Data types
The IPLocate API provides comprehensive IP address intelligence data through simple REST endpoints. This page details all available data objects and their fields.
You can also view a full example response.
For fields that are not available, the value will be null.
For top-level objects such as hosting or vpn, the entire key/object will be missing from the response if not relevant to the given IP address.
You should make sure your application handles each of these cases.
Geolocation & base data object
The base response object includes IP geolocation information such as country, city, currency and calling codes, timezone.
The base response fields will always be present.
Example response
{
"ip": "8.8.8.8",
"country": "United States",
"country_code": "US",
"is_eu": false,
"city": "Mountain View",
"continent": "North America",
"latitude": 37.40599,
"longitude": -122.078514,
"time_zone": "America/Los_Angeles",
"postal_code": "94043",
"subdivision": "California",
"currency_code": "USD",
"calling_code": "1",
"network": "8.8.8.0/24",
"is_anycast": false,
"is_satellite": false
}
Autonomous system & network data (asn object)
The asn object provides detailed information about the Autonomous System of the IP address. This is usually the service provider or network responsible for connecting the IP address to the rest of the internet.
Example response
{
"asn": {
"asn": "AS15169",
"route": "8.8.8.0/24",
"netname": "GOOGLE",
"name": "Google LLC",
"country_code": "US",
"domain": "google.com",
"type": "hosting",
"rir": "ARIN"
}
}
Organization types
The type field classifies the organization based on its primary function:
business- General business organizations
hosting- Cloud hosting and data center providers (AWS, Google Cloud, Azure, etc.)
government- Government agencies and organizations
education- Educational institutions (universities, schools, research organizations)
isp- Internet Service Providers
unknown- Organizations that couldn't be classified
Regional Internet Registries (RIRs)
The rir field indicates which Regional Internet Registry manages the IP address space:
ARIN- American Registry for Internet Numbers (North America)
RIPE- Réseaux IP Européens (Europe, Middle East, parts of Asia)
APNIC- Asia-Pacific Network Information Centre (Asia-Pacific region)
LACNIC- Latin American and Caribbean Internet Addresses Registry (Latin America and Caribbean)
AFRINIC- African Network Information Centre (Africa)
Privacy & threat detection data (privacy object)
Privacy and threat data provides detailed information about privacy services associated with the IP address (such as proxies, VPNs, iCloud Private Relay), as well as threat and security information like abuse and spam reports.
This data is updated multiple times per day.
Example response
{
"privacy": {
"is_abuser": false,
"is_anonymous": false,
"is_bogon": false,
"is_hosting": true,
"is_icloud_relay": false,
"is_proxy": false,
"is_tor": false,
"is_vpn": false
}
}
Hosting & datacenter provider data (hosting object)
Hosting data provides additional detailed information about the type of hosting service or datacenter the IP address belongs to.
IPLocate tracks hundreds of known hosting providers, including all major cloud providers. We also track millions of other IP addresses that are used by less well-known hosting providers.
The hosting object will only be present if we have detailed hosting provider information for the given IP address.
Otherwise, privacy.is_hosting may be true but the response will not include the hosting object.
Example response
{
"hosting": {
"provider": "Amazon AWS",
"domain": "aws.amazon.com",
"network": "3.5.140.0/22",
"region": "ap-northeast-2",
"service": "EC2"
}
}
Major hosting providers detected
IPLocate identifies IP addresses from dozens of major cloud and hosting providers, CDNs, and infrastructure providers. For example:
- Amazon Web Services (AWS)
- Microsoft Azure
- Google Cloud Platform (GCP)
- Cloudflare
- Akamai
- Fastly
- DigitalOcean
- Linode (Akamai)
- Hetzner
- OVHcloud
Regional information
For major cloud providers, when available, the region field may provide the specific geographic region where the resource is located. For example:
Note that each cloud provider uses different region codes.
Service identification
For major cloud providers, the service field may identify the specific service or product:
Note that each cloud provider has different named services.
Company data (company object)
Company data identifies the organization behind an IP address range, the type of business, and its domain name.
We source this information from a combination of public Whois and other network data, network analysis, and web crawling.
The company type is classified by a machine learning model based on observed IP address usage patterns and company metadata.
Example response
{
"company": {
"name": "Google LLC",
"domain": "google.com",
"country_code": "US",
"type": "hosting"
}
}
Company types
The type field classifies the organization based on the primary function of the IP address range:
business- General business organizations and corporations
hosting- Cloud hosting and data center providers (AWS, Google Cloud, Azure, etc.)
government- Government agencies and organizations
education- Educational institutions (universities, schools, research organizations)
isp- Internet Service Providers
unknown- Organizations that couldn't be classified
The company.type field won’t always match the asn.type field.
The asn.type field is based on the primary function of the ASN or its organization. An ASN can include multiple IP address ranges (“networks”), and may operate multiple services across those networks.
The company.type field intends to capture the type of usage of a particular IP address range, which may be different from the ASN, and which may be different even across the same organization and domain name. For example, Google runs networks for Google Cloud Platform, which is a hosting provider, as well as networks for its business and ISP services. The company.type field would capture one network as hosting, another as business, and another as isp.
Abuse contact data (abuse object)
Abuse contact data is contact information (usually of the network administrator) which can be used to report IP addresses that are engaged in fraudulent/malicious activities.
Abuse contact data is sourced from public Whois information.
As defined in our Terms of Service, abuse contact data must be only be used for purposes related to cybersecurity, fraud prevention, network and infrastructure monitoring, internet research, and related activities.
Abuse contact data must not be used for advertising or marketing purposes or any related activity.
Example response
{
"abuse": {
"address": "TPG Internet Pty Ltd. (Part of the Total Peripherals Group)\n65 Waterloo Road\nNorth Ryde NSW 2113",
"country_code": "AU",
"email": "[email protected]",
"name": "ABUSE TPGCOMAU",
"network": "123.243.246.192 - 123.243.246.223",
"phone": "+000000000"
}
}
VPN data (vpn object) Private beta
VPN data provides additional detailed information about the type of VPN or proxy service the IP address belongs to.
VPN data will be populated for IP addresses where privacy.is_vpn is true, and where we have additional data.
Comprehensive VPN detection data is currently in beta. Contact us to get access.
VPN detection status is currently available via the privacy.is_vpn flag.