Is this request a bot? Is this address disposable?

Two endpoints, one HTTP call each. Every verdict is a documented rule with a stated weight: no model, no confidence hand-waving, no black box.

curl -X POST https://uat.conureapi.com/v1/bot-check \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip":"52.1.2.3","user_agent":"curl/8.4.0"}'

Get a key, 1,000 free calls a month Read the docs

What comes back

{
  "is_bot": true,
  "risk_score": 100,
  "reasons": ["datacenter_ip", "missing_sec_ch_ua", "known_bot_user_agent"]
}

A score, a boolean, and the exact reasons behind it. You can log the reasons, show them to a support agent, and argue with them.

How it decides

• Addresses. A merged sorted range table over published datacenter CIDRs, cross-checked against brute force on every test run.
• Mailboxes. Syntax, role-account shape, disposable-domain membership, free-provider status and a live MX lookup.
• Failures are not verdicts. If DNS is unreachable the signal scores zero rather than inventing a reason to reject your customer.

Pricing

1,000 calls a month free, then 1,000 credits per dollar. You are not billed for your own 400s or for our 500s. No subscription, no seats, no sales call.

Drop it in