Look up an IP
GET /v1/lookup/{ip} returns the full record for one IPv4 or IPv6 address.
https://api.geoiphub.com/v1/lookup/{ip}Returns everything we know about one address: location, network, registry record, anonymizer detection, threat flags and a fraud score. Every plan gets every field.
Path parameters
Prop
Type
There are no query parameters. You can't pick fields: the response is always complete.
Example request
curl https://api.geoiphub.com/v1/lookup/185.213.155.73 \
-H "x-api-key: $GEOIPHUB_API_KEY"Example response
185.213.155.73 is a Mullvad VPN server in Frankfurt. Trimmed from a real lookup on 24 October 2026:
{
"ip": "185.213.155.73",
"geo": { "country_code": "DE", "city": "Frankfurt am Main (Innenstadt I)" },
"asn": { "asn": 39351, "org": "ESAB-AS - 31173 Services AB", "connection_type": "datacenter" },
"detection": { "is_vpn": true, "vpn_provider": "Mullvad", "is_hosting": true },
"scoring": {
"fraud_score": 100,
"recommended_action": "block",
"detection_methods": ["known_vpn_server", "wireguard_open", "datacenter_with_vpn_proxy", "no_ptr_datacenter"]
}
}The full response has ten groups. See Response format for a complete example and Response fields for every field.
Response headers
| Header | Meaning |
|---|---|
X-RateLimit-Limit | Your limit: lookups a day with a key, lookups a minute without one, or unlimited |
X-RateLimit-Remaining | Lookups left in the current window |
Retry-After | Seconds until you can try again, sent with 429 |
Cache-Control | Always private, no-store |
How fast it is
Addresses we already know are read from memory and answer in about a millisecond. An address we've never seen is classified live first, which takes up to about 2.5 seconds, so its first lookup is slower than every lookup after it.