Enrich alerts with anonymiser and network flags
Example
See more Security use cases → Alert → 185.220.x.x · isTor: true
Tor exit + hosting ASN → elevate alert severity for the SOC
Use case
IP Geolocation API for VPN, Proxy & Threat Detection
See through hidden origins — VPN, Tor, proxy, and datacentre traffic, plus impossible-travel anomalies — in one lookup.
Not every request is what it claims to be. One IP lookup tells you whether traffic rides a VPN, proxy, or Tor exit, whether it comes from a datacentre rather than a home ISP, and whether two sessions imply impossible travel — the signals access control and SOC teams act on.
Who uses it
The teams that lean on this most, in rough order of how often we see it.
The signals it uses
Every one ships in the standard response — no add-ons, no tiers.
security (isVpn / isTor / isThreat) Anonymiser and known-threat flags connection (ASN / org / type) Residential vs hosting / cloud / datacentre origin country / region / city Geo context for access rules and anomalies latitude / longitude Impossible-travel distance between sessions How different teams put it to work
The same signals, applied to the threats each team watches for.
Challenge logins from hidden origins
Example
See more Fintech use cases → Login → 45.83.x.x · isVpn: true
VPN + datacentre network → step-up MFA before access
Detect impossible travel on accounts
Example
See more SaaS use cases → Session A: Berlin → Session B: Lagos (4 min)
impossible travel → raise anomaly, force re-auth
Restrict access to domestic networks
Example
See more Government use cases → Portal access → 203.0.x.x · type: hosting
foreign + datacentre origin → deny, log for review
Spot proxy farms behind multi-accounting
Example
See more Gaming use cases → Cluster of logins → same hosting ASN
datacentre origin + proxy flags → link and challenge accounts
Common questions
What anonymiser signals does the API return?
The security block flags common VPN exits, Tor nodes, and known-threat IPs, and the connection block identifies hosting, cloud, and datacentre networks. Together these cover the large majority of traffic that tries to hide its true origin.
Can it detect account takeover on its own?
It supplies the location and network signals takeover detection relies on — impossible travel between sessions, logins from datacentre networks, VPN/Tor flags — but it isn't a verdict engine. Combine these with device, behavioural, and identity signals for a complete decision.
Why is datacentre/hosting detection so useful?
Most automated abuse — credential stuffing, scraping, bot sign-ups, proxy farms — runs from hosting and cloud networks rather than residential ISPs. Flagging a datacentre origin on a consumer action is one of the highest-signal, lowest-false-positive checks you can add.
Add origin signals in one request
Free tier: 2,000 lookups/day, no card. Paid plans from $2.50/month. Bulk endpoint available for enriching events at scale.