                    "city": "Ashburn",
                    "state": "Virginia",
                    "stateCode": "US-VA",
                    "lat": 39.04,
                    "lon": -77.49,
                    "asn": 14618,
                    "asnOrg": "Amazon.com",
                    "org": "Amazon.com",
                    "riskyAsn": false,
                    "riskScore": 75.0,
                    "timezone": "America/New_York",
                    "connectionType": "hosting",
                    "proxy": true,
                    "vpn": true
                },
                "internetServiceProvider": "Amazon.com",
                "connectionType": "hosting",
                "organization": "Amazon.com",
                "proxy": "RED",
                "vpn": "RED",
                "tor": "GREEN",
                "riskLevel": "GREEN",
                "riskScore": 75.0
            }
        }
    ]
}
```