IP Screening API: Risk Score, Geolocation, and Proxy Detection

Submit an IP address to receive a risk profile including blacklist score, geolocation, and proxy or VPN detection for fraud and access decisions.

[GET]

{{baseUrl}}/api/v1/fraud/ip

Header

Header	Type	Description
AppId	string	Create an app to get your app ID on dashboard here
Authorization	string	Private/secret key. Use <key> not Bearer <key>

Query parameter

Parameter	Type	Description	Required
ip_address	string	IP Address	required

Sample response

Response

{
  "entity": {
    "report": {
      "ip": "2.58.56.101",
      "blacklists": {
        "detections": 11,
        "engines_count": 85,
        "detection_rate": "13%",
        "scantime": "0.92"
      },
      "information": {
        "reverse_dns": "powered.by.rdp.sh",
        "continent_code": "EU",
        "continent_name": "Europe",
        "country_code": "DE",
        "country_name": "Germany",
        "country_currency": "EUR",
        "country_calling_code": "49",
        "region_name": "Hamburg",
        "city_name": "Hamburg",
        "latitude": 53.575321197509766,
        "longitude": 10.015339851379395,
        "isp": "1337 Services GmbH",
        "asn": "AS210558"
      },
      "anonymity": {
        "is_proxy": false,
        "is_webproxy": false,
        "is_vpn": false,
        "is_hosting": false,
        "is_tor": true
      },
      "risk_score": {
        "result": 100
      }
    },
    "success": true
  }
}

Response Fields

Field	Type	Description
entity	object	Contains the IP screening result
entity.report	object	Full risk report for the screened IP address
entity.report.ip	string	The IP address that was screened
entity.report.blacklists	object	Blacklist detection results across threat intelligence engines
entity.report.blacklists.detections	integer	Number of engines that flagged the IP as malicious
entity.report.blacklists.engines_count	integer	Total number of threat intelligence engines queried
entity.report.blacklists.detection_rate	string	Percentage of engines that flagged the IP
entity.report.blacklists.scantime	string	Time taken to complete the blacklist scan in seconds
entity.report.information	object	Geolocation and network details for the IP
entity.report.information.reverse_dns	string	Reverse DNS hostname for the IP address
entity.report.information.continent_code	string	Two-letter continent code (e.g., “EU”, “NA”)
entity.report.information.continent_name	string	Full name of the continent
entity.report.information.country_code	string	ISO 3166-1 alpha-2 country code
entity.report.information.country_name	string	Full name of the country
entity.report.information.country_currency	string	Currency code used in the country
entity.report.information.country_calling_code	string	International calling code for the country
entity.report.information.region_name	string	Name of the region or state
entity.report.information.city_name	string	Name of the city
entity.report.information.latitude	number	Geographic latitude coordinate
entity.report.information.longitude	number	Geographic longitude coordinate
entity.report.information.isp	string	Internet Service Provider name
entity.report.information.asn	string	Autonomous System Number identifying the network
entity.report.anonymity	object	Anonymity and proxy detection results
entity.report.anonymity.is_proxy	boolean	true if the IP is identified as a proxy server
entity.report.anonymity.is_webproxy	boolean	true if the IP is identified as a web-based proxy
entity.report.anonymity.is_vpn	boolean	true if the IP is identified as a VPN endpoint
entity.report.anonymity.is_hosting	boolean	true if the IP belongs to a hosting or data center provider
entity.report.anonymity.is_tor	boolean	true if the IP is a known Tor exit node
entity.report.risk_score	object	Overall risk assessment
entity.report.risk_score.result	integer	Risk score from 0 (no risk) to 100 (highest risk)
entity.success	boolean	true if the screening completed successfully