IP reputation API
Know every IP before it touches your app
A single IP reputation API call returns the address's class and risk tags — datacenter, VPN, proxy, Tor, residential proxy, scanner — plus ASN and geo, with optional company and reverse-DNS enrichment.
The problem
A bare IP address tells you nothing
You can see the IP on every request, but a bare address tells you nothing about whether it's a home connection or a rented VPS running a scanner. Stitching together a geo database, an ASN feed, and a proxy/VPN list yourself means maintaining three data sources and still missing residential proxies and fresh Tor exits.
How it works
One GET, one in-memory lookup, structured tags back
No request body, no third-party round trip — a single longest-prefix match against a self-hosted dataset at the edge.
Send the IP
Make one authenticated GET to /v1/ip/{ip} with your Bearer key. Works for any IPv4 or IPv6 address — the one you pulled from a request header, a signup record, or a log line. No request body, no batching ceremony.
We resolve it against a compiled blob
The lookup is a longest-prefix match against a single self-hosted dataset loaded in-memory at the edge — no third-party round trip. It merges ASN, geo, and datacenter/proxy/VPN/Tor/scanner sources offline, so a typical lookup resolves in about a millisecond.
You get class, tags, and risk back
The response groups everything: network (asn, org), location (ISO country), type (datacenter/hosting/isp/mobile/cloud), and risk (proxy/vpn/tor/residential_proxy/scanner), plus a flat flags array. Branch on the booleans you care about and act.
What you get
Class, risk, and ASN — with enrichment when you ask for it
Every lookup groups network, location, type, and risk into one response, plus opt-in enrichment behind ?include= so default calls stay lean.
Risk tags, not just geo
Every lookup returns five risk booleans: proxy, vpn, tor, residential_proxy, and scanner. These are the tells that separate a real visitor from rented or laundered infrastructure — the part a plain GeoIP database leaves out.
Network class and ASN
The type block tells you what kind of network the IP belongs to — datacenter, hosting, isp, mobile, or cloud — alongside the ASN and org name. A datacenter or cloud-classed IP hitting a consumer signup form is rarely a real customer.
Optional enrichment via ?include=
Default lookups stay lean. Add ?include=region for cloud_provider and cloud_region (e.g. aws / us-east-1), ?include=company for an ASN-level company block (name, website, category, confidence), or ?include=rdns for reverse DNS plus forward-confirmed hostname_verified.
Honest, explicit credits
One credit per lookup. The only enrichment that can cost extra is rdns, and only on a cache miss (+1). Every response reports metadata.enrichment with requested, resolved, and the exact credits charged, so cost is never a surprise.
The call
One request in, structured reputation out
A live Tor exit relay (185.220.101.1) returns datacenter, hosting, proxy, vpn, tor, and scanner — all in a single response.
curl https://api.formshield.dev/v1/ip/185.220.101.1 \
-H "Authorization: Bearer YOUR_API_KEY"FAQ
Common questions
Send an authenticated GET to https://api.formshield.dev/v1/ip/{ip} with an Authorization: Bearer header. You get back the IP's network class (datacenter, hosting, isp, mobile, cloud), its risk tags (proxy, vpn, tor, residential_proxy, scanner), ASN, org, and ISO country in one response. No request body is needed, and each lookup costs one credit.
The type block describes what kind of network owns the IP — is it a datacenter, hosting provider, ISP, mobile carrier, or cloud network. The risk block flags how the IP is being used in ways that correlate with abuse: proxy, VPN, Tor exit, residential proxy, or scanner. An address can carry several of both at once (they aren't mutually exclusive), so branch on the specific booleans your use case cares about.
A base lookup is one credit. The region and company enrichments are included at no extra credit. The only add-on that can cost more is rdns (reverse DNS), which adds one credit only when the hostname isn't already cached. Every response reports the exact credits charged under metadata.enrichment, so you always know the cost of the call you made.
Stop fighting spam by hand
One API call. IP, email, content & behavior signals in a single intelligence platform. Start free, no credit card required.