Response fields
network
Reverse DNS, the abuse contact, open ports and cloud region.
Evidence gathered from the network itself: reverse DNS, the published abuse contact, active port probes, and published cloud ranges.
| Field | Type | Description |
|---|---|---|
ptr_record | string | Reverse DNS (PTR) hostname for the IP, when one resolves. |
ptr_pattern | string | Classification of the PTR hostname, e.g. "residential", "mobile". |
fcrdns_valid | boolean | Forward-confirmed reverse DNS: whether the PTR hostname resolves back to this IP. |
abuse_contact | string | Abuse contact published in the registry record. |
open_ports | number[] | Ports that answered during active probing. |
service | string | Service identified on the probed ports. |
cloud_region | string | Cloud provider region, when the IP falls in a provider's published range. |
A field with no value comes back as the string "none", or 0 for numbers. The API never returns null.
Example
The network group for 8.8.8.8, from a real lookup on 24 October 2026. Values change as the data is refreshed.
{
"network": {
"ptr_record": "dns.google",
"ptr_pattern": "none",
"fcrdns_valid": true,
"abuse_contact": "network-abuse@google.com",
"open_ports": [],
"service": "none",
"cloud_region": "none"
}
}