Security data API
VPN & Proxy Detection API
Included from the Small plan, $9.99 a month (65,000 requests).
Free keys get the same response, with every field of the security object set to null.
The ipbase API tells you whether an IP address belongs to a VPN, a proxy, the Tor network, iCloud Private Relay or a data center, and gives it a threat score. You get the security flags in the same JSON response as the location and network of the address, for IPv4 and IPv6.
Example request and response
The security object of the /v2/info endpoint, shortened from the example in the documentation. Add fields=security to get only the security data.
curl "https://api.ipbase.com/v2/info?ip=80.110.0.1" \
-H "apikey: YOUR-API-KEY"
{
"data": {
"ip": "80.110.0.1",
"connection": {
"asn": 8412,
"organization": "T-Mobile Austria GmbH",
"isp": "UPC Technology",
"range": "80.108.0.0/14"
},
"location": { "country": { "alpha2": "AT", "name": "Austria" } },
"security": {
"is_anonymous": false,
"is_datacenter": false,
"is_vpn": false,
"is_bot": false,
"is_abuser": false,
"is_known_attacker": false,
"is_proxy": false,
"is_spam": false,
"is_tor": false,
"proxy_type": "",
"is_icloud_relay": false,
"threat_score": 0
}
}
}
Response fields
- security.is_vpn
- The address belongs to a VPN provider.
- security.is_proxy
- The address is a known open or anonymizing proxy.
- security.is_tor
- The address is a Tor exit node.
- security.is_icloud_relay
- The address is an iCloud Private Relay egress address.
- security.is_datacenter
- The address belongs to a hosting or cloud provider rather than a consumer network.
- security.is_anonymous
- The address hides the real client (VPN, proxy, Tor or relay).
- security.is_bot, is_abuser, is_known_attacker, is_spam
- The address has been seen sending bot traffic, abuse, attacks or spam.
- security.threat_score
- A score from 0 (no known threat) to 100, computed from the security flags.
Use cases
Sign-up and checkout fraud
Flag sign-ups and payments from VPNs, proxies and Tor before they reach your fraud review, and ask those users for extra verification.
Geo-restricted content
Licensing and compliance rules apply to the real location of a user. Detect when a VPN or proxy hides it.
Bot and abuse filtering
Rate-limit or challenge traffic from data centers and from addresses with a known abuse history.
Ad and analytics quality
Keep data center and anonymized traffic out of conversion and campaign reports.
Which plans include VPN and proxy detection
VPN and proxy detection is part of the Small plan and every plan above it: the VPN, proxy, Tor, iCloud Private Relay, data center, bot, abuse, spam and known attacker flags, and the threat score from 0 to 100. Prices exclude VAT, and yearly billing gives 2 months free. Compare the plans.
| Plan | Price a month | Requests a month | Security data | ASN API | Hosted domains API |
|---|---|---|---|---|---|
| Free | $0.00 | 150 (10 a minute) | No: every field is null | No | No |
| Small | $9.99 | 65,000 | Yes | Yes | No |
| Medium | $39.99 | 650,000 | Yes | Yes | Yes |
| Large | $89.99 | 2,500,000 | Yes | Yes | Yes |
| Custom | On request | More than 2,500,000 | Yes | Yes | Yes |
Frequently asked questions
Which plan includes VPN and proxy detection?
What does a free API key return in the security object?
GET https://api.ipbase.com/v2/info) returns the security data.Which security flags does the API return?
is_vpn), proxies (is_proxy), Tor exit nodes (is_tor), iCloud Private Relay (is_icloud_relay) and data centers (is_datacenter), and addresses seen sending bot traffic, abuse, attacks or spam (is_bot, is_abuser, is_known_attacker, is_spam). is_anonymous is true for any of VPN, proxy, Tor or relay, and threat_score runs from 0 (no known threat) to 100.What is the threat score?
Can the API detect any VPN?
Does it work for IPv6 addresses?
Can I check many IP addresses at once?
Is there a free way to try it?
Is yearly billing cheaper?
Related
Free IP tools
Example lookups: 8.8.8.8 · 8.8.8.0/24 · AS15169 · example.com · all IPv4 ranges