Claude ban causes
Every documented reason a Claude account is banned, and the IP and environment causes Anthropic does not document, each with its source.
How to Read an IP Check: ping0.cc, Scamalytics, ipinfo, IPPure, BrowserLeaks
Five free tools, five different opinions. Learn which fields have a defined meaning and which are a site’s private score.
What each tool shows
| Item | What it shows | Is the meaning published? | Use it for |
|---|---|---|---|
| ping0.cc | We could not read its result fields: its pages answer scripts with a bot check | We could not read a methodology | A second opinion; do not decide on it alone |
| Scamalytics | A 0–100 fraud score with a risk label, operator and ASN, and yes/no flags for datacenter, server, VPN, Tor and proxies | Yes: score and bands are defined | Reputation of the address and its neighborhood |
| ipinfo | Location, ASN and its type, and an Anonymization section: hosting, VPN, proxy, Tor, relay, residential proxy | Yes: field names are documented, type values are listed | Which network owns the address, and whether it is flagged |
| IPPure | Location and operator, a risk score (higher is riskier), native or announced, residential or datacenter labels, and WebRTC and DNS leak checks | Partly: its FAQ names the data (risk databases, honeypot statistics) and defines the labels, but not the score formula | A second opinion, the native label and a leak check |
| BrowserLeaks | ISP, organization, ASN, usage type, the time zone of the IP, and IPv6, WebRTC and DNS leak tests | It reports what it measures | Leaks and consistency with your browser |
Read on 29 October 2026. What a tool shows can change, so judge from the page in front of you.
Open the checkers
These are third-party sites that we do not control. Run them with your browser connected through the proxy so that they see the proxy’s address; ipinfo and Scamalytics also let you type in any address: ping0.cc, Scamalytics, ipinfo, IPPure and BrowserLeaks.
You can run the same checks on any address, including ones we do not sell.
Reading a Scamalytics score
| Item | Risk level | What the provider says |
|---|---|---|
| 0–19 | Low risk | A score of 0 means no known fraud risk |
| 20–59 | Medium risk | No further definition is given |
| 60–89 | High risk | A score of 70 means about 7 in 10 users seen from the address were linked to fraud |
| 90–100 | Very high risk | The top band |
Scamalytics builds the score from fraud feedback reported by operators and applies it to the surrounding subnet, ASN and hosting block, so the score of an address can reflect its neighbors. It calls the thresholds a starting point. A score is a reputation estimate, not a decision by any platform.
Flags worth reading, and what they are defined as
| Item | Defined as | If it is set |
|---|---|---|
| hosting | ip-api: “Hosting, colocated or data center”. IPinfo: associated with a hosting or cloud provider | The address sits in a datacenter network, not an access provider’s |
| proxy / VPN | ip-api: “Proxy, VPN or Tor exit address”. IPinfo has separate vpn and proxy fields for known services | The database has seen the address used by such a service |
| Tor | IPinfo: a Tor exit node | A public anonymity network exit |
| relay | IPinfo: associated with a relay service | A privacy relay, not a normal end-user connection |
| mobile | ip-api: a mobile (cellular) connection | A phone network address |
| ASN type | IPinfo: ISP, Hosting, Education, Government or Business | ISP is what you expect for a home or ISP address; Hosting is a datacenter |
Definitions as the providers write them on 29 October 2026. Different databases can label the same address differently.
A 5-minute routine
Connect and note the address
Connect through the proxy, open the BrowserLeaks IP page and write down the address, country, ISP and ASN.
Check the network type
The organization behind the ASN should be an access provider or telecom company. In ipinfo, ASN Type should be ISP, not Hosting.
Before continuing A Hosting type does not prove the address will be refused anywhere, only that databases call it a datacenter network.
Check the flags
Look for hosting, proxy, VPN, Tor and relay flags in two tools, for example ipinfo and Scamalytics.
Check the fraud score
Note the Scamalytics score and its band. Compare with the score at another time: scores move.
Expected result Low risk (0–19), or at most a medium score you can explain.
Check leaks and consistency
On BrowserLeaks run the IPv6, WebRTC and DNS tests, then compare the IP’s time zone with your browser’s.
Record the date and the result
Keep a short note of the tools, the date and what they showed, and repeat after any change of address, browser or system.
When the tools disagree
They read different databases that update at different times, and IPinfo itself says a classification can rest on neighboring addresses. Cities differ most; trust the country and the network first. Weigh the fields with a published meaning (network type, hosting and proxy flags, score bands) above a score whose method you cannot read.
Our own range check shows why one flag should not decide anything. On 28 October 2026 ip-api flagged 12% of the native /24 ranges we looked at as hosting, so a flag on one tool is a reason to look closer, and a clean result is not proof either. A good score is not a promise that any platform will accept the address.
IP check FAQ
Which score should I trust?
Prefer fields whose meaning is published: network type, hosting and proxy flags, and Scamalytics’ bands. Treat ping0.cc and IPPure scores as a second opinion: one publishes no method we could read, the other no formula.
Does a 0 on Scamalytics mean Claude will accept my IP?
No. It means Scamalytics has no known fraud risk for that address. It is not a platform decision.
Why does my IP show a different city on each tool?
Each tool uses its own database, and city data is an estimate. Check the country and the network first.
Can I check an address I have not bought yet?
ipinfo and Scamalytics accept any address you type in. BrowserLeaks and IPPure mainly check the connection you are using, so run those once you have the address, and check again after any change.
Do these tools show what Anthropic sees?
No. Anthropic does not publish the signals it uses.
Related guides
The Claude account-stability guides, the Claude ban and appeal guide and the Claude proxy setup.
Claude and IP risk
How IP databases label datacenter, VPN, residential and ISP addresses, native vs broadcast ranges, and why one account should keep one IP.
Claude account environment
Match time zone, browser language and payment details to your IP’s country: what sites can read, how to check it, and where Anthropic is explicit.
Claude account checklist
Twelve checks before and after you subscribe to Claude, each linked to the section that explains it.
Choose an AI-subscription ISP
The Claude, GPT / Grok and Gemini tiers compared: subscriptions, networks, regions, price per IP for 30 days and the first-IP half price.
Claude account bans
Why Anthropic bans Claude accounts, how to appeal and export your chats, what happens to a Pro or Max plan, and what a proxy can and can’t change.
Claude proxy
Claude proxy on a static ISP IP: Claude Code over HTTP (no SOCKS), one IP per person, an address you can allowlist — and Anthropic's region rules.
View options and pricingReference links
11
- Scamalytics: IP lookup page (example)
Third-party source · Confirmed on:
Read on 29 October 2026: the lookup page shows a fraud score out of 100 with a risk label, the operator and ASN, and yes/no lines for Datacenter, Server, Anonymizing VPN, Tor exit node, Public proxy, Web proxy, Residential proxy and Search engine robot, plus a list of external blacklists. The page says its findings cover web connections made by internet users to websites and applications, not server-to-server connections.
- Scamalytics: products (how the IP risk score is defined)
Official documentation · Confirmed on:
Read on 29 October 2026: the score is built from fraud feedback gathered from a global network of operators who report confirmed fraudulent activity; a score of 70 means approximately 7 out of 10 users seen from that IP address have been linked to fraudulent activity, and 0 means no known fraud risk; this intelligence is applied across the surrounding IP neighbourhood, including addresses within the same subnet, ASN and hosting block. Bands: 0–19 low, 20–59 medium, 60–89 high, 90–100 very high; Scamalytics calls the thresholds a starting point.
- IPinfo: lookup page for one IP (example)
Third-party source · Confirmed on:
Read on 29 October 2026: the page for an address lists location, ASN, company, privacy, AS type, abuse contact; geolocation with local time and timezone; an Anonymization section with Hosting, VPN, Proxy, Tor, Relay and Residential Proxy; and an ASN section with ASN Type and Route.
- IPinfo: Privacy Detection API data
Official documentation · Confirmed on:
Read on 29 October 2026. Standard fields: vpn — associated with a VPN service; proxy — associated with a proxy service; tor — a Tor exit node; relay — associated with a relay service; hosting — associated with a hosting or cloud provider; service — name of the service. The Extended API adds confidence, coverage and signal fields, and its inferred field notes that a classification may rest on activity from neighbouring addresses rather than direct observation. The Core API returns only is_anonymous and is_hosting.
- IPPure: IP purity check site (home page and FAQ)
Third-party source · Confirmed on:
Read on 29 October 2026. The home page lists IP location and operator, IP risk detection, fingerprint analysis, VPN leak, WebRTC and DNS leak detection. The FAQ says: higher risk score means riskier; the data comes from Internet risk databases and honeypot statistics; a score decays over time; an IP with no records is inferred from its range and related information; IPv6 addresses are not scored. It defines native as registered in the server’s country and non-native as advertised from a different region via BGP, and residential as public IPs assigned to home users by ISPs and data center as IPs assigned to data centers, cloud providers or hosting facilities. A guide page says its ASN human-to-bot ratio comes from Cloudflare data. The formula of the score is not published.
- ping0.cc: IP lookup site
Third-party source · Confirmed on:
Opened on 29 October 2026. From a script the site answers with a bot check instead of its result page, so we could not read its result fields or any explanation of its risk value and IP-type labels, and a web search found none. We therefore describe it only as a second opinion and make no claim about how its values are calculated.
- BrowserLeaks: IP address page
Third-party source · Confirmed on:
Read on 29 October 2026: the page lists IP address, country and city, ISP and organization, network (ASN), usage type, the time zone and local time that go with the IP, an IPv6 leak test, a WebRTC leak test, a DNS leak test, TCP/IP, TLS and HTTP/2 fingerprints and the HTTP request headers. Its separate JavaScript page lists the browser’s time zone (Internationalization API) and the language values (locale, language and languages).
- ip-api.com: JSON API documentation (response fields)
Official documentation · Confirmed on:
Read on 29 October 2026. Field definitions: mobile — “Mobile (cellular) connection”; proxy — “Proxy, VPN or Tor exit address”; hosting — “Hosting, colocated or data center”; isp — “ISP name”; org — “Organization name”; as — “AS number and organization, separated by space (RIR). Empty for IP blocks not being announced in BGP tables.”
- IPinfo: ASN database developer resource
Official documentation · Confirmed on:
Read on 29 October 2026: the ASN type field takes the values ISP, Hosting, Education, Government or Business. The page lists the categories but does not define each one beyond its name.
- Proxy302 check of 203 candidate /24 ranges (28 October 2026)
Product observation · Confirmed on:
Our own tally. The 203 /24 ranges are the candidates for our static ISP stock offered by upstream suppliers, 176 marked native and 27 marked broadcast, from 15 networks (three ranges had no announcing network on record). On 28 October 2026 one sample address in each range was looked up in ip-api.com and its hosting and proxy flags were recorded. Counts: native 176 ranges, 21 hosting, 3 proxy; broadcast 27 ranges, 8 hosting, 0 proxy; native ranges announced by NTT America (AS2914) 66, 4 hosting, 0 proxy; other native ranges 110, 17 hosting, 3 proxy. Ranges flagged hosting or proxy are left out of the AI-subscription tiers. No range or address is published.
One address per range and one database only; other databases may label the same range differently, and flags change over time. This is a sample of what we were offered, not a statistic of the internet.
- Claude Help Center: Safeguards warnings and appeals
Official documentation · Confirmed on:
Read on 29 October 2026. Ban reasons listed: repeated violations of the Usage Policy, account creation from an unsupported location, Terms of Service violations. Users are warned when Anthropic believes their prompts break the policy; for API customers the warnings are tied to thresholds across the whole API account. The appeal form opens only after you log in at claude.ai with the banned account; banned Free, Pro and Max users can still export their data (possibly restricted, depending on the violation) or delete the account. The article does not mention VPNs or IP addresses and says response times are longer than normal.
Ready to try it?
Create an account, top up once, then pick rotating residential, static ISP or datacenter IPs and have one running in your browser within minutes.