Block VPN, Tor and datacenter sign-ups
Block VPN sign-ups, or better, hold them: a player who registers through a VPN, a Tor exit node or a cloud server is hiding where they really are. InlineShield checks the IP address of every sign-up and tells you when it belongs to one of these networks, so you can send the account to review or KYC instead of paying out a bonus.
Last updated
Why the IP address matters for bonus abuse
Multi-accounters change IP addresses so their accounts don't line up. Players outside your licensed markets use VPNs to look as if they are inside them. Bot farms run from rented cloud servers because they are cheap and quick to replace.
None of these networks is proof of fraud on its own. Together with an alias email or a machine-made address, they are a strong hint.
What InlineShield checks
VPN providers
Tor exit nodes
Datacenter and hosting IPs
Time zone versus IP country
Hold, don't just block
By default a sign-up from a VPN, a datacenter IP or with a time-zone mismatch is held for review (verdict QUARANTINED) rather than refused. Each of these holds has its own switch in the console under Settings › Rules.
If you approve the held account, the signup.approved webhook comes back with recommendedAction: "require_kyc". The player gets in, and you check their identity before paying anything out. If you reject it, you get "block".
When a signal can't be worked out, for example there is no time zone or the IP country is unknown, it never holds a sign-up and never adds points. More on the answers in risk verdicts; plan limits are on the pricing page.
Frequently asked questions
Can a casino detect a VPN at sign-up?
Often, yes. The IP address can be checked against VPN provider lists, the Tor exit list and the networks of hosting providers. InlineShield does this for each sign-up and also compares the browser's time zone with the IP country.
Does iCloud Private Relay count as a VPN?
Not as a VPN: Apple's published Relay ranges are removed from the VPN list. Relay traffic that leaves through Cloudflare's network can still be flagged as a datacenter IP and held; you can switch the datacenter hold off in Settings › Rules.
Will VPN users be blocked automatically?
Not by default. They are held for review, so you decide. You can also switch the VPN hold off in Settings › Rules.
What do I need to send?
The player's IP address. With the browser script and /api/v1/siteverify it is captured for you; with the server-only /api/v1/verify call, send the visitor's IP from your own request, not your server's.
Where does the IP location data come from?
Country, city and network owner come from an IP location database (DB-IP), and Tor exit nodes from the public Tor exit list.
Screen your next sign-up for free
The Free plan includes 1,000 screenings a month. Create an account, add your keys and see real verdicts on your own traffic. No card, no sales call, no setup fee.