Making requests

Required. Get your personal API key on the My products page.

Required. The IPv4 address to classify. Specified as a path segment of the request URL, e.g. /api/v1/ip/185.220.101.1.

The queried IPv4 address, echoed back.

String or null. The CIDR range the IP belongs to, when known.

String. The detection type of the IP.

Allowed values: vpn, corporate_vpn, proxy, hosting, cdn, tor, relay, residential_proxy, residential_proxy_likely, residential_proxy_mobile, datacenter_proxy, mobile_proxy, suspected_vpn, suspected_proxy, unknown.

String or null. Attributed provider for the IP (e.g. a VPN brand, residential proxy network, hosting company). Null when no attribution is available.

Float in [0, 1]. Calibrated confidence in the classification. Higher values indicate stronger evidence.

String. The detection method that produced the record (e.g. mslm, port_scan, proxy_enum, netflow_analysis, asn_classification).

String. Same as source (legacy field, retained for backward compatibility).

String (ISO-8601) or null. When the IP was first observed.

String (ISO-8601) or null. When the IP was last observed.

Integer. Total times the IP has been observed (hits).

Float or null. Persistence: the percentage of days within the rolling 90-day observation window on which the IP was observed as an active proxy / VPN exit (distinct observation days ÷ 90 × 100).

High (>50) indicates a consistently active exit; low (<5) indicates sporadic or one-shot activity. Null when the result comes from a network-range detection with no per-IP observation history.

Integer. Number of distinct proxy / VPN networks through which the IP was observed as an exit. A value of 2 or more means the IP is shared or resold across multiple commercial networks — a strong proxy signal. 0 means no per-IP enumeration history (range-level detection only).

Float in [0, 1.5]. Composite evidence-strength score: recency factor × consistency × multi-provider boost. Values above 1.0 indicate multi-provider, daily-active IPs; 0.0 means never observed at point level. For a normalised 0–1 score use min(confidence_decay, 1.0).

String. Observation staleness bucket derived from last_seen, so you can filter without date math.

Allowed values: current (observed in the last day), recent (last week), stale (last 90 days), frozen (>90 days ago, or never observed).

Boolean. True if the classification is in {vpn, vpn_concentrator, corporate_vpn, commercial_vpn, vpn_hosting} (confirmed VPN endpoints). Does not include tor, relay, suspected_vpn, or vpn_suspect — tor/relay have dedicated booleans; suspected_vpn/vpn_suspect are corroboration-only signals that do not set is_vpn. This asymmetry with is_proxy is deliberate: suspected_proxy does set is_proxy, but suspected_vpn/vpn_suspect never set is_vpn.

Boolean. True if the classification is in {proxy, datacenter_proxy, mobile_proxy, suspected_proxy}. Does not include residential proxies (see is_residential_proxy). To match any proxy of any kind, combine is_proxy OR is_residential_proxy.

Boolean. True if the IP is a Tor exit node (classification tor).

Boolean. True if the classification is relay — a privacy-preserving relay service (e.g. Apple Private Relay). Distinct from is_vpn: relays route consumer traffic through provider-operated egress with no user-selectable endpoint.

Boolean. True if the IP belongs to a datacenter / hosting provider.

Boolean. True if the IP belongs to a content-delivery network.

Boolean. True if the classification is in {residential_proxy, residential_proxy_likely, residential_proxy_mobile}. Mutually exclusive with is_proxy; use the more specific booleans below to filter further.

Boolean. True if classification == residential_proxy (the ≥85% precision tier). Subset of is_residential_proxy.

Boolean. True if classification == residential_proxy_mobile — mobile carrier IPs detected as proxy. Subset of is_residential_proxy.

Boolean. True when the IP appears on a public open-proxy list. Distinct from is_proxy: every open proxy is also a proxy, but most proxies are not on public lists.

Boolean. True if the IP is an appliance-class VPN (Fortinet, Pulse Secure, Cisco AnyConnect, …). Sub-flag of is_vpn.

Integer in [0, 100]. Computed as confidence × 100, with a +10 boost for high-risk classification types.

Integer or null. Autonomous System number announcing the IP.

String or null. Registered organisation name for the ASN.

String or null. Normalised CDN operator brand (lowercase), e.g. akamai, fastly, cloudflare, aws_cloudfront. Non-null only when classification == cdn.

Object or null. ASN-level abuse scoring. Available on all tiers; premium tiers (growth+) get the full breakdown:

abuse_score — integer 0–100, abuse level for this ASN (all tiers).

abuse_level — string: low, moderate, high, critical (all tiers).

flagged_ratio — float 0.0–1.0, ratio of flagged IPs in the ASN (growth+).

flagged_ip_count — integer, count of flagged IPs (growth+).

total_announced_ips — integer, total IPs announced by this ASN (growth+).

Object. Additional detection signals and enrichment data (all keys optional):

raw_score — number, the internal numeric confidence (0–100).

signals — object, detection signals (port patterns, protocols, etc.).

dns_enrichment — object, DNS PTR records and RDNS history.

tls_enrichment — object, TLS certificate analysis.

Object or null. Geographic data, premium tiers (growth+) only; null when no observed-location data is available. Keys:

exit_country — string or null, ISO 3166-1 alpha-2 country code of the exit IP.

user_countries — array of strings or null, countries where users of this IP were observed.

user_country_count — integer or null, count of distinct user countries.

observed_lat / observed_lon — number or null, coordinates of the observed exit point.

observed_countries — array of strings, countries where this concentrator was observed.

observation_readings — string or null, metadata about the observations.

2 requests/min

30 requests/min

100 requests/min

250 requests/min

500 requests/min

Custom — contact us.