Check a phone number, an email address or an IP address for fraud signals.
Pick what you want to check, enter it and see the fraud signals on record. It is free, with no signup.
Works for US and Canadian numbers. Enter 10 digits, such as (202) 555-0138.
Free & rate-limited. No signup required to try.
Free & rate-limited. No signup required to try.
Free & rate-limited. No signup required to try.
A fraud checker looks up a phone number, an email address or an IP address and shows the signals fraud teams read first. 1Lookup's free checker shows whether a number is reported as spam, whether an email address is a throwaway inbox, and whether an IP address is flagged as a proxy, a VPN, a Tor exit or hosting.
- Free, no signup
- Phone, email and IP in one place
- Never contacts the number or address
- Says so when it cannot tell
You can run a fraud check in under a minute.
Pick what you have.
Choose the Phone number, Email address or IP address tab, whichever value you were given.
Enter it and run the check.
Nothing is sent to the number, the address or the person behind them.
Read the first field.
Each tab opens with the field that matters most: the spam and fraud risk for a number, whether an email address is a throwaway inbox, and the risk level for an IP address.
Combine what you find.
One flag is a reason to look closer. Two or three that agree, such as a throwaway email address on a proxy IP address, are a stronger reason to ask for more proof.
Need this at scale? Fraud Detection API
Run the phone, email and IP checks on one signup in a single call and act on the combined answer.
A fraud check reads the signals that sit on a phone number, an email address or an IP address, and no single signal proves fraud.
Fraud rarely shows itself in one place. A new account arrives with a phone number, an email address and an IP address, and each one carries a few checkable facts: whether the number has been reported as spam, whether the address is a throwaway inbox, and whether the connection comes from a proxy or a hosting network. This page runs each of those checks for free, one value at a time.
The scale is real. The FBI's Internet Crime Complaint Center received 1,008,597 complaints in 2025, with reported losses of $20.877 billion, which is an average of $20,699 a complaint. Phishing and spoofing, the crime type that starts with a fake message or call, drew 191,561 of them, more than any other type.
A check is evidence and not a verdict. A flag is a reason to ask for a second proof or to look at an account again, and a clean result means only that none of these signals were raised. Each tab says so when it cannot tell: a number nobody has rated shows as Not rated, an IP list that could not be read shows as Not checked, and a mailbox the mail server did not confirm shows as uncertain.
The Fraud Detection API runs the same three checks on every signup and every order.
When the checks have to run inside your own software or across a list, the API returns the phone spam rating, the email address checks and the IP flags for 1 credit a lookup. See the Fraud Detection API. To check a number's reputation on its own, use our free phone number fraud checker. To see whether an IP address is a proxy or a VPN, use our free VPN and proxy detection. To check whether a phone number is on an internet-calling line, use our free virtual number checker. To check an email address for deliverability in depth, use our free email verifier. To read the guide behind these checks, see our guide to detecting fake phone numbers.
The phone tab returns these fields, and each one answers a different question.
This is an invented result for a made-up number, laid out the way a check comes back. The first four fields are free on this page, and a free account opens the rest.
- Spam and fraud riskHigh
- Reported as spamYes
- Flagged as a robocallerNo
- Suggested actionBlock the number
Opens with a free trial
- The risk score behind the rating78 out of 100
- The risk factors behind the ratingSPAM_REPORTS
Spam and fraud risk
The rating, from low to high, or Not rated when the number has no reputation on record. It is the first field to read.
Reported as spam
Whether the number is reported as spam. No means its reputation is good, and Not rated means nobody has rated it.
Flagged as a robocaller
Whether the number is flagged as an automated caller. An automated line that people rate well can be flagged and still rate low.
Suggested action
A plain next step: no action needed, verify, review or block the number.
The risk score behind the rating
The 0 to 100 score the rating comes from.
The risk factors behind the rating
The reasons the rating lists, which are the signals that were raised.
The email tab returns these fields, and each one answers a different question.
This is an invented result for a made-up address, laid out the way a check comes back. The first six fields are free on this page, and a free account opens the rest.
- Throwaway addressNo
- Mailbox deliverableDeliverable
- Valid formatYes
- Mail servers foundYes
- Provider typeCompany domain
- Shared team addressNo
Opens with a free trial
- Whether the mail server confirmed the mailboxConfirmed
- Catch-all domain flagNo
- Age of the domain3,412 days
Throwaway address
Yes when the address belongs to a temporary inbox service. It is the first field to read.
Mailbox deliverable
Whether mail to the address can be delivered: deliverable, undeliverable, risky, a temporary inbox or uncertain.
Valid format
Whether the address is written the way an email address must be.
Mail servers found
Whether the address's domain publishes mail servers. A domain with none cannot receive mail.
Provider type
Whether the address sits on a free provider, a company domain or a throwaway provider.
Shared team address
Yes for an address such as info@ or support@, which a team shares and a person does not own.
Whether the mail server confirmed the mailbox
Whether the receiving mail server accepted the mailbox when asked.
Catch-all domain flag
Yes when the domain accepts mail for any address, which makes a confirmed mailbox less telling.
Age of the domain
How long the domain has existed, when that is on record. A very new domain is one more thing to read next to the others.
The IP tab returns these fields, and each one answers a different question.
This is an invented result for a documentation address, laid out the way a check comes back. The first seven fields are free on this page, and a free account opens the rest.
- Risk levelMedium
- Proxy or VPN flaggedNo
- Hosting or datacenterYes
- Tor exit nodeNo
- Reverse DNS name setNo
- Mobile networkNo
- Cloud providerExample Cloud, region-1
Opens with a free trial
- The risk factors behind the levelDATACENTER_IP, NO_REVERSE_DNS
- Connection type and anonymity levelDATACENTER, MEDIUM
- The network and organization that own the addressExample Networks, AS64496
Risk level
Low, medium, high or critical, worked out from the flags below. It is the first field to read.
Proxy or VPN flagged
Yes when the address is a known proxy or VPN exit.
Hosting or datacenter
Yes when the address belongs to a hosting company or a cloud operator, where people do not usually browse from.
Tor exit node
Yes when the address is on the Tor Project's list of exit addresses, and Not checked when that list could not be read.
Reverse DNS name set
Whether the address has a name set for it in reverse DNS. Home and office connections usually do.
Mobile network
Yes when the address belongs to a mobile network.
Cloud provider
The cloud operator and region, when the operator publishes the range.
The risk factors behind the level
The reasons the level lists, which are the flags that were raised.
Connection type and anonymity level
The kind of connection and how well it hides the user, worked out from the same flags.
The network and organization that own the address
The network and the organization the address is registered to.
The fraud checker runs one lookup for the value you choose, in three steps.
You pick a tab and enter a value.
Choose phone number, email address or IP address. A value in the wrong format is told so before anything is looked up.
We read the records for it.
1Lookup reads the spam and robocaller lists for a number, the mail records for an address, and the proxy, hosting and Tor lists for an IP address. Nothing is sent to the number, the address or the person.
You read the signals.
The result opens with the one field that matters most and lists the others under it. A free account opens the rest.
A fraud check sends each value to the records that can speak to it.
A phone number, an email address and an IP address are each judged by different lists, so each has a tab of its own.
- You enter a valueA phone number, an email address or an IP address, on its own tab.
- Its records are readThe spam and robocaller lists for a number, the mail records for an address, and the proxy, hosting and Tor lists for an IP address.
- Each signal gets a fieldA signal with a record becomes a yes or a no. A signal without one stays unrated, uncertain or not checked.A missing record is never shown as a clean result
- You read the resultThe field that matters most comes first, then the rest. Two or three signals that agree tell you more than any one of them.
Phishing and spoofing drew the most complaints in 2025 at 191,561, but averaged $1,127 a complaint, while investment fraud averaged $118,500.
The FBI's Internet Crime Complaint Center received 1,008,597 complaints in 2025 with reported losses of $20.877 billion. This table shows the six crime types with the largest reported losses and phishing and spoofing, which had the most complaints. The average is the reported loss divided by the complaints.
| Crime type | Complaints | Reported losses ($ millions) | Average loss per complaint |
|---|---|---|---|
| Investment | 72,984 | 8,649 | $118,500 |
| Business email compromise | 24,768 | 3,047 | $123,005 |
| Tech and customer support | 47,794 | 2,135 | $44,664 |
| Personal data breach | 67,456 | 1,315 | $19,493 |
| Confidence and romance | 23,159 | 929 | $40,126 |
| Government impersonation | 32,424 | 798 | $24,610 |
| Phishing and spoofing | 191,561 | 216 | $1,127 |
Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report.
Phishing and spoofing complaints fell 36% from 2023 to 2025 while their reported losses grew 11.5 times.
The same report lists three years side by side. Fewer people reported phishing and spoofing, and each report cost more, which is why one signal read alone is a weak guide to the harm.
| Year | Complaints | Reported losses ($ millions) |
|---|---|---|
| 2023 | 298,878 | 18.7 |
| 2024 | 193,407 | 70.0 |
| 2025 | 191,561 | 215.8 |
Source: FBI Internet Crime Complaint Center, 2025 Internet Crime Report, three year comparison.
Seven cloud operators publish 132 million IPv4 addresses of hosting space, and the Tor Project lists 1,215 exit addresses.
These are the published range files the IP tab reads for its cloud, hosting and Tor flags, read on 23 October 2026 with overlapping ranges merged. A host that publishes no list is not in them, so a no on the hosting flag means not in a published range.
| Operator | Published IPv4 ranges | IPv4 addresses (millions) |
|---|---|---|
| AWS | 10,683 | 102.0 |
| Google Cloud | 1,033 | 19.3 |
| Oracle Cloud | 1,107 | 4.3 |
| DigitalOcean | 1,087 | 3.1 |
| Cloudflare | 15 | 1.5 |
| Linode | 5,409 | 1.4 |
| Fastly | 21 | 0.4 |
Each tab says so in its own words when it cannot tell, and none of them shows that as a clean result.
This is how the free result reads each signal that has no record or could not be checked.
| Tab | Signal | What the result shows |
|---|---|---|
| Phone number | Spam and fraud risk | Not rated |
| Phone number | Reported as spam, flagged as a robocaller | Not rated |
| Email address | Mailbox deliverable | Uncertain |
| Email address | Valid format, mail servers found | Unknown |
| IP address | Tor exit node | Not checked |
| IP address | Risk level | Not rated |
A fraud check can answer six questions about a phone number, an email address or an IP address and cannot answer three others.
The records behind each tab cover some questions, and other checks cover the rest.
| Question | Can this check answer it? | Where the answer lives |
|---|---|---|
| Is the number reported as spam or flagged as a robocaller? | Yes | The phone tab |
| Is the email address a throwaway inbox? | Yes | The email tab |
| Can the email address receive mail? | Yes | The email tab |
| Is the IP address a proxy, a VPN or a hosting address? | Yes | The IP tab |
| Is the IP address a Tor exit node? | Yes | The IP tab |
| Is the number on an internet-calling line? | Yes | The virtual number checker |
| Is the person real? | No | Only a second proof from the person can show it |
| Is the line switched on right now? | No | A live HLR lookup |
| Where is the visitor right now? | No | An IP address shows a network and not a street |
A fraud check costs 1 credit, about $4.95 per 1,000 lookups on Starter and $2.00 on Enterprise.
These are the monthly plans on the pricing page. A phone number, an email address and an IP address each cost 1 credit, every plan starts with a 7-day free trial, and the same credits pay for every other 1Lookup check.
| Plan | About per 1,000 lookups | Monthly price | Fraud checks included |
|---|---|---|---|
| Starter | $4.95 | $99 | 20,000 |
| Growth | $3.52 | $299 | 85,000 |
| Professional | $3.20 | $799 | 250,000 |
| Enterprise | $2.00 | $1,999 | 1,000,000 |
The IP fraud API returns the flags as JSON from one request.
Send the address to the IP endpoint with your API key. Each request costs 1 credit, and every account can send up to 1,000 requests a minute. The level is in risk_assessment.risk_level, the reasons in risk_assessment.risk_factors and the cloud and Tor facts under insights.network_intelligence. The phone spam endpoint and the email endpoint work the same way and cost 1 credit as well.
curl -X POST https://app.1lookup.io/api/v1/ip \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{"ip": "203.0.113.42"}'import requests
response = requests.post(
"https://app.1lookup.io/api/v1/ip",
headers={"Authorization": "Bearer YOUR_API_KEY"},
json={"ip": "203.0.113.42"},
)
data = response.json()["data"]
print(data["risk_assessment"]["risk_level"])const response = await fetch('https://app.1lookup.io/api/v1/ip', {
method: 'POST',
headers: {
'Authorization': 'Bearer YOUR_API_KEY',
'Content-Type': 'application/json'
},
body: JSON.stringify({ ip: '203.0.113.42' })
})
const { data } = await response.json()
console.log(data.risk_assessment.risk_level)Response
{
"success": true,
"data": {
"request": { "type": "ip", "input": "203.0.113.42" },
"risk_assessment": {
"fraud_score": 40,
"risk_level": "MEDIUM",
"risk_factors": ["DATACENTER_IP", "NO_REVERSE_DNS"]
},
"insights": {
"network_intelligence": {
"is_datacenter": true,
"cloud_provider": "Example Cloud",
"cloud_region": "region-1",
"is_tor_exit": false,
"is_bogon": false,
"coverage": "complete"
}
},
"recommendations": { "primary_action": "VERIFY" },
"metadata": { "credits_used": 1, "credits_remaining": 9998 }
}
}To run these checks on every signup and every order, see our Fraud Detection API.
It checks three kinds of value on one page.
A phone number, an email address and an IP address each have a tab, so one visit covers everything a new account hands you.
It keeps what it does not know apart from what it found.
A number nobody has rated shows as Not rated, an IP list that could not be read shows as Not checked, and neither is shown as a clean result.
It shows only fields it can trace to a record.
Every field is read from a list or a mail server's answer, and each rating is worked out only from those fields.
It never contacts anyone.
The check reads records only, so the number's owner, the mailbox's owner and the address's user are never told.
Who uses this tool
Signup and checkout teams check all three values on a new account.
A throwaway email address, a number reported as spam and a hosting IP address on one signup are three signals that agree.
Trust and safety teams look closer at one flagged account.
A single tab answers the next question about an account without opening a second tool.
Sales and marketing teams clean the leads that a form collects.
Throwaway email addresses and hosting IP addresses on a form are a quick way to spot sign-ups that are unlikely to answer.
People check a stranger's contact details before they reply.
A number, an email address or an IP address from a message can be checked in seconds before anyone answers.
Frequently asked questions
How do I check a phone number, an email address or an IP address for fraud?
Pick the tab for the value you have, enter it and run the check. The first field answers the main question, such as the spam and fraud risk of a number, whether an email address is a throwaway inbox or the risk level of an IP address.
What is a fraud checker?
It is a tool that looks up the signals on a phone number, an email address or an IP address that fraud teams read first, and reports them in plain words. This one is free and needs no signup.
Can a fraud checker prove that someone is a fraudster?
No. A flag is a reason to look closer, and a clean result means only that none of these signals were raised. Plenty of honest people use a VPN, a shared inbox or a number that nobody has rated.
What does the phone tab check?
It checks whether people have reported a US or Canadian number as spam and whether it is flagged as a robocaller. It then shows the rating those two signals add up to and a suggested action.
What does a throwaway email result mean?
It means the address belongs to a temporary inbox service, made to receive one message and be dropped. The tab also shows whether the address can receive mail at all, and whether it is a free provider, a company domain or a shared team address.
What does the IP tab flag?
It flags whether the address is a proxy or VPN, whether it sits on a hosting or datacenter network, whether it is a Tor exit node and whether it is on a mobile network. It also shows whether the address has a reverse DNS name set and the cloud operator when one publishes the range.
Does a proxy or VPN flag mean the visitor is committing fraud?
No. A VPN is a privacy tool that many people use every day. The flag is one signal to read next to the others, such as a throwaway email address on the same account.
Why does the Tor check sometimes say Not checked?
The Tor answer depends on a public list of exit addresses. When that list could not be read for a lookup, the tab says Not checked and does not guess a no.
Why does a phone number show Not rated?
A number that nobody has reported and that is on no robocaller list has no reputation on record. That is different from a clean rating, so the tab shows Not rated.
Does a clean result mean the number, address or email is safe?
It means none of these signals were raised. Hosts that publish no list of their ranges are not on the hosting list, so a no on the hosting flag means not in a published range, and new fraud has no history yet.
Does the person know I checked?
No. The check reads records only. No call, message or request goes to the number, the mailbox or the address, so no one is told.
Does the fraud checker work outside the US?
The email and IP tabs work for any address. The phone tab covers US and Canadian numbers.
How much fraud is reported?
The FBI's Internet Crime Complaint Center received 1,008,597 complaints in 2025 with reported losses of $20.877 billion. Investment fraud alone was $8,648,617,756 of that, and phishing and spoofing drew the most complaints at 191,561.
How much does a fraud check cost per lookup?
A fraud check costs 1 credit per phone number, email address or IP address in the API or a CSV upload. That is about $4.95 per 1,000 on the Starter plan, $3.52 on Growth, $3.20 on Professional and $2.00 on Enterprise. The free tool on this page checks one value at a time with no signup, and every plan starts with a 7-day free trial.
Is there an API that runs these fraud checks on every signup?
Yes. The phone spam, email and IP endpoints each return their signals as JSON for 1 credit a request, and a CSV upload does the same for a whole list. Every account can send up to 1,000 requests a minute.
These pages answer the question that comes after a fraud check.
- Phone number fraud checkerA number's spam and robocaller record with a suggested action.
- Virtual number checkerWhether a number sits on an internet-calling line.
- VPN and proxy detectionWhether an IP address is a proxy, a VPN or a hosting address.
- Email verifierWhether an email address can receive mail, in depth.
The first three digits of a US number tell you where it was assigned.
Every area code has its own page with the places it covers, the local time there, and what to do when a call from it looks spoofed. These are the codes people look up most.
- 213Los Angeles
- 646New York City
- 917New York City
- 202Washington
- 404Atlanta
- 702Las Vegas
- 786Miami
- 415San Francisco
- 206Seattle
- 954Fort Lauderdale
- 323Los Angeles
- 929New York City
Area code 213, downtown Los Angeles, also has a page for each of its 786 prefixes, with the company NANPA lists as the holder.
New area codes catch people out, because a number from one looks unfamiliar even when it is local. These are the newest working codes.
- 465New York, since Jun 2026
- 483Alabama, since Feb 2026
- 471Mississippi, since Jan 2026
- 679Michigan, since Nov 2025
- 457Louisiana, since Sep 2025
- 729Tennessee, since Sep 2025