IP geolocation · threat signals · one REST call

Know who is behind every IP address.

Send an address, get back its likely location, the network that runs it, VPN, proxy and Tor flags, and a risk score that explains itself. One HTTPS request, JSON back, no SDK to install.

Location and networkCountry, region, city, time zone, currency, ASN and ISP for IPv4 and IPv6.
Threat and privacy signalsVPN, proxy, Tor, spam and hosting flags, plus a risk score with its reasons.
Keys and usage you controlRestrict each key, rotate it any time, and see lookups by key, tag and country.

Read the quickstart

15-day trial with every fieldNo credit card400 free lookups a month after

Read the transcript

0:00 Type any IP address into the IP Explorer, and see where it is likely to be, and which network runs it.
0:10 Below that are the VPN, proxy and Tor flags, and a risk score that lists its reasons. This address is a Tor exit, so it scores high.
0:22 Every result shows the request that produced it. One HTTPS call with your key returns the same JSON, with no SDK to install.
0:33 Give each app its own key, restrict it to your sites or your servers, and rotate it whenever you need to.
0:43 Statistics show how much of your quota is left, and where lookups come from, by key, tag and country. IpQuery.Info: start your free trial today.

1HTTPS request per lookup

1,000Addresses per batch call

v4 + v6Every address family

15Day trial, every field

For developers

One request. Everything you need back.

Send your key as a Bearer header, pass the address, and read the JSON. Leave ip out to look up the caller.

fields= returns only what you ask for, so responses stay small.
tag= labels a call (signup, checkout, a campaign) for your statistics.
POST up to 1,000 addresses as JSON, plain text or CSV in one call.
Plain errors: a structured error.code, a request ID and rate-limit headers.

API reference Try a lookup without an account

curl -H "Authorization: Bearer $IPQUERY_KEY" \
  "https://ipquery.info/api?ip=203.0.113.24&tag=signup"

const res = await fetch(
  "https://ipquery.info/api?ip=203.0.113.24&tag=signup",
  { headers: { Authorization: `Bearer ${process.env.IPQUERY_KEY}` } }
);
const [ip] = await res.json();
if (ip.is_vpn || ip.is_tor) flagForReview(ip);

import os, requests

r = requests.get(
    "https://ipquery.info/api",
    params={"ip": "203.0.113.24", "tag": "signup"},
    headers={"Authorization": f"Bearer {os.environ['IPQUERY_KEY']}"},
    timeout=5,
)
ip = r.json()[0]
print(ip["country_iso_code"], ip["risk_level"])

Response 200 OK · application/json

[{
  "query_ip_address": "203.0.113.24",
  "country": "Germany",  "time_zone": "Europe/Berlin",
  "asn": "AS64500",  "usage_type": "hosting",
  "is_vpn": true,  "vpn_name": "ExampleVPN",
  "risk_score": 50,  "risk_level": "medium",
  "risk_factors": ["vpn", "datacenter"]
}]

Illustrative response for a documentation address (RFC 5737), trimmed. Field availability depends on your plan; withheld fields are listed in gated_fields.

Learn it in under a minute

Short how-to videos, with the steps written out

Each task has its own page: why you would do it, a short narrated video, then numbered steps with screenshots.

Browse all IpQuery.Info how-to guides

What comes back

Four kinds of answer in every lookup.

Where it is likely to be

Continent, country, region and city with coordinates and an accuracy radius, plus time zone, currency, languages and whether GDPR applies.

country_iso_code time_zone gdpr_required

Who runs the network

ASN, network name and connection type, whether the range is hosting, cloud, mobile or satellite, and BGP routing on higher plans.

asn usage_type is_cloud

Whether it is hiding something

Commercial VPNs, proxies and Tor are flagged separately from privacy relays such as iCloud Private Relay, so ordinary users are not treated as threats.

is_vpn is_tor privacy_network_type

How much to trust it

A 0–100 risk score and level, with the factors that produced it, so your code (and your support team) can see why.

risk_score risk_level risk_factors

See every data source and how often it refreshes

What teams build with it

Drop it into the request path you already have.

Screen signups and checkouts Hold back VPN, proxy and Tor traffic, or ask for a second factor when the risk score is high. Guide: block VPN, proxy and Tor Localise on the first request Pick the store, currency, language or support hours from the visitor's country before the page renders. Guide: geo-redirect by country Show consent only where it is needed gdpr_required tells you whether the visitor's country falls under GDPR. Guide: GDPR consent by country See where demand comes from Tag each call by product or campaign and map lookups by country, European region or US state. Guide: segment usage with tags

Safe to put in production

Keys you can lock down, and nothing hidden in the fine print.

Give every service its own key. Restrict browser keys to your sites and server keys to your IPs, and rotate any key without downtime planning.

Security controls Status and changelog

Allowed origins, referrers and client IPs per key, with wildcard subdomains and IP prefixes.
Rotate or delete a key from the dashboard the moment it might have leaked.
Record-Only keys log visitor geography for your maps without returning data to the browser.
DPA, subprocessors and an SLA are published, and Enterprise adds contractual terms.

Pricing

Start free. Scale when you are ready.

Basic

$ 10 /mo

Included: 100,000 API requests / month

Included: Geolocation, ASN, ISP and country data

Included: VPN, proxy, Tor, Spamhaus and cloud flags

Included: Risk score and risk level

Included: Reverse DNS (hostname)

Not included: Threat and Privacy Detection: residential proxies, privacy relays, named VPN provider

Not included: Detection confidence scores

Not included: Explainable risk factors

Not included: BGP routing: prefix, origin AS and MOAS

Included: Email support - 2 business days

Not included: Priority email support - 1 business day

Not included: SLA, DPA and security review

Not included: Procurement and invoicing support

Not included: Named support contact

Advanced

$ 50 /mo

Included: 1,500,000 API requests / month

Included: Geolocation, ASN, ISP and country data

Included: VPN, proxy, Tor, Spamhaus and cloud flags

Included: Risk score and risk level

Included: Reverse DNS (hostname)

Included: Threat and Privacy Detection: residential proxies, privacy relays, named VPN provider

Included: Detection confidence scores

Included: Explainable risk factors

Included: BGP routing: prefix, origin AS and MOAS

Included: Email support - 2 business days

Included: Priority email support - 1 business day

Not included: SLA, DPA and security review

Not included: Procurement and invoicing support

Not included: Named support contact

Enterprise

$ 100 /mo

Included: 5,000,000 API requests / month

Included: Geolocation, ASN, ISP and country data

Included: VPN, proxy, Tor, Spamhaus and cloud flags

Included: Risk score and risk level

Included: Reverse DNS (hostname)

Included: Threat and Privacy Detection: residential proxies, privacy relays, named VPN provider

Included: Detection confidence scores

Included: Explainable risk factors

Included: BGP routing: prefix, origin AS and MOAS

Included: Email support - 2 business days

Included: Priority email support - 1 business day

Included: SLA, DPA and security review

Included: Procurement and invoicing support

Included: Named support contact

Compare which fields each plan returns

Make your first lookup in the next five minutes.

Create an account, copy the key we make for you, and send one request.

Getting started guide