Most people start looking at bot traffic after something breaks. A pile of chargebacks lands in one week. A signup form fills up with nonsense overnight. The hosting bill doubles and nobody can explain why.
The quieter truth is that bots cost you money long before anything breaks. You just pay for it in small amounts, spread across a lot of places.
Where the money goes
Ad spend. If you pay per click, some of those clicks come from scripts, click farms and people hiding behind VPNs to look like they are somewhere they are not. You pay full price for every one of them.
Free trials and promos. One person with a VPN and a list of email addresses can claim your "first month free" offer twenty times. Each fake account costs you onboarding emails, support time and server resources.
Chargebacks. Card testers love checkout pages with no screening. They run hundreds of small payments to see which stolen cards still work. Even the ones that fail can count against you with your payment processor.
Infrastructure. Scrapers do not care about your rate limits. They will happily request every page on your site, every hour, and you pay for the bandwidth.
What a blocking API actually does
An IP blocking API answers one question for every visitor: does this connection come from a normal home or mobile network, or from somewhere that real customers rarely use, like a VPN provider, a proxy service, a Tor exit or a rented server in a datacenter?
That single answer is surprisingly useful. Real shoppers mostly browse from their home Wi-Fi or their phone. Fraud, scraping and fake signups mostly come from rented infrastructure, because it is cheap, disposable and easy to rotate.
You do not have to block everyone who gets flagged. A lot of teams start by just logging the verdict for a week. Then they look at which flagged visitors actually bought something, which ones asked for refunds, and which ones never came back. The pattern is usually obvious.
Block, challenge or watch
Once you can see the traffic, you get to choose what to do with it:
- Block the obvious stuff, like datacenter traffic hitting your checkout.
- Challenge the grey area with an extra step, such as email verification or a CAPTCHA, instead of turning people away.
- Watch everything else, and tag it in your analytics so your numbers stay honest.
Some legitimate people do use VPNs, especially for privacy at work or while travelling. That is why "challenge" is often a better default than "block" outside of payments.
The maths is usually easy
Take one month of data. Add up what you lost to chargebacks, to promo abuse and to ad clicks that never turned into anything. Compare that to the cost of a lookup API. For most businesses taking payments or buying traffic, the comparison is not close.
Fraudex runs this check in under a millisecond per request, so it can sit right in front of your forms and checkout without slowing anyone down. The free plan lets you see network and country for every IP. The VPN and bot verdict starts on the Pro plan.