What data does the IP Intelligence API return for an IP address?

For any IPv4 or IPv6 address the API returns a flat JSON object containing the normalized ip, its version (4 or 6), an array of reverse DNS (PTR) hostnames, the origin asn and asn_name, the covering bgp_prefix, the country_code, the RIR registry, the prefix allocated_date, and an is_bogon flag indicating whether the address is private, reserved, or non-routable. Network fields are null for bogon addresses.

Does the API support both IPv4 and IPv6?

Yes. The API fully supports both IPv4 and IPv6, including compressed IPv6 notation and IPv4-mapped IPv6 addresses. The response includes a version field set to 4 or 6 so you can branch your logic accordingly. Reverse DNS, ASN lookups, and bogon detection all work identically across both address families.

What happens if I don't provide an IP address?

If you omit the ip query parameter, the API looks up the public IP your request came from. This is ideal for building "what's my IP" widgets and client diagnostics. If your public IP can't be determined and no ip is supplied, the API answers 400 (not billed); pass ip explicitly in that case.

What is a bogon and how is it detected?

A bogon is an IP address that should never appear on the public internet, including private RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback, link-local, and other reserved blocks. When an address falls into one of these ranges the API sets is_bogon to true and returns null for the ASN, BGP prefix, registry, and country fields, since there is no public network ownership to report.

Where does the ASN and network ownership data come from?

ASN, AS name, BGP prefix, RIR registry, and allocation date are sourced from the authoritative Team Cymru IP-to-ASN service, queried in real time over DNS-over-HTTPS from the Cloudflare edge. This means there are no stale local databases to maintain and no third-party API keys to manage — the data reflects the current global routing table.

How fast is the API and where does it run?

The IP Intelligence API runs entirely on the Cloudflare global edge across 300+ locations, so every lookup is resolved from the data center nearest to your request. Typical responses complete in under 200ms. Because lookups run over DNS-over-HTTPS rather than scraping or querying a centralized database, latency stays low and consistent even under high concurrency.

Is the API suitable for fraud detection and SIEM enrichment?

Typical uses include enriching server logs and SIEM pipelines, fraud and abuse scoring, allow/deny-list automation, and CDN/anycast attribution. The clean, flat JSON response is easy to parse and join against your event data, and the bogon flag lets you immediately filter out internal traffic. Each lookup costs 5 credits, so the Pro plan ($99.99/month, 250,000 credits) covers up to 50,000 lookups per month for high-volume security workloads.

Reverse DNS, ASN ownership, and bogon detection for any IP

IP Intelligence API

The IP Intelligence API turns a bare IPv4 or IPv6 address into actionable intelligence with a single GET request. It resolves reverse DNS (PTR) records, identifies the owning network through the authoritative Team Cymru IP-to-ASN dataset, and flags private, reserved, and non-routable addresses inline.

Built entirely on the Cloudflare global edge, every lookup runs over DNS-over-HTTPS with sub-second latency from the nearest data center — no scraping, no stale databases, and no per-record licensing. It is ideal for fraud and abuse scoring, log enrichment, SIEM pipelines, and CDN/anycast attribution.

Get a free API key Read the docs

Free tier included, no credit card required. One key works across every API.

Free calls / month: 200
IP Versions: IPv4 + IPv6
Lookup Speed: <200ms
Uptime SLA: 99.9%

Get your free API key

200 free calls on the free plan

Key features

Reverse DNS (PTR) resolution for any IPv4 or IPv6 address
ASN and AS name identification via the Team Cymru IP-to-ASN dataset
BGP prefix, RIR registry, and allocation date enrichment
Bogon detection for private, reserved, and non-routable ranges
Caller self-identification when the ip parameter is omitted
Full IPv6 support including compressed and IPv4-mapped forms
Clean, flat JSON responses with best-effort partial data

Built for

Fraud and abuse scoring
Log and SIEM enrichment
Allow/deny-list automation
ASN-based geo and network routing
CDN and anycast attribution
"What is my IP" widgets and client diagnostics
Threat intelligence pipelines
Network reconnaissance and auditing

MCP · for your agent

Hand the IP Intelligence API to your agent

Connect Claude, Cursor or any MCP client once, then ask in plain words. Your agent finds this API, reads its docs and makes the call: 5 credits per call, the same as REST, from your team's balance.

Connect your agent

Verify a webhook's source network

“Our webhook endpoint got a request from 140.82.115.4 claiming to be GitHub. Does that IP really belong to GitHub?”

list_apis · get_api_docsfree

api_request GET /ip-intelligence/v1/lookup?ip=140.82.115.4 5 cr

ASN, network owner, BGP prefix and reverse DNS, confirming whether the IP is GitHub's.

Explain odd IPs in access logs

“Our public access logs show hits from 10.0.4.12 and 100.64.1.9. Are those real visitors?”

list_apis · get_api_docsfree

api_request GET /ip-intelligence/v1/lookup?ip=100.64.1.9 5 cr

Both flagged as private or reserved ranges: a sign the proxy isn't passing client IPs.

Tell CDN traffic from real visitors

“Our origin logs show lots of requests from 104.16.132.229. Is that Cloudflare or a real visitor?”

list_apis · get_api_docsfree

api_request GET /ip-intelligence/v1/lookup?ip=104.16.132.229 5 cr

ASN and network owner identifying Cloudflare, so you know to read the forwarded client IP.

$ claude mcp add --transport http apicodex https://mcp.apicodex.io

Illustrative asks; the calls and prices are real. Claude, Cursor, VS Code and Windsurf setup: mcp.apicodex.io

Try it

Build the request for your data

Edit the parameters below and see the exact request and curl command you'd send. No key required to preview.

GET /ip-intelligence/v1/lookup

Open in Playground

Parameters

ip

Request · HTTP

GET /ip-intelligence/v1/lookup?ip=8.8.8.8 HTTP/1.1
Host: api.apicodex.io
X-Api-Key: YOUR_API_KEY

Response · JSON 200 OK

{
"ip": "8.8.8.8",
"version": 4,
"reverse_dns": ["dns.google"],
"asn": "15169",
"asn_name": "GOOGLE, US",
"bgp_prefix": "8.8.8.0/24",
"country_code": "US",
"registry": "arin",
"allocated_date": "1992-12-01",
"is_bogon": false
}

Run it with your key

Documentation

IP Intelligence API Documentation

The IP Intelligence API resolves reverse DNS (PTR), ASN/network ownership via the Team Cymru IP-to-ASN service, and a bogon/private-range flag for any IPv4 or IPv6 address. Authentication is handled globally: send your API key in an X-Api-Key header, or pass it as the apikey query parameter.

Base URL

url

https://api.apicodex.io/ip-intelligence

Authentication

Send your API key in an X-Api-Key header, or pass it as the apikey query parameter (?apikey=YOUR_KEY):

headers

{
"X-Api-Key": "YOUR_API_KEY"
}

Request and response

Illustrative values. Confirm current endpoint behavior, quotas, and data freshness in the API documentation before production use.

request · http

GET /ip-intelligence/v1/lookup?ip=8.8.8.8 HTTP/1.1
Host: api.apicodex.io
X-Api-Key: YOUR_API_KEY

response · json

{
"ip": "8.8.8.8",
"version": 4,
"reverse_dns": ["dns.google"],
"asn": "15169",
"asn_name": "GOOGLE, US",
"bgp_prefix": "8.8.8.0/24",
"country_code": "US",
"registry": "arin",
"allocated_date": "1992-12-01",
"is_bogon": false
}

Code examples

cURL

curl --request GET \
  --url 'https://api.apicodex.io/ip-intelligence/v1/lookup?ip=8.8.8.8&apikey=YOUR_KEY'

JavaScript/Node.js

const params = new URLSearchParams({
  ip: '8.8.8.8',
  apikey: 'YOUR_KEY'
});

const response = await fetch(
  `https://api.apicodex.io/ip-intelligence/v1/lookup?${params}`
);

const data = await response.json();
console.log(data);

Python

import requests

url = "https://api.apicodex.io/ip-intelligence/v1/lookup"

querystring = {"ip": "8.8.8.8", "apikey": "YOUR_KEY"}

response = requests.get(url, params=querystring)

print(response.json())

Endpoints

GET /v1/lookup

Look up reverse DNS, ASN/network info, and bogon status for an IP. If ip is omitted, the caller's own public IP is used.

/v1/lookup?ip=8.8.8.8

Query Parameters

Optional parameters

ip The IPv4 or IPv6 address to look up. If omitted, the caller's own public IP is used. Returns 400 (not billed) if your public IP can't be determined.
apikey Your API key, passed as a query parameter. Optional if you send it in an X-Api-Key header instead.

Pricing

IP Intelligence API Pricing

This API costs 5 credits per request. Credits are shared across every API on your plan.

Estimate your monthly cost

Drag the slider to match your expected request volume. We'll recommend the cheapest plan that covers it.

Requests per month 10,000

Recommended plan

Starter

$29.99 /month

Credits used

Credits included

Cost per 1K requests

Choose Starter

Free

1,000 credits · ~200 requests/mo · 2 rps

All APIs included
No credit card required
Full documentation and examples
MCP server for your AI agents
Up to 5 active API keys

Start for free

Starter

Popular

$29.99 /month

50,000 credits · ~10,000 requests/mo · 10 rps

All APIs included
Email support
Usage dashboard and analytics
MCP server for your AI agents
Up to 5 active API keys

Start with Starter

Pro

$99.99 /month

250,000 credits · ~50,000 requests/mo · 25 rps

All APIs included
Priority support
MCP server for your AI agents
Up to 5 active API keys

Start with Pro

FAQ

IP Intelligence API

Key features

Built for

Hand the IP Intelligence API to your agent

Verify a webhook's source network

Explain odd IPs in access logs

Tell CDN traffic from real visitors

Build the request for your data

IP Intelligence API Documentation

Base URL

Authentication

Request and response

Code examples

Endpoints

GET /v1/lookup

Query Parameters

Optional parameters

IP Intelligence API Pricing

Free

Starter

Pro

Need a different plan?

Frequently asked questions

Related APIs