Loading
Loading
Detect VPNs, proxies, Tor nodes, bots, and malicious traffic for any IP address - powered by continuously updated IP threat intelligence data.
The APIFreaks IP Security API gives you a complete risk profile for any IP address. Whether you are building IP fraud detection into a checkout flow, blocking automated abuse at login, or running threat intelligence across millions of events, this API returns the information you need to make a confident decision without stitching together multiple data sources.
Authorize every request with your API key, passed either as a header or as a query parameter:
X-apiKeyapiKeyThis is version v1.0 of the API.
The following parameters can be used in your API requests. All parameters are passed as query string parameters.
formatoptionalStringdefault: jsonjson (default) or xml.ipoptionalStringA valid IPv4 or IPv6 address to look up.
fieldsoptionalArrayComma-separated list of field paths to return in the response. Use dot notation for nested fields (e.g. security.threat_score). Only the specified fields will be included, helping reduce response size.
excludesoptionalArrayComma-separated list of field paths to remove from the response. Use dot notation for nested fields (e.g. security.is_tor, security.is_cloud_provider). The ip field is always included and cannot be excluded.
A successful request returns a 200 OK response with a JSON object containing the security data. The response includes the top-level fields listed below. See the response preview on the right for the full JSON structure.
ipThe IP address that was looked up.
threat_score (Integer), is_tor (Boolean), is_proxy (Boolean), proxy_provider_names (Array<String>), proxy_confidence_score (Integer), …
bot_type describes what an automated client does, not whether it is welcome. Check is_known_good_bot to tell declared bots from unidentified ones. New values can be added over time, so treat the field as a plain string.
search_engine (String), ai_crawler (String), ai_assistant (String), seo_crawler (String), site_monitor (String), …
scanner (String), scraper (String), exploit (String), credential_stuffing (String), brute_force (String), …
secure_web_gatewayOutbound address of a secure web gateway (SWG, SSE, or SASE). Employee browsing is routed and inspected in the vendor's cloud, then reaches your site from this IP. Most gateway ranges are this type.
browser_isolationOutbound address of a remote browser isolation service. Pages are loaded in the vendor's cloud browser, so this IP requests your site instead of the user's own device.
Besides the response body, every response carries custom headers you can use to track credit usage, and concurrency usage on endpoints that enforce a concurrency limit. See the Custom Response Headers documentation and the endpoints with concurrency limits for more details.
X-Concurrent-Threadsheaderconcurrency-limited endpointsSpecifies the maximum number of concurrent requests allowed.
X-Concurrent-Threads-Activeheaderconcurrency-limited endpointsIndicates the number of active concurrent requests being processed.
X-AF-Credits-Costheaderall responsesSpecifies the number of credits consumed by the current request.
See the HTTP Status Codes documentation for a complete reference of common API errors and HTTP status codes.
Provided IP address 'invalid' is not valid
Provided IP address '999.999.999.999' is not valid
'10.0.0.1' is a bogon IP address.