Response format
One JSON object in ten groups, with a complete real example.
Every successful lookup returns 200 OK with one JSON object. Its fields are grouped:
ip, asn, geo, whois, network, detection, threat, dns, scoring, meta
Each group has its own page under Response fields.
Reading it
- Fields are nested.
data.geo.country_code,data.detection.is_vpn,data.scoring.fraud_score. - No nulls. A text field with no value is the string
"none", a number with no value is0, and an empty list is[]. Check for"none", notnull. - Booleans are always present. A flag that doesn't apply is
false, never missing. - Scores have different scales.
scoring.fraud_scoreanddetection.vpn_confidencerun from 0 to 100.scoring.confidence,geo.geo_confidence,detection.proxy_scoreanddetection.residential_proxy_scorerun from 0.0 to 1.0.
Complete example
The full response for 8.8.8.8 (Google Public DNS), from a real lookup on 24 October 2026. Values change as the data is refreshed.
{
"ip": "8.8.8.8",
"asn": {
"asn": 15169,
"org": "GOOGLE - Google LLC",
"asn_type": "hosting",
"user_type": "hosting",
"isp": "GOOGLE - Google LLC",
"domain": "none",
"connection_type": "datacenter",
"access_type": "datacenter",
"carrier": "none",
"mcc": "none",
"mnc": "none",
"rpki": "valid"
},
"geo": {
"country_code": "US",
"country_name": "United States",
"country_names": {
"de": "Vereinigte Staaten von Amerika",
"en": "United States",
"es": "Estados Unidos de Am\u00e9rica (los)",
"fa": "\u0627\u06cc\u0627\u0644\u0627\u062a \u0645\u062a\u062d\u062f\u0647\u0654 \u0627\u0645\u0631\u06cc\u06a9\u0627",
"fr": "\u00c9tats-Unis",
"ja": "\u30a2\u30e1\u30ea\u30ab\u5408\u8846\u56fd",
"ko": "\ubbf8\uad6d",
"pt-BR": "Estados Unidos",
"ru": "\u0421\u0428\u0410",
"zh-CN": "\u7f8e\u56fd"
},
"country_geoname_id": 6252001,
"continent_code": "NA",
"continent_name": "North America",
"continent_geoname_id": 6255149,
"is_in_european_union": false,
"flag_emoji": "\ud83c\uddfa\ud83c\uddf8",
"region": "California",
"city": "Mountain View",
"timezone": "none",
"latitude": 37.422,
"longitude": -122.085,
"geo_confidence": 0.8
},
"whois": {
"org": "none",
"country": "US",
"netname": "none",
"status": "none",
"registered": "2023-12-28T00:00:00.000Z",
"last_changed": "none",
"has_vpn_keywords": false,
"has_hosting_keywords": false
},
"network": {
"ptr_record": "dns.google",
"ptr_pattern": "none",
"fcrdns_valid": true,
"abuse_contact": "network-abuse@google.com",
"open_ports": [],
"service": "none",
"cloud_region": "none"
},
"detection": {
"is_proxy": false,
"is_vpn": false,
"is_tor": false,
"is_hosting": true,
"is_relay": false,
"is_mobile": false,
"is_satellite": false,
"is_anycast": true,
"is_residential_proxy": false,
"is_public_proxy": false,
"is_anonymous": false,
"proxy_type": "none",
"anonymity_level": "low",
"vpn_provider": "none",
"vpn_provider_tier": "none",
"relay_provider": "none",
"proxy_score": 0,
"vpn_confidence": 5,
"residential_proxy_status": "not_observed",
"residential_proxy_evidence": "none",
"residential_proxy_last_seen": "none",
"residential_proxy_score": 0,
"last_seen": "2026-10-20T12:21:35.000Z"
},
"threat": {
"is_abusive": false,
"is_bogon": false,
"is_crawler": false,
"is_spammer": false,
"is_scanner": false,
"is_botnet": false,
"is_cgnat": false,
"threat_types": [],
"blocklist_count": 0,
"blocklist_sources": [],
"dnsbl_sources": [],
"crawler": {
"verified": false,
"unverified": false,
"spoofed": false,
"name": "none",
"operator": "none",
"category": "none",
"verification_method": "none"
},
"botnet": {
"role": "none",
"family": "none",
"last_seen": "none"
},
"honeypot": {
"hits_30d": 0,
"type": "none",
"last_hit": "none"
},
"spammer_last_seen": "none"
},
"dns": {
"ptr_record": "dns.google",
"ptr_pattern": "none",
"fcrdns_valid": true
},
"scoring": {
"fraud_score": 10,
"confidence": 0.25,
"recommended_action": "allow",
"detection_methods": [
"datacenter_ip"
]
},
"meta": {
"last_classified_at": "2026-10-24T10:43:30.837Z",
"last_scanned": "2026-10-20T12:21:35.000Z",
"request_id": "97daa70d-4069-428c-bdbc-68b6c2a8735b",
"latency_ms": 0,
"sources": []
}
}