The IP Reputation API returns detailed threat intelligence for any IPv4 or IPv6 address. It detects VPNs, proxies (including residential), Tor exit nodes, bot or spam activity, and known attacker behavior. It also identifies cloud provider associations and, when available, returns the provider name. In addition, it delivers geolocation and network details enriched with country metadata, making it a comprehensive source of security and geolocation data.
Authorization
You can make authorized requests to our API by passing API key
as a query parameter. To get your API key, login to our billing
dashboard and get your API key! If your API key has been
compromised, you can change it by clicking on reset button in
billing dashboard.
Important References
For details on request limits and handling rate limiting, refer here
For a complete overview of API credit consumption and usage, refer here
Query Parameters
Required
apiKey
Retrieve your API key from the billing dashboard.
ip
The IP address for which you want to retrieve the security response details.
Request
SHELL
Loading request...
Response
Loading response...
Fields Description
Fields
Details
Data Type
Example
ip
IP address being analyzed
string
8.8.8.8
location
Geolocation details derived from IP address
continent_code
Continent code
string
NA
continent_name
Continent name
string
North America
country_code2
2-letter country code
string
US
country_code3
3-letter country code
string
USA
country_name
Country name
string
United States
country_name_official
Official country name
string
United States of America
country_capital
Capital city of the country
string
Washington, D.C.
state_prov
State or province name
string
California
state_code
State or region code
string
US-CA
district
District or administrative area
string
Santa Clara
city
City name
string
Mountain View
locality
Local area name
string
Mountain View
accuracy_radius
Accuracy radius of geolocation data
string
zipcode
Postal code
string
94043-1351
latitude
Latitude coordinate
string
37.42240
longitude
Longitude coordinate
string
-122.08421
is_eu
Indicates whether IP is in EU region
boolean
false
geoname_id
GeoNames identifier
string
6301403
country_emoji
Country flag emoji
string
🇺🇸
network
Network-level information of the IP
connection_type
Type of network connection
string
route
CIDR route or network range associated with the IP address
string
1.1.1.0/24
is_anycast
Indicates whether the IP address is configured as an anycast address
boolean
true
asn
Autonomous System Number details
as_number
ASN identifier
string
AS15169
organization
Organization owning ASN
string
Google LLC
country
Country of ASN registration
string
US
type
Type of organization (e.g., BUSINESS)
string
BUSINESS
domain
Associated organization domain
string
about.google
date_allocated
ASN allocation date
string (YYYY-MM-DD)
rir
Regional Internet Registry
string
ARIN
security
Security and threat intelligence information for the IP
threat_score
Threat score of the IP (0 = safe, higher = risky)
number
5
is_tor
Indicates if the IP address is part of the Tor network
boolean
false
is_proxy
Indicates whether the IP address is detected as a proxy
boolean
false
proxy_provider_names
List of detected proxy service providers associated with the IP
array
proxy_confidence_score
Confidence score indicating the likelihood of proxy usage
number
0
proxy_last_seen
Last detected timestamp of proxy activity for the IP address
string (YYYY-MM-DD HH:mm:ss)
is_residential_proxy
Indicates whether the IP address belongs to a residential proxy network
boolean
false
is_vpn
Indicates whether the IP address is associated with a VPN service
boolean
false
vpn_provider_names
List of detected VPN providers associated with the IP address
array
vpn_confidence_score
Confidence score indicating the likelihood of VPN usage
number
0
vpn_last_seen
Last detected timestamp of VPN activity for the IP address
string (YYYY-MM-DD HH:mm:ss)
is_relay
Indicates whether the IP address is operating as a relay service
boolean
false
relay_provider_name
Name of the relay service provider associated with the IP address
string
is_anonymous
Indicates anonymous IP usage
boolean
false
is_known_attacker
Indicates if the IP address is known for malicious or abusive activity
boolean
false
is_bot
Indicates if the IP address belongs to a bot
boolean
false
is_spam
Indicates whether the IP address is associated with spam activity
boolean
false
is_cloud_provider
Indicates whether the IP address belongs to a cloud hosting provider
boolean
true
cloud_provider_name
Name of the cloud provider associated with the IP address
string
Cloudflare, Inc.
Bulk IP Reputation Lookup
Bulk IP Reputation API extends the threat intelligence capabilities to up to 100 IPv4 or IPv6 addresses in one request.
