Loading
Loading
Detect VPNs, proxies, Tor nodes, bots, and malicious traffic for any IP address — powered by continuously updated IP threat intelligence data.
The APIFreaks IP Security API gives you a complete risk profile for any IP address. Whether you are building IP fraud detection into a checkout flow, blocking automated abuse at login, or running threat intelligence across millions of events, this API returns the information you need to make a confident decision without stitching together multiple data sources.
Pass your API key as the apiKey parameter in every request.
This is version v1.0 of the API.
The following parameters can be used in your API requests. All parameters are passed as query string parameters.
ipoptionalStringA valid IPv4 or IPv6 address to look up.
fieldsoptionalStringComma-separated list of field paths to return in the response. Use dot notation for nested fields (e.g. security.threat_score). Only the specified fields will be included, helping reduce response size.
excludesoptionalStringComma-separated list of field paths to remove from the response. Use dot notation for nested fields (e.g. security.is_tor, security.is_cloud_provider). The ip field is always included and cannot be excluded.
A successful request returns a 200 OK response with a JSON object containing the security data. The response includes the top-level fields listed below. See the response preview on the right for the full JSON structure.
ipThe IP address that was looked up.
securityThe security information for the IP address.
Contains the following fields:
threat_scoreOverall threat score for the IP address. Ranges from 0 to 100. 100 indicates the highest risk.
is_torIndicates whether the IP is a Tor exit node.
is_proxyIndicates whether the IP is associated with a proxy network.
proxy_provider_namesList of detected proxy provider names, when available.
proxy_confidence_scoreConfidence score (0–100) for proxy detection, when flag is true. Defaults to 0.
proxy_last_seenLast seen date (YYYY-MM-DD) for proxy activity, when available.
is_residential_proxyIndicates whether the IP is associated with a residential proxy network.
is_vpnIndicates whether the IP is associated with a VPN network.
vpn_provider_namesList of detected VPN provider names, when available.
vpn_confidence_scoreConfidence score (0–100) for VPN detection, when flag is true. Defaults to 0.
vpn_last_seenLast seen date (YYYY-MM-DD) for VPN activity, when available.
is_relayIndicates whether the IP is associated with a relay network.
relay_provider_nameRelay provider name, when available.
is_anonymousIndicates whether the IP is anonymous. True if VPN, proxy, Tor, or relay is detected.
is_known_attackerIndicates whether the IP is flagged for known attacker behavior.
is_botIndicates whether the IP is associated with bot activity.
is_spamIndicates whether the IP is associated with spam activity.
is_cloud_providerIndicates whether the IP belongs to a cloud provider.
cloud_provider_nameName of the cloud provider, if the IP address belongs to a cloud provider.
The API uses standard HTTP status codes to indicate the success or failure of requests. For common status codes like 429 (Too Many Requests), refer to the general API documentation.
Provided IP address 'invalid' is not valid
Provided IP address '999.999.999.999' is not valid
'10.0.0.1' is a bogon IP address.
Need to check multiple IPs at once? Use the Bulk IP Threat Intelligence API to look up to 50,000 IP addresses in a single request.