IPGeolocation-Logo

Security API and Threat Intelligence

Defend your systems with advanced IP intelligence. The Security API analyzes every request, detecting VPNs, proxies, and Tor usage while calculating a real-time threat score. Combined with precise geolocation, you’ll gain the insights you need to reduce fraud, detect abuse, and make faster, data-driven security decisions.

Get Free API Access
    • stringip:"2a06:98c0:3600:0:0:0:0:103" ,
    • stringhostname:"2a06:98c0:3600::103" ,
    • objectsecurity:Object,
      • numberthreat_score:5 ,
      • booleanis_tor:false ,
      • booleanis_proxy:false ,
      • stringproxy_type:"" ,
      • stringproxy_provider:"" ,
      • booleanis_anonymous:false ,
      • booleanis_known_attacker:false ,
      • booleanis_spam:false ,
      • booleanis_bot:false ,
      • booleanis_cloud_provider:true ,
      • stringcloud_provider:"Cloudflare, Inc." ,
    • objectlocation:Object,
      • stringcontinent_code:"EU" ,
      • stringcontinent_name:"Europe" ,
      • stringcountry_code2:"GB" ,
      • stringcountry_code3:"GBR" ,
      • stringcountry_name:"United Kingdom" ,
      • stringcountry_name_official:"United Kingdom of Great Britain and Northern Ireland" ,
      • stringcountry_capital:"London" ,
      • stringstate_prov:"England" ,
      • stringstate_code:"GB-ENG" ,
      • stringdistrict:"Greater London" ,
      • stringcity:"London" ,
      • stringzipcode:"EC4V 4AJ" ,
      • stringlatitude:"51.50967" ,
      • stringlongitude:"-0.09925" ,
      • booleanis_eu:false ,
      • stringcountry_flag:"https://ipgeolocation.io/static/flags/gb_64.png" ,
      • stringgeoname_id:"6619887" ,
      • stringcountry_emoji:"🇬🇧" ,
    • objectcountry_metadata:Object,
      • stringcalling_code:"+44" ,
      • stringtld:".uk" ,
      • languages:Array[3],
        • stringlanguages[0]:"en-GB" ,
        • stringlanguages[1]:"cy-GB" ,
        • stringlanguages[2]:"gd" ,
    • objectnetwork:Object,
      • objectasn:Object,
        • stringas_number:"AS132892" ,
        • stringorganization:"Cloudflare, Inc." ,
        • stringcountry:"US" ,
      • objectcompany:Object,
        • stringname:"CLOUDFLARENET EU" ,
    • objectcurrency:Object,
      • stringcode:"GBP" ,
      • stringname:"Pound Sterling" ,
      • stringsymbol:"£" ,
    • objecttime_zone:Object,
      • stringname:"Europe/London" ,
      • numberoffset:0 ,
      • numberoffset_with_dst:1 ,
      • stringcurrent_time:"2025-09-10 21:17:07.791+0100" ,
      • numbercurrent_time_unix:1757535427.791 ,
      • stringcurrent_tz_abbreviation:"BST" ,
      • stringcurrent_tz_full_name:"British Summer Time" ,
      • stringstandard_tz_abbreviation:"GMT" ,
      • stringstandard_tz_full_name:"Greenwich Mean Time" ,
      • booleanis_dst:true ,
      • numberdst_savings:1 ,
      • booleandst_exists:true ,
      • stringdst_tz_abbreviation:"BST" ,
      • stringdst_tz_full_name:"British Summer Time" ,
      • objectdst_start:Object,
        • stringutc_time:"2025-03-30 TIME 01" ,
        • stringduration:"+1H" ,
        • booleangap:true ,
        • stringdate_time_after:"2025-03-30 TIME 02" ,
        • stringdate_time_before:"2025-03-30 TIME 01" ,
        • booleanoverlap:false ,
      • objectdst_end:Object,
        • stringutc_time:"2025-10-26 TIME 01" ,
        • stringduration:"-1H" ,
        • booleangap:false ,
        • stringdate_time_after:"2025-10-26 TIME 01" ,
        • stringdate_time_before:"2025-10-26 TIME 02" ,
        • booleanoverlap:true ,
    • objectuser_agent:Object,
      • stringuser_agent_string:"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected]..." ,
      • stringname:"ClaudeBot" ,
      • stringtype:"Robot" ,
      • stringversion:"1.0" ,
      • stringversion_major:"1" ,
      • objectdevice:Object,
        • stringname:"Anthropic ClaudeBot" ,
        • stringtype:"Robot" ,
        • stringbrand:"Anthropic" ,
        • stringcpu:"Unknown" ,
      • objectengine:Object,
        • stringname:"ClaudeBot" ,
        • stringtype:"Robot" ,
        • stringversion:"1.0" ,
        • stringversion_major:"1" ,
      • objectoperating_system:Object,
        • stringname:"Cloud" ,
        • stringtype:"Cloud" ,
        • stringversion:"??" ,
        • stringversion_major:"??" ,
        • stringbuild:"??" ,

    • IP Security Lookup

    This API provides a reliable proxy detection method, adding seamless VPN and proxy check capabilities. The threat score reflects the risk associated with the provided IP, ranging from 0 to 100. The API indicates whether the IP is a proxy, along with its provider, making it a powerful proxy detector tool. It also identifies if an IP address is a bot, uses Tor, sends spam, hides its identity, or performs attacks. Additionally, it shows whether the IP is linked to a cloud provider and includes the provider’s name. These features make the API a powerful and accurate proxy detection service.

    Response
    1{
2  "ip": "2.56.188.34",
3  "security": {
4    "threat_score": 75,
5    "is_tor": false,
6    "is_proxy": true,
7    "proxy_type": "VPN",
8    "proxy_provider": "Nord VPN",
9    "is_anonymous": true,
10    "is_known_attacker": true,
11    "is_spam": false,
12    "is_bot": false,
13    "is_cloud_provider": true,
14    "cloud_provider": "Packethub S.A."
15  }

    IP Security With Network Details

    The API provides both the Autonomous System (AS) Number and organization details about the specified IP address. The API response provides network identification data about the IP address which enables easier detection of service providers as well as potential malicious networks.

    Enriching security data with AS number details helps detect risky patterns and supports proactive threat response. Blocking dangerous IP ranges, along with restricting access to IPs associated with specific AS numbers, organizations, or ISPs, helps enhance your cyber security posture.

    Request
    curl -X GET 'https://api.ipgeolocation.io/v2/security?apiKey=API_KEY&ip=2.56.188.34&include=network'
    Response
    1{
2  "ip": "2.56.188.34",
3  "security": {
4    "threat_score": 75,
5    "is_tor": false,
6    "is_proxy": true,
7    "proxy_type": "VPN",
8    "proxy_provider": "Nord VPN",
9    "is_anonymous": true,
10    "is_known_attacker": true,
11    "is_spam": false,
12    "is_bot": false,
13    "is_cloud_provider": true,
14    "cloud_provider": "Packethub S.A."
15  },
16  "network": {
17    "asn": {
18      "as_number": "3640",
19      "organization": "C I C E S E",
20      "country": "MX"
21    },
22    "company": {
23      "name": "Packethub S.A.",
24    }
25  }
26}

    IP Security With Geolocation

    The geolocation information for the provided IP can also be included in the default response of the Security API. The geolocation data contains the country, state, city, and ZIP code, along with the latitude and longitude of the IP address. This cybersecurity intelligence helps identify region-specific threats and block high-risk IPs by location.

    Request
    curl -X GET 'https://api.ipgeolocation.io/v2/security?apiKey=API_KEY&ip=2.56.188.34&include=location'
    Response
    1{
2  "ip": "2.56.188.34",
3  "security": {
4    "threat_score": 75,
5    "is_tor": false,
6    "is_proxy": true,
7    "proxy_type": "VPN",
8    "proxy_provider": "Nord VPN",
9    "is_anonymous": true,
10    "is_known_attacker": true,
11    "is_spam": false,
12    "is_bot": false,
13    "is_cloud_provider": true,
14    "cloud_provider": "Packethub S.A."
15  },
16  "location": {
17    "continent_code": "OC",
18    "continent_name": "Oceania",
19    "country_code2": "AU",
20    "country_code3": "AUS",
21    "country_name": "Australia",
22    "country_name_official": "Commonwealth of Australia",
23    "country_capital": "Canberra",
24    "state_prov": "Queensland",
25    "state_code": "AU-QLD",
26    "district": "",
27    "city": "Brisbane",
28    "zipcode": "4101",
29    "latitude": "-27.47306",
30    "longitude": "153.01421",
31    "is_eu": false,
32    "country_flag": 
33      "https://ipgeolocation.io/static/flags/au_64.png",
34    "geoname_id": "10113228",
35    "country_emoji": "🇦🇺"
36  }
37}

    Bulk IP Security Lookup

    Our IP Security API allows you to retrieve security details for up to 50,000 IPs at once using the bulk lookup feature. This powerful capability saves time and enables users to analyze large volumes of IP behavior patterns quickly and efficiently. Through bulk IP security lookups, organizations can detect VPN usage at scale, perform VPN checks, identify proxies, bots, and known attackers across large datasets, and automate threat detection workflows for real-time security monitoring.

    Whether you're monitoring user activity, blocking suspicious traffic, or conducting cybersecurity audits, the bulk lookup API is built to support high-performance threat intelligence operations.

    Request
    curl -X POST 'https://api.ipgeolocation.io/v2/security-bulk?apiKey=API_KEY' -H 'Content-Type: application/json' -d '{
  "ips": ["1.0.0.0", "1.0.0.1", "1.0.0.2"]
}'

    Response in Multiple Languages

    You can retrieve the geolocation information for an IP address in the following languages:

    English FlagEnglish German FlagGerman Russian FlagRussian Japanese FlagJapanese French FlagFrench Chinese Simplified FlagChinese Simplified Spanish FlagSpanish Czech Republic FlagCzech Republic Italian FlagItalian Korean FlagKorean Persian FlagPersian Portuguese FlagPortuguese Standard Arabic FlagStandard Arabic

    Use Cases

    Login Protection

    When a user attempts to log in, their IP address can be analyzed for threat level, proxy or VPN usage, and whether it is associated with known attackers, spam, or bots. Leveraging advanced VPN detection, this API stands out as one of the most reliable VPN detector services.

    It plays a key role in controlling unauthorized logins and reducing the risk of multiple account creation. This use case is especially important for banking platforms, SaaS applications, and any user-based systems where security and identity integrity are paramount.

    Login Protection image

    E-commerce Fraud Prevention

    During the checkout process, the API works as a reliable proxy checker by analyzing the customer’s IP address. It can detect whether the IP is associated with a VPN, proxy, Tor, bot, spam, cloud provider, or shows a suspicious location mismatch. This helps prevent fraudulent transactions, such as fake orders or the use of stolen credit cards, protecting both your business and your customers.

    Fraud Prevention image

    Real-Time Chat & Community Filtering

    Before allowing users to send messages or join live chats, you can leverage the API’s bot detection and threat analysis features to evaluate their IP address. This helps identify spammy behavior, anonymous access, or any history of malicious activity. It ensures a safer and more trustworthy environment for gaming platforms, community forums, and live chat applications.

    Chat Protection image

    Location Based Restriction

    Combining geolocation data with security analysis provides a more comprehensive defense against privacy and security threats. The combination of geolocation with IP address security features enables you to make stronger security decisions.The method proves useful in blocking specific regions that take part in harmful activities thus minimizing security threats.

    Location Based Restriction image

    AS Number Based Protection

    Our IP Security API not only provides the AS Number but also reveals the associated ASN organization and company name, along with detailed security insights and geolocation data. This empowers security teams to identify and block entire networks or specific organizations involved in malicious activity. It allows for broader, more accurate, and proactive threat mitigation through enhanced visibility and context.

    AS Number Based Protection image

    Ready to get started?Get Started with IP Security API Today

    Enrich every request with precise geolocation and real-time threat intelligence, delivered on a global edge with a 99.99% uptime SLA. Start free and scale when you’re ready.

    Get Started
    CTA Illustration
    CTA Illustration
    Documentation

    IP Security API

    Overview

    IP Security API provides detailed security information for a given IP address. It detects whether the IP is associated with a proxy, Tor node, or bot, and identifies the proxy type (e.g., VPN, PROXY, RELAY) along with its VPN/proxy service provider—making it a powerful VPN checker. The API also flags IPs involved in spam activities and checks if the IP is linked to a cloud provider, including the cloud provider’s name.

    The IP Security API offers two endpoints for threat detection, supporting both single and bulk IP lookups.

    Note
    For client-side calls to the endpoints mentioned below using the Request Origin (available on paid plans only), the apiKey parameter can be omitted.

    Single IP Security Lookup API

    1.Lookup With IP

    You can use the single IP lookup API to get security details of a given IP in both JSON and XML formats.The URL for this API is https://api.ipgeolocation.io/v2/security?apiKey=API_KEY&ip=2.56.188.34 and its default JSON response is shown below:

    Loading code block…

    2.Lookup Without an IP

    Without passing IP Address, API returns the security health details of the client device IP. You can perform this lookup using the following URL: https://api.ipgeolocation.io/v2/security?apiKey=API_KEY and its default JSON response is given below:

    Loading code block…

    Parameters

    You can use following parameters to customize the API response according to your requirements.

    1.Including Data (include)

    This parameter accepts multiple values: location, network, currency, time_zone, user_agent, country_metadata , hostname, liveHostname, hostnameFallbackLive

    i.Combine IP Security with Geolocation

    This parameter accepts two values: location and network . To retrieve security details along with geolocation data, set the include parameter to location like mentioned below. Note that the apiKey is also passed with query parameter for authorization. The response for this parameter appears below.

    Loading code block…

    ii.Combine IP Security with Network Details

    To retrieve security details along with AS Number and network information, set the include parameter to network like mentioned below. Note that the apiKey is also passed with query parameter for authorization. The response for this parameter appears below.

    Loading code block…

    iii.Combine IP Security with Both Geolocation and Network details

    For complete security insights, you can include both geolocation data and network information of an IP address. To do this, set the Include by separating them with a comma include=location,network like mentioned below. Note that the apiKey is also passed with query parameter for authorization. The response for these values given below:

    Loading code block…

    iv.Combine IP Security with Timezone details

    Get actual time zone of particular IP along with its proxy details. For this you have to put time_zone keyword in include parameter like mentioned below. Time zone details are combined with default response.

    Loading code block…

    v.Combine IP Security with User Agent

    Get the user agent of client device along with its proxy details. For this you have to provide user_agent keyword in include parameter like mentioned below. User agent information is merged with default response.

    Loading code block…

    vi.Combine IP Security with Currency details

    Get the currency of particular IP along with its proxy details. For this you have to put currency keyword in include parameter like mentioned below. Currency details are combined with default response.

    Loading code block…

    vii.Combine IP Security with Country Metadata details

    Get the country metadata of particular IP along with its proxy details. For this you have to put country_metadata keyword in include parameter like mentioned below. Country metadata details are combined with default response.

    Loading code block…

    viii.Combine IP Security with Hostname

    You can also retrieve the hostname associated with an IP address by providing one of the following values in the include parameter:

    If the hostname cannot be resolved, the queried IP address will be returned in the hostname field.

    1. hostname – Queries only the latest local database.
    2. liveHostname – Performs a live hostname lookup only.
    3. hostnameFallbackLive – First checks the local database, then falls back to a live lookup if no result is found.
    Loading code block…

    ix.Combine IP Security with all fields

    To retrieve a complete and detailed response from the API, you need to explicitly include all of the following fields in the include parameter:
    location, network, currency, time_zone, user_agent, country_metadata, hostname .
    Each of these fields provides a specific layer of information, and combining them with security details ensures you receive the full scope of security data.

    Here's how you can do it

    Loading code block…

    2.Excluding Fields (excludes)

    You can exclude specific fields from the API response based on your requirements, except for the ip field, which is always included. For example, If you want to remove is_tor and is_cloud_provider from api response, you can put the keys in excludes parameter like this:

    Loading code block…

    3.Get Specific Fields (fields)

    You can also retrieve only the specific fields you need from the geolocation and network details. To do this, use the fields parameter and specify the object and field names you want in the response. For example, if you only need threat_score , city and as_number in api response, you can put the keys in fields parameter, as demonstrated in the URL below. Please note that, to make this work, you need to include the objects that aren't included by default. If you're selecting specific fields from those objects (like location or network), make sure to include the full object first. Kindly refer to example given below:

    Loading code block…

    Response in Multiple Languages

    You can retrieve only the location information for an IP address from the IP Security API in any of these languages:

    • English (en)
    • German (de)
    • Russian (ru)
    • Japanese (ja)
    • French (fr)
    • Chinese Simplified (cn)
    • Spanish (es)
    • Czech (cs)
    • Italian (it)
    • Korean (ko)
    • Persian (fa)
    • Portuguese (pt)

    By default, the API responds in English. You can change the response language by passing the language code as a query parameter lang Here is an example to get the geolocation data for IP adderss '2.56.188.34' in Chinese language:

    Loading code block…

    Bulk IP Security Lookup API

    The Bulk IP Security Lookup API allows you to retrieve security details for up to 50,000 IP addresses in a single request . It supports the same customization parameters as the Single IP Security Lookup API, enabling you to tailor the response to your needs. You can find the API endpoint and a sample JSON response below.

    Loading code block…

    Reference to IP Security API Response

    Below, we provide separate tables for each JSON object in the response, listing all possible fields available across the security endpoint.

    1.Standalone fields reference

    FieldTypeDescriptionCan be empty?
    ipstring

    IP address that is used to lookup security information.

    		No
    hostnamestring

    Hostname of the IP address used to query IP Security API.

    		No

    2. security json object reference

    FieldTypeDescriptionCan be empty?
    threat_scorenumber

    IP address’ threat score. It ranges from 0 to 100. 100 indicates highest threat and vice versa for lower score.

    		No
    is_torboolean

    Indicates if the IP address is being consumed on a Tor endpoint.

    		No
    is_proxyboolean

    Indicates if the IP address belongs to a proxy network.

    		No
    proxy_typestring

    Type of the proxy network if the IP address belongs to a proxy network.

    		Yes
    proxy_providerstring

    Name of the proxy provider, if the IP address belongs to a proxy network.

    		Yes
    is_anonymousboolean

    Indicates if the IP address is being used anonymously.

    		No
    is_known_attackerboolean

    Indicates if the IP address is enlisted as an attacking IP address.

    		No
    is_spamboolean

    Indicates if the IP address is enlisted as a spam IP address.

    		No
    is_botboolean

    Indicates if the IP address is enlisted as a bot IP address.

    		No
    is_cloud_providerboolean

    Indicates if the IP address belongs to a cloud provider (computing infrastructure providers).

    		No
    cloud_providerboolean

    Name of the Cloud Provider, if the IP address belongs to a cloud provider.

    		Yes

    3. location json object reference

    FieldTypeDescriptionCan be empty?
    continent_codestring

    2-letter code of the continent.

    		No
    continent_namestring

    Name of the continent.

    		No
    country_code2string

    Country code (ISO 3166-1 alpha-2) of the country.

    		No
    country_code3string

    Country code (ISO 3166-1 alpha-3) of the country.

    		No
    country_namestring

    Name of the country.

    		No
    country_name_officialstring

    Official name (ISO 3166) of the country.

    		No
    country_capitalstring

    Name of the country’s capital.

    		No
    state_provstring

    Name of the state/province/region.

    		Yes
    state_codestring

    Code of the state/province/region.

    		Yes
    districtstring

    Name of the district or county.

    		Yes
    citystring

    Name of the city.

    		Yes
    zipcodestring

    ZIP/Postal code of the place.

    		Yes
    latitudestring

    Latitude of the place.

    		No
    longitudestring

    Longitude of the place.

    		No
    is_euboolean

    Is the country belong to European Union?

    		No
    country_flagstring

    URL to get the country flag.

    		No
    geoname_idstring

    Geoname ID of the place from geonames.org

    		Yes
    country_emojistring

    Emoji of the Country flag.

    		Yes

    4. network json object reference

    FieldTypeDescriptionCan be empty?
    asn.as_numberstring

    Autonomous system number of the autonomous system, to which IP address belongs to.

    		Yes
    asn.organizationstring

    Legal Full Name of AS organization holding the IP address.

    		Yes
    asn.countrystring

    Name of the country, ASN is residing.

    		Yes
    company.namestring

    Name of the company/ISP holding the IP address.

    		No

    5. currency json object reference

    FieldTypeDescriptionCan be empty?
    codestring

    Currency code (ISO 4217).

    		No
    namestring

    Currency name (ISO 4217).

    		No
    symbolstring

    Currency symbol.

    		No

    6. country_metadata json object reference

    FieldTypeDescriptionCan be empty?
    calling_codestring

    Calling code/Dialing code of the country.

    		No
    tldstring

    Top Level Domain Name (TLD) of the country, which is also called ccTLD.

    		No
    languageslist of strings

    List of the languages’ codes, spoken in the country.

    		No

    7. time_zone json object reference

    FieldTypeDescriptionCan be empty?
    namestring

    Name (ISO 8601) of the time zone.

    		No
    offsetnumber

    Time zone offset from UTC.

    		No
    offset_with_dstnumber

    Time zone with DST offset from UTC.

    		No
    current_timestring

    Current time in ‘yyyy-MM-dd HH:mm:ss.SSS±ZZZ’ format.

    		No
    current_time_unixfloat

    Current time in seconds since 1970.

    		No
    is_dstboolean

    Is the time zone in daylight savings?

    		No
    dst_savingsnumber

    Total daylight savings.

    		No
    dst_existsboolean

    Indicates whether Daylight Saving Time (DST) is observed in the region. If true, the dst_start and dst_end objects will include detailed DST transition information.

    		No
    dst_start.utc_timestring

    The date and time in UTC when DST begins.

    		No
    dst_start.durationstring

    The time change that occurs when DST starts.

    		No
    dst_start.gapboolean

    Is there a gap when the clocks jump forward or not.

    		No
    dst_start.date_time_afterstring

    The local date and time that immediately follows the start of DST.

    		No
    dst_start.date_time_beforestring

    The local date and time immediately before DST begins.

    		No
    dst_start.overlapboolean

    Whether there is an overlap of time due to clocks being set back when DST starts.

    		No
    dst_end.utc_timestring

    The date and time in UTC when DST ends.

    		No
    dst_end.durationstring

    The time change that occurs when DST ends.

    		No
    dst_end.gapboolean

    Is there a gap when the clocks jump backward or not.

    		No
    dst_end.date_time_afterstring

    The local date and time that immediately follows the ends of DST.

    		No
    dst_end.date_time_beforestring

    The local date and time immediately before DST ends.

    		No
    dst_end.overlapboolean

    Whether there is an overlap of time due to clocks being set back when DST ends.

    		No

    8. user_agent json object reference

    FieldTypeDescriptionCan be empty?
    user_agent_stringstring

    User-Agent string passed along with the query in the 'User-Agent' header.

    		No
    namestring

    User-Agent Name.

    		No
    typestring

    User-Agent Class.

    		No
    versionstring

    User-Agent Version.

    		No
    version_majorstring

    User-Agent Version Major.

    		No
    device.namestring

    Device Name.

    		No
    device.typestring

    Device Type.

    		No
    device.brandstring

    Device Brand.

    		No
    device.cpustring

    Device CPU Model.

    		No
    engine.namestring

    Layout Engine Name

    		No
    engine.typestring

    Layout Engine Class

    		No
    engine.versionstring

    Layout Engine Version.

    		No
    engine.version_majorstring

    Layout Engine Version Major.

    		No
    operating_system.namestring

    Operating System Name.

    		No
    operating_system.typestring

    Operating System Class.

    		No
    operating_system.versionstring

    Operating System Version.

    		No
    operating_system.version_majorstring

    Operating System Version Major.

    		No
    operating_system.buildstring

    Operating System Version Major.

    		No

    Error Codes

    IP Security API returns HTTP status code 200 for a successful API request along with the response.

    While, in case of a bad or invalid request, IP Security API returns 4xx HTTP status code along with a descriptive message explaining the reason for the error.

    Below is a detailed explanation of the specific HTTP status codes and their corresponding error conditions:

    HTTP StatusDescription
    400
    Bad Request

    It is returned for one of the following reasons:

    • If the provided IPv4, IPv6 address, or domain name is invalid.

    • If special character(s) ( ) [ ] { } | ^ ` is passed in the API URL either as parameter or its value. Specially in case of API key.

    • If the IP addresses JSON list is empty, or the provided JSON does not have 'ips' field while querying /security-bulk endpoint.

    • If more than 50,000 IP addresses are provided while quering from /security-bulk endpoint.

    401
    Unauthorized

    It is returned for one of the following reasons:

    • If API key (as apiKey URL parameter) is missing from the request to IP Security API.

    • If an invalid (a random value) API key is provided.

    • If the API request is made from an unverified ipgeolocation.io account.

    • If your account has been disabled or locked to use by the admin due to abuse or illegal activity.

    • When the request to IP Security API is made using API key for a database subscription

    • When the request to IP Security API is made on the 'paused' subscription.

    • If you’re making API requests after your subscription trial has been expired.

    • If your active until date has passed and you need to upgrade your account.

    • If bulk IP to security look-ups endpoint is called using free subscription API key.

    404
    Not Found

    It is returned for one of the following reasons:

    • If the IPv4, IPv6, or domain name does not not exists in our database.

    • If the IPv4, IPv6, or domain name is passed as a path variable, instead of url parameter as ip= .

    • If the wrong endpoint is called, that does not exists in our API.

    405
    Method Not Allowed

    • If wrong HTTP request method is used for calling the endpoints. Only GET and POST methods are allowed. POST method for /security-bulk   endpoint and GET method for /security endpoint requests.

    413
    Content Too Large

    • If the passed data in the POST requests is more than the limit of the API.

    415
    Unsupported Media Type

    • If the payload for IPs in /security-bulk endpoint is missing, or the content type is not mentioned as JSON.

    423
    Locked

    • If the passed IP address is from a bogon ip ranges, or is part of a private network.

    429
    Too Many Requests

    It is returned for one of the following reasons:

    • If the API usage limit has reached for the free subscriptions, or paid subscriptions with the status 'past due', 'deleted' or 'trial expired'.

    • If the surcharge API usage limit has reached against the subscribed plan.

    499
    Client Closed Request

    • If the client has set the very short request or connection timeout, leading to the server closing the request prematurely.

    5XX
    Server Side Error

    • If a 500 (Internal Server Error), 502 (Bad Gateway), 503 (Service Unavailable), 504 (Gateway Timeout), or 505 (HTTP Version Not Supported) status code is returned, it indicates an issue on our end. Please contact us with your request at [email protected] for further assistance.

    API SDKs

    To facilitate the developers, we have added some SDKs for various programming languages. The detailed documentation on how to use these SDKs is available in the respective SDK's documentation page linked below.

    Our SDKs are also available on Github. Feel free to help us improve them. Following are the available SDKs:

    Frequently Asked Questions

    Threat intelligence in the cyber domain represents the method of gathering, analyzing and understanding data regarding possible cyber attacks. Currently, organizations use data for threat forecasting while processing raw information into valuable insights that secure them against hackers. Threat intelligence system functions like a weather alert system in digital world. It helps organizations to detect threats before they appear, better understand the motives of attackers and take preventive measures.
    VPN (Virtual Private Network) is a service that encrypts a user's traffic by creating tunnel and routes it via remote server, masking user's original IP. This encryption saves user's online activity and sensitive data from being exposed on internet. Unlike a proxy, a VPN not only masks your IP and changes your location but also provides stronger anonymity and privacy.
    • Proxy: Routes traffic via an intermediate server.
    • VPN: Adds encryption and hides your activity.
    • TOR: Bounces traffic through multiple nodes.
    There are many services providing VPN IPs data, but ipgeolocatio.io provides accurate and comprehensive VPN/proxy IPs data including spam, bot, tor, attacker, and anonymous IPs. The data is also enriched with the proxy provider name and the cloud provider name associated with each IP. Data also includes location and network details of IPs, making it one of the best VPN/proxy data.

    You can access our comprehensive and accurate VPN database through our Databases

    Yes, the IP Security API supports batch IP address lookups. It allows users to query up to 50,000 IPs in one request. The requests made in the batch will count towards your total API usage.

    Yes, we provide latest sample VPN/Proxy data for users to evaluate quality and observe it's structure. You can refer to Security DB Docs.

    The proxy server is a bridge between user's device and destination website. The request first goes from user's device to that proxy server, then the server makes a request to the desired website, gets the response, and sends it back to the user's device. Usually, it does not provide sending or receiving data encryption. It only masks the user's original IP, so it is generally used to avoid geolocation based restrictions.
    Tor (The Onion Router) is an open-source web browsing network that provides multiple layers of anonymity to provide enhanced online privacy. In this network, user requests are encrypted in multiple layers and redirected through a series of routers called nodes, masking the original IP address. The multi-layered encryption and routing system creates anonymous traffic that becomes challenging to track down its source and destination points.
    Yes VPN is better in terms of privacy than proxy. VPN routes user's traffic through remote sever while encrypting user's data, where as proxy usually does not encrypt the traffic. Proxy just routes traffic through intermediate server providing only IP masking and changed geolocaton.

    You can check if particular IP is VPN or proxy by simply making request to the endpoint: Refer to the above documentation.

    IP Security API provides detailed security data of provided IP including threat score(calculated from security attributes), is proxy, proxy type(e.g. VPN, PROXY, RELAY, OPENVPN, WIREGUARD, PRIVATEVPN), proxy provider name, tor, bot, spam, anonymous, attacker, is cloud provider, cloud provider name.
    Our IP Security API data updates every 24 hours. Our downloadable databases are available with weekly and monthly updates, providing you with the most up-to-date security information.

    Subscribe Our Newsletter

    Get the latest in geolocation tech, straight to your inbox.