Know which visitors aren’t visitors.
One POST request places an IP address on the map — country, city, time zone, network, and owner — and flags the traffic that isn’t a person: cloud and datacenter ranges, corporate gateways, Tor exits, named VPN exits, and iCloud Private Relay, scored by arithmetic you can audit, with your own allow and deny lists in every answer.
Free credits every month. No credit card required. The demo on this page runs against the live service.
Live demo
POST /demo/ip · no key needed
Response
Look up any address to see the full API response, straight from the live service.
Every response field, documented.
This is the actual contract of POST /api/v1/ip — threat flags are tri-state: false is a checked negative, null means the signal was not evaluated. Each response also carries sources naming only the datasets actually consulted and meta with your credit usage.
| Field | Type | What it tells you |
|---|---|---|
| ip | The canonical form of the address. IPv4-mapped IPv6 input (::ffff:8.8.8.8) collapses to its dotted-quad form. | |
| version | 4 or 6. | |
| reason | reserved_range for private, loopback, CGNAT, documentation, and multicast space — answered free, with everything else null. | |
| network | The CIDR prefix the location answer covers, e.g. 8.8.8.0/24 — how wide the answer is. | |
| continent / country / country_name | Continent code, ISO 3166-1 country code, and the English country name. From the DB-IP Lite database, or from the network operator’s own published location where one exists. Country is highly reliable. | |
| is_eu | Whether the country is a member of the European Union — the floor for a consent-banner decision. Null when the country is unknown. | |
| is_eea | Whether the country is in the European Economic Area — the EU plus Iceland, Liechtenstein and Norway, where the GDPR applies directly. Null when the country is unknown. | |
| privacy_regime | The comprehensive privacy law that applies where the address is, as a lowercase code: California ccpa and Quebec law25 by region, otherwise by country — gdpr across the EU and EEA, uk_gdpr, fadp, lgpd, pipeda, appi, pipl, popia and more. Null means no comprehensive law is known for the place, never that there is none. | |
| sanctions / fatf_list | The sanctions programmes naming the country — ofac_comprehensive (Cuba, Iran, North Korea) and ofac_programme (any country-related OFAC programme) — and whether the FATF lists it under call_for_action or increased_monitoring. Facts about a place from a curated file that names its sources and dates, never a verdict about a person, and neither carries a weight. | |
| region / city | State or province and city. City-level from the database is approximate — never build compliance on it; exact where the operator publishes it. | |
| latitude / longitude | Coordinates of the located area, with the same city-level caveat. Null when an operator-declared location disagrees with the database, rather than a contradicting point. | |
| location_source | operator when the network operator publishes the location itself — an RFC 8805 geofeed (DigitalOcean, Linode, Vultr), Apple’s relay egress list, or a VPN provider’s server list (Mullvad, NordVPN, IVPN and AirVPN name the city, Private Internet Access and VPN Gate the country) — and that declaration was applied. database otherwise. | |
| location_confidence | low whenever the address is anycast or on a listed mobile carrier or satellite operator, whoever placed it, because that place belongs to the network, not the user. Otherwise high when the operator declared the location itself, and graded from our weekly accuracy measurement for that country — 75 % city agreement and above high, 50 % medium, below that low. Null when fewer than 20 samples settle the country. | |
| timezone / timezone_source | IANA zone such as Europe/Berlin, and what settled it: region or country when the curated map knows one clock applies, nearest_city when the nearest place in the GeoNames list inside the located country did — how Texas, Canada, Australia, Brazil and Russia get an answer instead of null. Still null more than 250 km from any listed place. | |
| timezone_matches | Send browser_timezone — the zone the visitor’s browser reports — and this says whether it keeps the same clock as the located zone. A connection that is not where its owner is, in one boolean. Null when there is nothing to compare. | |
| currency / calling_code | ISO 4217 currency from ICU region data and the international calling code from libphonenumber — defaults a visitor can override. | |
| asn / org | The autonomous system number and the organization operating it, e.g. 15169 / "Google LLC". | |
| asn_type | hosting, isp, education, or government. hosting whenever is_datacenter is true or the operator name says so; the rest from the operator name. Null when we cannot tell — never guessed. | |
| connection_type | What the address is attached to, from positive evidence only: corporate_proxy, hosting, satellite, mobile, or residential (a dynamic reverse-DNS name, so only when you asked for the hostname). Null when nothing said so — it never means residential by default. | |
| is_mobile / is_satellite | Whether the network is a listed mobile carrier (T-Mobile, Verizon Wireless, AT&T Mobility, EE, Three, Jio, Airtel, China Mobile, Telcel and more) or a listed satellite ISP (Starlink, Viasat, HughesNet), from curated positive-only lists. A mobile address is many people behind carrier NAT; a satellite address lands at a ground station. False means not listed, never a guess. | |
| registry / registry_country / allocated_at | Which regional registry allocated the space, the country it recorded, and when — straight from the RIRs’ daily delegated statistics. A block allocated weeks ago, or a registry country that disagrees with the geolocation, is worth a second look; neither is weighted. | |
| abuse_contact | The network’s abuse mailbox from the registry’s RDAP record, only when you ask for it with abuse_contact: true — it is a registry lookup, cached per allocation. Null otherwise, or when the registry lists none. | |
| network_details | Only with network_details: true — the RDAP record’s name, organisation, range and registration dates, from the same cached registry lookup as abuse_contact. | |
| hostname / hostname_verified / hostname_kind / hostname_domain | Only with hostname: true — the reverse DNS name, whether it resolves back to the address, what its naming convention says (dynamic pool or static), and its registrable domain. A verified name under googlebot.com, search.msn.com, applebot.apple.com and the other crawler domains proves the crawler. | |
| is_datacenter | Whether the address sits in known hosting or cloud ranges — the providers’ own published feeds, GitHub’s hosted runner ranges, plus the open X4BNet list. Traffic that is not a person on a home connection. | |
| hosting_provider | Amazon Web Services, Google Cloud, Microsoft Azure, Oracle Cloud, DigitalOcean, Linode, Vultr, Cloudflare, Fastly, or GitHub Actions when the address is inside that provider’s own published ranges. Null when the flag came only from the aggregate list. | |
| is_corporate_proxy / corporate_proxy | Whether the address is the egress of a corporate secure web gateway, from the ranges Zscaler publishes for its clouds so customers can allow-list them, and which operator. Everything behind it is an employee reaching the Internet from the gateway’s address: the location is the gateway’s and the traffic is a workplace. No weight, and never the datacenter weight. | |
| is_crawler | Whether the address sits in the ranges a crawler operator publishes so you can verify its bots — Googlebot and Google’s fetchers, Bingbot, GPTBot, ChatGPT-User, OAI-SearchBot, PerplexityBot, Perplexity-User, DuckDuckBot, AhrefsBot — or a verified hostname proves one. Not a risk: no weight, and the datacenter weight is skipped for it. | |
| crawler / crawler_kind | Which crawler, and what it does: search, ai_training, ai_assistant, seo, or fetcher. Allow-list the verified ones and treat the rest of the datacenter traffic as what it is. | |
| is_anycast | Whether the address sits in a published anycast range: CDN edges and the public resolvers. Geolocation means little for such an address. | |
| is_unallocated | True when no regional Internet registry has allocated or assigned the space, from the five RIRs’ daily statistics. Such an address should not be on the public Internet at all, which is why it scores 100. | |
| is_blocklisted | True when a public threat blocklist names the address’s netblock or its operator: Spamhaus DROP (netblocks hijacked or leased by spam and cybercrime operations), Spamhaus ASN-DROP (the operators behind them, matched by the address’s ASN), and abuse.ch’s Feodo Tracker list of active botnet C2 servers. Traffic from such space is almost never a customer, which is why it scores 80. | |
| blocklist | The list that names the address: Spamhaus DROP, Spamhaus ASN-DROP, or abuse.ch Feodo Tracker. Null unless is_blocklisted is true. | |
| is_attack_source / attack_source | Whether an attack-source list names the address — single hosts seen attacking honeypots and sensors in the last days, from Emerging Threats’ compromised-hosts list, the CINS Army list and blocklist.de, refreshed hourly — and which list. Kept apart from the blocklists because these name hosts rather than netblocks and churn daily, so a hit weighs 50, not 80. | |
| is_tor / tor_last_seen | Whether the address is a currently listed Tor exit node, from the Tor Project’s bulk exit list and its Onionoo relay data (synced hourly, IPv6 included), and when it was last seen exiting — today while listed, otherwise the date the thirty-day exit history last saw it. An exit that left the list this week still weighs 40. | |
| is_vpn | Whether the address is a known VPN exit: the server lists Mullvad, NordVPN, Private Internet Access, IVPN, AirVPN and VPN Gate publish, the open X4BNet VPN ranges, and Cloudflare WARP by inference. False on iCloud Private Relay egress unless a VPN provider’s own list names the address — Apple’s declaration outranks the aggregate list. | |
| is_relay | Whether the address is an iCloud Private Relay egress address, from Apple’s own published list. Relay users are ordinary Apple customers, which is why the weight is small. | |
| privacy_service | The named service behind a VPN or relay flag: Mullvad, NordVPN, Private Internet Access, IVPN, AirVPN, VPN Gate, or iCloud Private Relay — and "Cloudflare WARP (inferred)" when Cloudflare’s own network carries the address outside the ranges it publishes, because Cloudflare publishes no WARP list and an inference should say it is one. Null for Tor and for ranges known only from the aggregate list. | |
| is_anonymous | True when any of is_tor, is_vpn or is_relay is true; false when at least one was checked and none matched; null when none was evaluated. | |
| account_list | Your own allow or deny list that names the address — id, name, kind and the entry that matched. An allow list zeroes the score, a deny list tops it, and deny is checked first so a contradiction fails closed. Lists belong to the account and apply to every lookup it is billed for. | |
| risk_score | A transparent sum you can recompute: your deny list +100, unallocated +100, blocklist +80, Tor +70, your own reported_abuse +60, an attack-source list +50, datacenter +40, reported_abuse_widely +40, recently_tor +40, VPN +30, relay +10, capped at 100 — and 0 whatever else fired when your allow list names the address. The datacenter weight is skipped when is_relay, is_crawler or is_corporate_proxy is true, because all three sit on infrastructure by design. Null only when no feed evaluated the address and nobody reported or listed it. | |
| risk_level | low under 30, medium from 30, high from 60. | |
| risk_signals | Each contributing signal with the weight actually applied and the dataset behind it, so the weights always sum to risk_score. An allow-list hit is one allowlisted entry of weight 0 and nothing beside it. | |
| seen_by_you | How many times your account looked this address up in the last seven days before this call, and when it first did — velocity, kept under a keyed hash rather than the address. Null under privacy: true. |
One request, local data, millisecond answers.
- Lookups run against local databases and compiled feeds — no upstream API in the request path
- Geo databases refresh monthly, every range feed daily
- POST with the address in the body, GET it in the path, or GET /me for the caller’s own address
- Batches of 1,000 per call, bulk runs of 100,000 with a CSV and a signed webhook
- A browser endpoint for domain-locked publishable keys; omit the address for the visitor’s own
- Nothing about a lookup is stored; privacy: true skips even the seven-day repeat marker and the velocity count
- Your own allow and deny lists apply to every lookup the account is billed for
- Reserved and unknown addresses cost nothing
- Repeats of a charged lookup are free for seven days
$ curl https://spaw.co/api/v1/ip \ -H "Authorization: Bearer sk_live_…" \ -H "Content-Type: application/json" \ -d '{"ip": "8.8.8.8"}' { "success": true, "data": { "ip": "8.8.8.8", "network": "8.8.8.0/24", "country": "US", "is_eu": false, "privacy_regime": "ccpa", "sanctions": [], "fatf_list": null, "city": "Mountain View", "location_source": "database", "timezone": "America/Los_Angeles", "timezone_source": "region", "currency": "USD", "asn": 15169, "org": "Google LLC", "asn_type": "hosting", "connection_type": "hosting", "is_datacenter": true, "hosting_provider": null, "is_corporate_proxy": false, "is_crawler": false, "is_unallocated": false, "is_blocklisted": false, "is_attack_source": false, "is_tor": false, "tor_last_seen": null, "is_vpn": false, "is_relay": false, "privacy_service": null, "is_anonymous": false, "account_list": null, "risk_score": 40, "risk_level": "medium", "seen_by_you": { "count": 0, … }, "sources": [{ "dataset": "dbip-city-lite", … }, …], … }, "meta": { "credits_used": 1, "credits_remaining": 499, "cache_hit": false, "ip_lookups_prepaid": 4 } }
How often the database agrees with the operators.
Every week we sample the ranges whose operators publish a location — cloud geofeeds, Apple’s relay list, VPN server lists — and compare the raw database answer with that declaration. This is agreement with what network operators publish, not ground truth of where a person sits. Last measured 2026-10-11 on 2,349 addresses.
| Feed | Sample | Country agreement | City agreement |
|---|---|---|---|
| iCloud Private Relay | 286 | 85.0% | 8.4% (286 compared) |
| DigitalOcean | 309 | 93.5% | 61.2% (309 compared) |
| Linode | 291 | 100.0% | 73.5% (291 compared) |
| Vultr | 505 | 99.8% | 64.7% (498 compared) |
| Mullvad | 375 | 97.3% | 34.1% (375 compared) |
| NordVPN | 298 | 99.0% | 83.8% (297 compared) |
| geofeeds | 285 | 84.6% | 30.3% (238 compared) |
| All feeds | 2,349 | 94.8% | 52.2% |
Of 2,632 addresses on the Mullvad, NordVPN and Private Internet Access server lists, the aggregate open VPN list also flags 59.0%. The rest is what the named lists add.
Every dataset behind an answer, and its licence.
Each response names the datasets it consulted in sources, with the date each was last synced. This is the whole list, so a reader can check any flag against its source.
Data synced on 2026-10-17: the newest feed sync and database build behind the answers on this page. Every response carries the same dates in its sources block.
Where one credit pays for itself.
Stop non-human signups
Datacenter and VPN flags catch scripted registrations from cloud boxes and CI runners before they consume trials or spam your users — and hosting_provider tells you which cloud they came from.
Localize with confidence
Country-level answers are dependable enough to pick currency, language, and defaults on the first page load, and the time zone now resolves down to the nearest place where a country keeps more than one clock.
Score traffic quality
Tag analytics and lead sources with datacenter, Tor, VPN, and relay flags to see how much of your "traffic" is actually infrastructure — and keep relay users, who are real people, out of the block list.
Allow-list verified crawlers
is_crawler names Googlebot, Bingbot, GPTBot and the rest from the ranges their operators publish, so your bot policy can let search through, meter AI training, and still block the unknown datacenter box next door.
The crawler ranges, synced dailyRecognise the office, not the visitor
is_corporate_proxy says the address is a secure web gateway’s egress, so an employee behind Zscaler is not mistaken for a datacenter box, and their country is read as the gateway’s rather than as a mismatch.
Keep your own lists in the answer
Office egress, partner ranges and the addresses that already burned you go on an allow or deny list once, and every lookup the account is billed for — API, dashboard, bulk, monitors, widget — carries the verdict.
Screen by country for compliance
sanctions and fatf_list name the programmes and the FATF list a country is on, from a file that names its sources and dates, so the screening rule your compliance policy already has can run on the first request.
What every country carriesWatch your own addresses
Register your egress and mail-server addresses — or a whole /24 — as a monitored list and get an email the day one of them lands on Spamhaus DROP or a botnet list, before your deliverability does.
Catch a connection that is not where its owner is
Send the browser’s time zone with the lookup and timezone_matches says whether the clock on the visitor’s machine agrees with the network’s — the cheapest strong signal against a proxied signup.
What we won’t pretend to know.
IP reputation is where invented certainty sells best. Ours is recomputable from the response itself.
The risk score is arithmetic, not an oracle
Your deny list +100, unallocated +100, blocklist +80, Tor +70, your own reports +60, seen attacking +50, datacenter +40, reports from three or more accounts +40, an exit seen this week +40, VPN +30, relay +10 — you can recompute every score from the flags in the same response, including the exceptions: a relay address, a verified crawler or a corporate gateway never carries the datacenter weight, and your allow list zeroes everything. No proprietary probability, no black box.
Null means not evaluated, never no
Every flag is a real answer for both address families wherever a feed covers it, Tor included through the Tor Project’s relay data. Where nothing covers an address family, the flag says null instead of a fabricated false. The mobile, satellite and connection_type answers come from positive evidence only: a network not on the curated lists reads false or null, never as a guess, and null never means residential.
An inference says it is one
Residential proxies are invisible to open data and are not claimed; they will only ever ship as a clearly labelled premium signal. Where the answer is inferred rather than published — Cloudflare WARP from Cloudflare’s own network outside its published ranges, a time zone from the nearest listed place — the response labels it so, and the sanctions and FATF facts are exactly that: facts about a place, never a verdict about a person.
Common questions about IP lookups.
How accurate is the location?
Country-level answers from DB-IP are dependable — accuracy comparable with paid databases. City-level precision from free data is approximate and varies by region, which is why we say so on this page instead of selling you street-level confidence. Where the network operator publishes the location itself — cloud geofeeds, Apple’s relay list, VPN server lists — that declaration wins and location_source says operator.
Where do the flags come from?
Open and first-party lists, all synced daily and the Tor lists hourly: the Tor Project’s exit list and relay data with a thirty-day exit history; the published ranges of AWS, Google Cloud, Microsoft Azure, Oracle Cloud, DigitalOcean, Linode, Vultr, Cloudflare, Fastly and GitHub’s hosted runners plus X4BNet’s datacenter lists; the server lists of Mullvad, NordVPN, Private Internet Access, IVPN, AirVPN and the VPN Gate project plus X4BNet’s VPN lists, with Cloudflare WARP inferred and labelled as such; Apple’s iCloud Private Relay egress list; the cloud enforcement node ranges Zscaler publishes for corporate gateways; the public threat blocklists Spamhaus DROP and ASN-DROP and abuse.ch’s Feodo Tracker; the attack-source lists Emerging Threats, CINS and blocklist.de publish, refreshed hourly; the ranges Google, Microsoft, OpenAI, Perplexity, DuckDuckGo and Ahrefs publish to verify their crawlers; the RFC 8805 geofeeds discovered across the five registries every week, which sharpen the city; the GeoNames list of populated places for time zones; and curated files for mobile carriers, satellite operators and the compliance lists. Each response names the groups that were consulted and the date they were last synced.
Can you detect residential proxies?
No, and neither can anyone else using open data. Open lists cover datacenter ranges, commercial VPN egress, relays, and Tor exits. Residential-proxy detection needs proprietary network telemetry; it is on the roadmap as a separately labeled premium signal.
Are IPv6 addresses covered?
Yes. The datacenter, VPN, relay, anycast, corporate gateway and registry feeds carry IPv6, and Tor exits over IPv6 come from the Tor Project’s Onionoo relay data. When a feed genuinely has nothing for an address family, that flag answers null rather than a fabricated false, and the sources block shows which groups were consulted.
What does hosting_provider add to is_datacenter?
The provider’s own feed placed the address inside its ranges, so you know it is an AWS or Cloudflare address rather than merely hosting space. A steady stream of Cloudflare or Fastly addresses usually means your app is reading the proxy’s address instead of the client header it sets, and a GitHub Actions address is a workflow, not a visitor.
How do my own lists work?
An account keeps up to 20 allow or deny lists of up to 5,000 addresses or prefixes each, managed from the Lists tab of the dashboard or /api/v1/ip/lists. An allow list zeroes the score of every address it names and a deny list tops it at 100; deny is checked first, so an address on both fails closed. Whichever list matched is named in account_list with the entry that matched, on every lookup the account is billed for.
What do sanctions and fatf_list mean?
Facts about a place: which country-related OFAC sanctions programmes name the country, with the comprehensive ones (Cuba, Iran, North Korea) marked apart, and whether the FATF lists it under a call for action or increased monitoring as of its June 2026 plenary. They come from a curated file that names its sources and the dates they were checked, carry no weight, and say nothing about the person: the screening rule is your compliance policy’s to write.
What counts as a reserved range?
Private networks (10/8, 172.16/12, 192.168/16), loopback, link-local, CGNAT, the documentation TEST-NETs, multicast, and their IPv6 equivalents. They answer instantly with reason reserved_range and cost nothing.
What does an IP lookup cost?
One credit buys five answered lookups. The lookup that opens a block reports credits_used 1 and leaves four prepaid on your account; the next four report credits_used 0, and meta.ip_lookups_prepaid says how many are left. Reserved and private ranges, unallocated space, addresses nothing knows and repeats within seven days are free and never use one.
Guides
All guides- How Tor exit rotation defeats a static blocklist
- How accurate is free IP geolocation?
- How to verify Googlebot and GPTBot
- Why residential proxies cannot be detected from open data
- A VPN and relay policy that does not punish real people
- Block datacenter and bot signups with one IP lookup
- Gate consent and defaults by country: is_eu, timezone and currency from an IP
Score your first address in minutes.
Create a key, send one POST request, and keep free lookups every month on us.