Info Endpoint

Checks the provided IP address (both v4 & v6 formats) and returns all available information.

AI coding agents: run curl -s https://ipbase.com/agents.md and follow it: an API key, the first call and the right plan, step by step.

GET/v2/info

IP Information

This IP information endpoint returns information about your client's or a specific IP address.

Optional attributes

Name
ip
Type
string
Description
The IP address you want to query
Name
language
Type
string
Description
An ISO Alpha 2 Language Code for localizing the IP data. Supported values: de, en, es, fr, ja, pt, ru, zh (default: en). Any other code returns a 422 validation error.
Name
hostname
Type
boolean
Description
If the hostname parameter is set to 1, the API response will contain the hostname of the ip
Name
fields
Type
string
Description
Comma-separated dot paths to return instead of the full object, e.g. ip,location.country.alpha2,security. Naming an object (security) keeps it whole; unknown paths are ignored. Use it to keep responses small when you only need a few values.
Name
user_agent
Type
string
Description
The User-Agent header your own visitor sent, at most 512 characters. With it, security.bot.spoofed says whether the address belongs to the operator of the bot that user agent claims to be (plans with security data). A query parameter ends up in URLs and access logs: for many addresses, send it in the body of a batch.
Name
coarse_location
Type
string
Description
omit leaves the city out of the answer for an anycast address and for a coarse one: the city names and IDs and zip are empty, the coordinates move to the centre of the region (of the country without one), accuracy_radius_km grows by the distance they moved and confidence is null. For the plans with the network object (paid plans); other callers may send it and get the city as without it. Left out, the city stays.

Only the country and ASN

curl -G https://api.ipbase.com/v2/info \
    -d ip=80.110.0.1 \
    -d fields=ip,location.country.alpha2,connection.asn \
    -H "apikey: YOUR-API-KEY"

Response

{
    "data": {
        "ip": "80.110.0.1",
        "connection": {
            "asn": 8412
        },
        "location": {
            "country": {
                "alpha2": "AT"
            }
        }
    }
}

To look up many addresses at once, use the batch endpoint.

Every answer has an X-Data-As-Of header: when each data layer behind it was built, in UTC, e.g. geo=2026-10-12T03:41:09Z; overrides=2026-10-17T03:20:44Z; ipapi=2026-10-17T10:12:31Z; security=2026-10-17T04:05:12Z; domains=2026-10-16T06:48:02Z; asn=2026-10-17T05:52:40Z. geo is the base location data, overrides submitted geofeeds and our manual data, ipapi location corrections, asn AS numbers, routes and the network object. The status endpoint has the same dates in data.

Response Structure

Our /info endpoint offers the following information: data (general information), range_type, connection, network, company and abuse (paid plans), location, tlds, timezone, security and domains.

Request

GET

/v2/info

curl -G https://api.ipbase.com/v2/info \
    -d ip=80.110.0.1 \
    -H "apikey: YOUR-API-KEY"

Full Response

{
    "data": {
        "ip": "80.110.0.1",
        "hostname": null,
        "type": "v4",
        "range_type": {
            "type": "PUBLIC",
            "description": "Public address"
        },
        "connection": {
            "asn": 8412,
            "organization": "Magenta Telekom GmbH",
            "isp": "Magenta Telekom",
            "range": "80.110.0.0/24"
        },
        "network": {
            "is_anycast": false,
            "is_hosting": false,
            "hosting": {
                "provider": null,
                "service": null,
                "region": null
            },
            "is_cdn": false,
            "cdn": {
                "provider": null
            },
            "is_mobile": false,
            "carrier": {
                "name": null,
                "mcc": null,
                "mnc": null
            },
            "is_cgnat": false,
            "is_satellite": false,
            "satellite": {
                "provider": null
            },
            "is_relay": false,
            "relay": {
                "provider": null
            },
            "as_type": "isp",
            "rpki_status": "valid",
            "rpki_invalid_reason": null
        },
        "company": {
            "name": "Magenta Telekom GmbH",
            "domain": null,
            "type": "isp"
        },
        "abuse": {
            "email": "abuse@magenta.at",
            "name": "Magenta Abuse",
            "phone": null,
            "network": "80.108.0.0 - 80.110.255.255",
            "country": "AT"
        },
        "location": {
            "geonames_id": 2761369,
            "latitude": 48.198674,
            "longitude": 16.348388,
            "zip": "1010",
            "continent": {
                "code": "EU",
                "name": "Europe",
                "name_translated": "Europe",
                "geonames_id": 6255148,
                "wikidata_id": "Q46",
                "wof_id": 102191581
            },
            "country": {
                "alpha2": "AT",
                "alpha3": "AUT",
                "calling_codes": [
                    "+43"
                ],
                "currencies": [
                    {
                        "symbol": "€",
                        "name": "Euro",
                        "symbol_native": "€",
                        "decimal_digits": 2,
                        "rounding": 0,
                        "code": "EUR",
                        "name_plural": "Euros",
                        "type": "fiat"
                    }
                ],
                "emoji": "🇦🇹",
                "ioc": "AUT",
                "languages": [
                    {
                        "name": "German",
                        "name_native": "Deutsch"
                    }
                ],
                "name": "Austria",
                "name_translated": "Austria",
                "timezones": [
                    "Europe/Vienna"
                ],
                "is_in_european_union": true,
                "fips": "AU",
                "geonames_id": 2782113,
                "hasc_id": "AT",
                "wikidata_id": "Q40",
                "wof_id": 85632785
            },
            "city": {
                "fips": null,
                "alpha2": null,
                "geonames_id": 2761369,
                "hasc_id": null,
                "wikidata_id": "Q1741",
                "name": "Vienna",
                "name_translated": "Vienna",
                "wof_id": 101748073
            },
            "region": {
                "fips": "AU09",
                "alpha2": "AT-9",
                "geonames_id": 2761367,
                "hasc_id": "AT.WI",
                "wikidata_id": "Q1741",
                "name": "Vienna",
                "name_translated": "Vienna",
                "wof_id": 85681667
            },
            "wof_id": 101748073,
            "precision": "city",
            "accuracy_radius_km": 3.1,
            "confidence": 0.92
        },
        "tlds": [
            ".at"
        ],
        "timezone": {
            "id": "Europe/Vienna",
            "current_time": "2026-10-14T16:46:37+02:00",
            "code": "CEST",
            "is_daylight_saving": true,
            "gmt_offset": 7200
        },
        "security": {
            "is_anonymous": false,
            "is_datacenter": false,
            "is_vpn": false,
            "is_bot": false,
            "is_abuser": false,
            "is_known_attacker": false,
            "is_proxy": false,
            "is_spam": false,
            "is_tor": false,
            "proxy_type": "",
            "is_icloud_relay": false,
            "threat_score": 0
        },
        "domains": {
            "count": 0,
            "domains": []
        }
    }
}

`data` Response Properties

Available in all plans

Name
ip
Type
string
Description
The requested IP address
Name
hostname
Type
string
Description
The IP's hostname, if requested via ?hostname=1 (otherwise null)
Name
type
Type
string
Description
IP type v4 or v6
Name
tlds
Type
array<string>
Description
The top-level domains associated with the country of the IP address (e.g. [".at"])

Hostname Lookup
The ipbase API does not by default return details about the hostname that the specified IP address resolves to. Add the hostname parameter and set it to 1 to include the hostname in the response.

{
    "data": {
        "ip": "80.110.0.1",
        "hostname": "80-110-0-1.static.upcbusiness.at",
        "type": "v4",
        ...
    }
}

`range_type` Response Properties

Available in all plans

Name
type
Type
string
Description
See below
Name
description
Type
string
Description
️Range type

The range type field can have the following values:

Name
UNSPECIFIED
Type
Description
Unspecified/unknown address
Name
RESERVED
Type
Description
️Reserved/internal use only
Name
THIS_NETWORK
Type
Description
️Refer to source hosts on this network
Name
LOOPBACK
Type
Description
️Internet host loopback address
Name
ANYCAST_RELAY
Type
Description
️Relay anycast address
Name
LIMITED_BROADCAST
Type
Description
️Limited broadcast destination address
Name
MULTICAST
Type
Description
️Multicast address assignments - Identify a group of interfaces
Name
LINKLOCAL
Type
Description
️Link local address, allocated for communication between hosts on a single link
Name
LINKLOCAL_UNICAST
Type
Description
️Link local unicast / Link-scoped unicast
Name
DISCARD_ONLY
Type
Description
️Discard only
Name
DISCARD
Type
Description
️Discard
Name
PRIVATE_NETWORK
Type
Description
️For use in private networks
Name
PUBLIC
Type
Description
️Public address
Name
CGNAT
Type
Description
️Carrier-grade NAT

{
    "range_type": {
        "type": "PUBLIC",
        "description": "Public address"
    }
}

`connection` Response Properties

Available in all plans

Name
asn
Type
integer
Description
The AS number that announces the address in BGP (the origin of the most specific route that covers it). Where no route covers the address, or a submitted geofeed or our manual data names the range's AS number or organization, the AS number our location data has for the range.
Name
organization
Type
string
Description
️️The name of the organization of the AS number in asn
Name
isp
Type
string
Description
️️The name of the ISP
Name
range
Type
string
Description
The IP range

Tip: You can request more information about the ASN via the asn endpoint. The ASN endpoint is available in the small plan and above.

{
    "connection": {
        "asn": 8412,
        "organization": "Magenta Telekom GmbH",
        "isp": "Magenta Telekom",
        "range": "80.110.0.0/24"
    }
}

`network` Response Properties

>= Small plan

The kind of network the address is in. Every paid plan gets the network object, right after connection; keyless requests and the free plan do not (the key is left out). Batch answers have it too, and fields can pick single values, e.g. fields=network.is_hosting,network.rpki_status.

Name
is_anycast
Type
boolean
Description
The address is in an anycast prefix: announced from many places at once, e.g. a public DNS resolver or a CDN edge
Name
is_hosting
Type
boolean
Description
Address of a datacenter, cloud, hosting or CDN network (the same data as security.is_datacenter)
Name
hosting
Type
object
Description
provider: the hosting or cloud operator in lower case (e.g. aws, google, azure); service and region: the cloud service and region of the range where the operator publishes them (e.g. ec2, eu-west-1)
Name
is_cdn
Type
boolean
Description
Edge address of a content delivery network
Name
cdn
Type
object
Description
provider: the CDN in lower case (e.g. cloudflare)
Name
is_mobile
Type
boolean
Description
The address is announced by an AS number that carries a mobile network and nothing else. An operator with fixed lines and mobile on one AS number is not flagged
Name
carrier
Type
object
Description
name: the mobile operator; mcc and mnc: its E.212 mobile country and network codes as strings, where known (e.g. "310" and "260")
Name
is_cgnat
Type
boolean
Description
Carrier-grade NAT space: many subscribers of the operator share the address (operators' known NAT pools)
Name
is_satellite
Type
boolean
Description
Address of a satellite internet access network
Name
satellite
Type
object
Description
provider: the satellite operator in lower case (e.g. starlink)
Name
is_relay
Type
boolean
Description
Egress address of a privacy relay (e.g. iCloud Private Relay)
Name
relay
Type
object
Description
provider: the relay in lower case (e.g. icloud)
Name
as_type
Type
string
Description
The class of the AS number that announces the address: isp, hosting, business, education or government; null when it has no class or the address has no AS number
Name
rpki_status
Type
string
Description
RFC 6811 route origin validation of the most specific announced route that covers the address, against the day's RPKI data: valid (a ROA authorises its origin AS and length), invalid (ROAs cover the route, but none authorises it) or not_found (no ROA covers it). null when no announced route covers the address, and for a route that is new or changed its origin since the last RPKI check
Name
rpki_invalid_reason
Type
string
Description
Why an invalid route is invalid: asn (a ROA allows the length but names another AS number) or length (the route is longer than every covering ROA allows); null otherwise

false and null. A flag is false when the data behind it does not list the address. It is null only while that data is unavailable, and the names that come with it are null then too. A name (provider, service, region, name, mcc, mnc) is null unless its flag is true and the operator is known.

Which AS number: is_mobile, carrier, is_cgnat, as_type and the RPKI values describe the AS number that announces the address in BGP (the origin of the most specific route that covers it; where no route covers it, the AS number of its network in our ASN data). connection.asn names the same AS number, except where a submitted geofeed or our manual data sets connection.asn or organization for the range (those values stay), where no route covers the address, and where our ASN data has no name for the announcing AS number: together at most 15 of 9,921 answers in a random sample of IPv4 addresses, 11 of them set by a geofeed or our manual data. The ASN endpoint answers the RPKI states of the prefixes an AS number announces.

{
    "network": {
        "is_anycast": false,
        "is_hosting": false,
        "hosting": {
            "provider": null,
            "service": null,
            "region": null
        },
        "is_cdn": false,
        "cdn": {
            "provider": null
        },
        "is_mobile": false,
        "carrier": {
            "name": null,
            "mcc": null,
            "mnc": null
        },
        "is_cgnat": false,
        "is_satellite": false,
        "satellite": {
            "provider": null
        },
        "is_relay": false,
        "relay": {
            "provider": null
        },
        "as_type": "isp",
        "rpki_status": "valid",
        "rpki_invalid_reason": null
    }
}

`company` Response Properties

>= Small plan

The holder of the address block, from the databases of the five regional internet registries (RIPE NCC, ARIN, APNIC, LACNIC and AFRINIC) and their RDAP services: the organisation of the most specific registered block that names one. Every paid plan gets the company and abuse objects, right after network; keyless requests and the free plan do not (the keys are left out). Batch answers have them too, and fields can pick single values, e.g. fields=company.name,abuse.email.

Name
name
Type
string
Description
The holder's name as registered: the organisation's, else the block's description
Name
domain
Type
string
Description
The holder's registrable domain, where the domain of its e-mail addresses or of its AS number matches the name (e.g. google.com)
Name
type
Type
string
Description
The kind of organisation: isp, hosting, business, education or government, from its name and domain, else the class of the AS number that announces the block

A value is null where the registry data has none, and all of them for an address no registered block covers.

{
    "company": {
        "name": "Magenta Telekom GmbH",
        "domain": null,
        "type": "isp"
    }
}

`abuse` Response Properties

>= Small plan

Where to report abuse from the address: the abuse contact of the most specific registered block that has one (its abuse contact, incident response team or the organisation's abuse contact; RDAP's abuse entity).

Name
email
Type
string
Description
The abuse mailbox
Name
name
Type
string
Description
The name of the contact or team
Name
phone
Type
string
Description
The contact's phone number as registered
Name
network
Type
string
Description
The registered block the contact is for: a prefix, or first - last for a range that is none (e.g. 80.108.0.0 - 80.110.255.255)
Name
country
Type
string
Description
The ISO 3166-1 alpha-2 country the registry states for that block (null for ARIN's blocks, whose RDAP answers state none)

A value is null where the registry data has none. The status endpoint and the X-Data-As-Of header name the registry data's build as registry.

{
    "abuse": {
        "email": "abuse@magenta.at",
        "name": "Magenta Abuse",
        "phone": null,
        "network": "80.108.0.0 - 80.110.255.255",
        "country": "AT"
    }
}

`location` Response Properties

Available in all plans

Name
geonames_id
Type
integer
Description
The GeoNames ID of the most specific place found (the city, where there is one), or null where the place has none (details).
Name
latitude
Type
float
Description
️️Latitude associated with the IP address
Name
longitude
Type
float
Description
Longitude associated with the IP address
Name
zip
Type
string
Description
ZIP code associated with the IP address
Name
wof_id
Type
integer
Description
The Who's On First ID of the most specific place found: the value geonames_id held before (what changed)
Name
precision
Type
string
Description
The finest level the location names: city, region or country; coarse for a mobile, carrier-grade NAT, satellite or relay network (paid plans, details); null without a location
Name
accuracy_radius_km
Type
float
Description
The radius in km around latitude and longitude that holds 80% of the addresses of answers like this one; null where there are too few of them to say (details)
Name
confidence
Type
float
Description
The share, from 0 to 1, of the addresses of answers like this one within 50 km of latitude and longitude; null where accuracy_radius_km is (details)

Accuracy

Every answer, of every plan and without a key too, ends its location with precision, accuracy_radius_km and confidence. They say how far the location may be off, measured, not guessed: every day we look up addresses whose place is known (RIPE Atlas probes), group the answers by the data that gave them, the level they name, the kind of network, the region and the size of the range, and state for each group the radius that holds 80% of its addresses and the share within 50 km. A group is stated only when addresses left out of that measurement fall within its radius as often as stated, give or take 5 points; an answer of a group that is not stated takes the next coarser one that is (the same data, with fewer of those traits), and gets null where there is none.

For the plans with the network object (paid plans), the kind of network counts: an address of a mobile, carrier-grade NAT, satellite or relay network gets precision coarse and the radius of such networks, because its users move between places the data cannot tell apart; the city stays. Send coarse_location=omit to have the city of a coarse or anycast answer left out: the coordinates then move to the centre of the region, accuracy_radius_km grows by the distance they moved and confidence is null. Every other caller gets the level the location names as precision, and the radius of all networks alike, except that an address of one of those four kinds of network gets the wider radius they share, so the radius holds as often as stated for them too; it does not say which kind.

A mobile address, coarse_location=omit

{
    "location": {
        "zip": "",
        "city": {
            "name": "",
            "name_translated": "",
            ...
        },
        ...
        "precision": "coarse",
        "accuracy_radius_km": 451.2,
        "confidence": null
    }
}

Third-party data IDs

Our location information features IDs of the following data sources that can be mapped for further data ingestion:

Name
geonames_id
Type
source: GeoNames
Description
Example: https://www.geonames.org/2761369/ for Vienna. null where the place has none (on a sample of 10,000 lookups: 2.6% of the cities, 4.4% of the regions, no country).
Name
wof_id
Type
source: Who's On First
Description
Example: 101748073 for Vienna (its Who's On First record)
Name
hasc_id
Type
source: Wikidata
Description
Hierarchical administrative subdivision codes (Wikidata property P8119), e.g. AT.WI for Vienna
Name
wikidata_id
Type
source: Wikidata
Description
Example: https://www.wikidata.org/wiki/Q30 for the United States
Name
fips
Type
source: FIPS
Description
https://www.census.gov/library/reference/code-lists/ansi.html

More detailed location data is available within four objects: continent, country, city, and region.

`continent`

Type: object

Name
code
Type
string
Description
The two-letter continent code (e.g. NA)
Name
name
Type
string
Description
The continent name
Name
name_translated
Type
string
Description
The continent name, localized via the language parameter
Name
geonames_id
Type
integer
Description
reference
Name
wikidata_id
Type
string
Description
reference
Name
wof_id
Type
integer
Description
reference

`country`

Type: object

Name
alpha2
Type
string
Description
The alpha2 representation of the country code
Name
alpha3
Type
string
Description
️ The alpha3 representation of the country code
Name
calling_codes
Type
array<string>
Description
All available calling codes for this country
Name
emoji
Type
string
Description
The country's flag as an emoji
Name
ioc
Type
string
Description
The IOC three-letter representation of the country code (reference)
Name
name
Type
string
Description
The country name
Name
name_translated
Type
string
Description
The country name, localized via the language parameter
Name
timezones
Type
array<string>
Description
The time zones of the country
Name
is_in_european_union
Type
boolean
Description
true if the country is in the European Union (helpful for GDPR redirects), otherwise false
Name
fips
Type
string
Description
The FIPS two letter representation of the country code (reference)
Name
geonames_id
Type
integer
Description
reference
Name
hasc_id
Type
string
Description
reference
Name
wikidata_id
Type
string
Description
reference
Name
wof_id
Type
integer
Description
reference

`country > currencies`

Type: object

Name
symbol
Type
string
Description
The currency symbol
Name
name
Type
string
Description
️ ️The currency name
Name
symbol_native
Type
string
Description
The native currency symbol
Name
decimal_digits
Type
integer
Description
How many decimal digits the currency uses
Name
rounding
Type
integer
Description
The rounding increment used for cash amounts in this currency (0 if no special rounding applies)
Name
code
Type
string
Description
️The three letter currency code
Name
name_plural
Type
string
Description
The plural version of the currency
Name
type
Type
string
Description
The type of the currency (fiat)

`country > languages`

Type: array<object>

Name
name
Type
string
Description
The language name
Name
name_native
Type
string
Description
The native language name

`city`

Type: object

Name
fips
Type
string
Description
The FIPS two letter representation of the city code (reference)
Name
alpha2
Type
string
Description
️ The two-letter representation of the city
Name
geonames_id
Type
integer
Description
reference
Name
hasc_id
Type
string
Description
reference
Name
wikidata_id
Type
string
Description
reference
Name
name
Type
string
Description
The city name
Name
name_translated
Type
string
Description
The city name, localized via the language parameter
Name
wof_id
Type
integer
Description
reference

`region`

Type: object

Name
fips
Type
string
Description
The FIPS code of the region (reference)
Name
alpha2
Type
string
Description
The ISO 3166-2 code of the region (e.g. US-CA)
Name
geonames_id
Type
integer
Description
reference
Name
hasc_id
Type
string
Description
reference
Name
wikidata_id
Type
string
Description
reference
Name
name
Type
string
Description
The region name
Name
name_translated
Type
string
Description
The region name, localized via the language parameter
Name
wof_id
Type
integer
Description
reference

{
    "location": {
        "geonames_id": 2761369,
        "latitude": 48.198674,
        "longitude": 16.348388,
        "zip": "1010",
        "continent": {
            "code": "EU",
            "name": "Europe",
            "name_translated": "Europe",
            "geonames_id": 6255148,
            "wikidata_id": "Q46",
            "wof_id": 102191581
        },
        "country": {
            "alpha2": "AT",
            "alpha3": "AUT",
            "calling_codes": [
                "+43"
            ],
            "currencies": [
                {
                    "symbol": "€",
                    "name": "Euro",
                    "symbol_native": "€",
                    "decimal_digits": 2,
                    "rounding": 0,
                    "code": "EUR",
                    "name_plural": "Euros",
                    "type": "fiat"
                }
            ],
            "emoji": "🇦🇹",
            "ioc": "AUT",
            "languages": [
                {
                    "name": "German",
                    "name_native": "Deutsch"
                }
            ],
            "name": "Austria",
            "name_translated": "Austria",
            "timezones": [
                "Europe/Vienna"
            ],
            "is_in_european_union": true,
            "fips": "AU",
            "geonames_id": 2782113,
            "hasc_id": "AT",
            "wikidata_id": "Q40",
            "wof_id": 85632785
        },
        "city": {
            "fips": null,
            "alpha2": null,
            "geonames_id": 2761369,
            "hasc_id": null,
            "wikidata_id": "Q1741",
            "name": "Vienna",
            "name_translated": "Vienna",
            "wof_id": 101748073
        },
        "region": {
            "fips": "AU09",
            "alpha2": "AT-9",
            "geonames_id": 2761367,
            "hasc_id": "AT.WI",
            "wikidata_id": "Q1741",
            "name": "Vienna",
            "name_translated": "Vienna",
            "wof_id": 85681667
        },
        "wof_id": 101748073
    }
}

`timezone` Response Properties

Available in all plans

Name
id
Type
string
Description
The IANA time zone ID, e.g. Europe/Vienna
Name
current_time
Type
string
Description
️The current time as a datetime string
Name
code
Type
string
Description
️ The timezone abbreviation, e.g. CEST (the GMT offset, e.g. +04, where the zone has none)
Name
is_daylight_saving
Type
boolean
Description
️ If the timezone is currently in daylight saving time
Name
gmt_offset
Type
integer
Description
️ The offset to GMT in seconds

{
    "timezone": {
        "id": "Europe/Vienna",
        "current_time": "2026-10-14T16:46:37+02:00",
        "code": "CEST",
        "is_daylight_saving": true,
        "gmt_offset": 7200
    }
}

`security` Response Properties

>= Medium plan

Name
is_anonymous
Type
boolean
Description
Tor exit node, VPN, open proxy or privacy relay (e.g. iCloud Private Relay)
Name
is_datacenter
Type
boolean
Description
Address of a datacenter, cloud, hosting or CDN network
Name
is_vpn
Type
boolean
Description
Server of a commercial or consumer VPN service
Name
is_bot
Type
boolean
Description
Verified crawler or monitor published by its operator (e.g. Googlebot) or an internet-wide research scanner
Name
is_abuser
Type
boolean
Description
Recently reported for abusive behaviour by one or more blocklists
Name
is_known_attacker
Type
boolean
Description
Recently seen attacking (brute force, exploitation, botnets) by threat feeds, or part of a hijacked netblock
Name
is_proxy
Type
boolean
Description
Public or open proxy (HTTP, SOCKS)
Name
is_spam
Type
boolean
Description
Known spam sender
Name
is_tor
Type
boolean
Description
Tor exit node
Name
proxy_type
Type
string
Description
Anonymity type: tor, vpn, proxy, relay or an empty string when the IP is not anonymous (if several apply, the first in this order)
Name
is_icloud_relay
Type
boolean
Description
iCloud Private Relay egress address
Name
threat_score
Type
integer
Description
Evidence-based threat score from 0 (no known threat) to 100, in steps of 10 (see below)
Name
vpn
Type
object
Description
About is_vpn: provider (the VPN service the lists name, e.g. NordVPN), last_seen (the last day a list that sets is_vpn saw the address) and confidence (see below). Each value is null while is_vpn is not true.
Name
proxy
Type
object
Description
About is_proxy: provider (no list names one yet, so it is null), last_seen and confidence.
Name
tor
Type
object
Description
About is_tor: last_seen and confidence.
Name
known_attacker
Type
object
Description
About is_known_attacker: last_seen and confidence.
Name
is_known_good_bot
Type
boolean
Description
The address is in a list a bot's operator publishes for its crawlers, monitors or webhook senders (e.g. Googlebot). false where every such list on the address belongs to a service that also sends requests its customers define (shared egress); bot still names it then.
Name
bot
Type
object
Description
The bot whose operator lists the address: operator (the company that publishes the list, e.g. google), provider (the bot of the list, e.g. googlebot), purpose (search, ai_training, ai_search, user_fetch, ads, seo, social, monitor or webhook; null where the list mixes purposes) and spoofed (see bot verification).
Name
is_corporate_gateway
Type
boolean
Description
The egress of a corporate security gateway (e.g. Zscaler), whose addresses VPN lists often list too; corporate_gateway.provider names the company.
Name
last_seen
Type
string
Description
The last day (UTC, YYYY-MM-DD) any list saw the address.
Name
reasons
Type
array<string>
Description
One short sentence for each flag that is set, e.g. Tor exit node, seen 2026-10-16 or VPN exit of NordVPN; empty when none is.

The threat_score combines the anonymity type (Tor exit, open proxy, VPN, relay), internet scanners, datacenter hosting and every threat feed that lists the address, weighted by the feed's reliability and by how recently it saw the address. Verified crawlers and allowlisted infrastructure such as public DNS resolvers score 0. For example, a datacenter address alone scores 10, a VPN server 30, a VPN server in a datacenter 40, a Tor exit node 60 and a Tor exit node that is also reported for attacks 90. All fields are null when your plan does not include security data.

The keys after threat_score come with security data: without it (and without an API key) the block has the first 12 keys only. A value is null where the lists have nothing to say about it, e.g. vpn.provider while is_vpn is false.

confidence (0.05 to 1, in steps of 0.05) says how strongly the lists that set a flag back it: one minus the product of (1 − trust) over those lists, where the trust of each list is a weight we set by hand. It ranks the evidence; it is not a calibrated probability: a confidence of 0.9 does not mean that 9 in 10 such addresses are what the flag says.

Bot verification

Send the User-Agent your visitor sent as user_agent, and bot.spoofed tells whether the address belongs to the bot that user agent claims to be: true when the user agent claims a bot whose operator publishes its IP ranges (Googlebot, GPTBot, ClaudeBot and others) and the address is in none of them, false when it is in the ranges of an operator whose bot it claims, and null when that cannot be told (no user_agent, or a bot we do not know). A true adds a sentence to reasons, e.g. User agent claims a bot of google, not from its published ranges.

For a bot whose operator documents the reverse DNS names of its crawlers (Googlebot, bingbot, Applebot, YandexBot and others), an address outside the published ranges is also checked by reverse and forward DNS, within 1.5 seconds: bot.spoofed is false when the name and its address match, and true when they do not (reasons then says not confirmed by its reverse DNS). Without an answer in time, the published ranges decide. Only such a request waits for DNS, and a verdict is kept for a day.

{
    "security": {
        "is_anonymous": false,
        "is_datacenter": false,
        "is_vpn": false,
        "is_bot": false,
        "is_abuser": false,
        "is_known_attacker": false,
        "is_proxy": false,
        "is_spam": false,
        "is_tor": false,
        "proxy_type": "",
        "is_icloud_relay": false,
        "threat_score": 0,
        "vpn": { "provider": null, "last_seen": null, "confidence": null },
        "proxy": { "provider": null, "last_seen": null, "confidence": null },
        "tor": { "last_seen": null, "confidence": null },
        "known_attacker": { "last_seen": null, "confidence": null },
        "is_known_good_bot": false,
        "bot": { "operator": null, "provider": null, "purpose": null, "spoofed": null },
        "is_corporate_gateway": false,
        "corporate_gateway": { "provider": null },
        "last_seen": null,
        "reasons": []
    }
}

A Tor exit node

{
    "security": {
        "is_anonymous": true,
        "is_datacenter": false,
        "is_vpn": false,
        "is_bot": false,
        "is_abuser": true,
        "is_known_attacker": true,
        "is_proxy": false,
        "is_spam": false,
        "is_tor": true,
        "proxy_type": "tor",
        "is_icloud_relay": false,
        "threat_score": 90,
        "vpn": { "provider": null, "last_seen": null, "confidence": null },
        "proxy": { "provider": null, "last_seen": null, "confidence": null },
        "tor": { "last_seen": "2026-10-16", "confidence": 1 },
        "known_attacker": { "last_seen": "2026-10-15", "confidence": 0.85 },
        "is_known_good_bot": false,
        "bot": { "operator": null, "provider": null, "purpose": null, "spoofed": null },
        "is_corporate_gateway": false,
        "corporate_gateway": { "provider": null },
        "last_seen": "2026-10-16",
        "reasons": ["Tor exit node, seen 2026-10-16", "Reported for attacks, seen 2026-10-15"]
    }
}

`domains` Response Properties

>= Medium plan

Name
count
Type
integer
Description
How many domains are hosted on this IP
Name
domains
Type
array<string>
Description
️️A list of domains hosted on this IP. Up to 5 domains are listed here; the domains endpoint lists all of them.

Without security data in your plan, count is null and domains is empty.

You can request all domains via the domains endpoint. It is available in the medium plan and above.

{
    "domains": {
        "count": 12360,
        "domains": [
            "eliwise.academy",
            "accountingprose.academy",
            "pistola.academy",
            "1and1-test-ntlds-fr.accountant",
            "omnergy.africa"
        ]
    }
}

What changed

Four changes to existing answers. The first three apply to /v2/info and /v2/batch (and to iplookupapi's /v1/info and /v1/batch), the last to requests without an API key.

geonames_id is a GeoNames ID. Before, the geonames_id of location, country, region and city held Who's On First IDs; only the continent's was a GeoNames ID. Now every geonames_id is the place's GeoNames ID, or null where the place has none, and a new wof_id after the other keys of each object holds the Who's On First ID: for location, country, region and city the value geonames_id held before, while continent.geonames_id was already a GeoNames ID and stays. On a sample of 10,000 lookups, location.geonames_id became null for 2.7% (cities 2.6%, regions 4.4%, countries none), and the other values of location, country, region and city became different numbers; the continent's stayed the same in all but 0.15% of the answers. If you stored the old values, read wof_id instead: Vienna was "geonames_id": 101748073 and is now "geonames_id": 2761369, "wof_id": 101748073.
Batch lookups keep the valid addresses. An item that is no IP address no longer fails the whole batch with a 422: it is listed in errors and neither looked up nor billed, so X-Cost counts the valid addresses. A POST body takes up to 1,000 addresses (100 in the query string), and hostname=true adds each address's reverse-DNS name. See the batch endpoint.
connection.asn and organization name the AS that announces the address. They now come from the BGP route tables: the origin AS number of the most specific route that covers the address, with that AS number's name as organization, where it is not the AS number our location data had for the range or where that had none. isp and range stay as they were, and so do asn and organization where a submitted geofeed or our manual data sets them for the range, or where no route covers the address. For a random sample of 10,000 IPv4 addresses, 4.29% of the 9,921 answers changed: 3.2% to another AS number, 1.1% from none to one. Most of them are in reassigned or sub-allocated ranges; in that sample, 214.209.91.20 changed from AS5972 to AS749 (United States Department of Defense). connection and the network object now describe the same AS number, apart from the few exceptions named with the network object.
Without an API key, only /v2/info and /v2/status answer. Requests without a key get the single lookup, up to 10 an hour per IP address, as before. Batches, /v2/asns, /v2/domains and every other endpoint now need an API key, a free one too: without one they answer 401 with error.code missing_api_key and are not billed. Before, a batch of up to 100 addresses worked without a key.

Legacy v1 endpoint

A legacy v1 endpoint, GET https://api.ipbase.com/v1/json/{ip}, is still available for backwards compatibility. It returns a flat JSON object with basic geolocation fields only (ip, country_code, country_name, region_code, region_name, city, zip_code, time_zone, latitude, longitude, metro_code). New integrations should use /v2/info, which supersedes it.

Info Endpoint

IP Information

Optional attributes

Only the country and ASN

Response

Response Structure

Request

Full Response

data Response Properties

range_type Response Properties

connection Response Properties

network Response Properties

company Response Properties

abuse Response Properties

location Response Properties

Accuracy

A mobile address, coarse_location=omit

Third-party data IDs

continent

country

country > currencies

country > languages

city

region

timezone Response Properties

security Response Properties

Bot verification

A Tor exit node

domains Response Properties

What changed

Legacy v1 endpoint

`data` Response Properties

`range_type` Response Properties

`connection` Response Properties

`network` Response Properties

`company` Response Properties

`abuse` Response Properties

`location` Response Properties

`continent`

`country`

`country > currencies`

`country > languages`

`city`

`region`

`timezone` Response Properties

`security` Response Properties

`domains` Response Properties