IP Intelligence API

For any IPv4 or IPv6 address the API returns a flat JSON object containing the normalized ip, its version (4 or 6), an array of reverse DNS (PTR) hostnames, the origin asn and asn_name, the covering bgp_prefix, the country_code, the RIR registry, the prefix allocated_date, and an is_bogon flag indicating whether the address is private, reserved, or non-routable. Network fields are null for bogon addresses.

Yes. The API fully supports both IPv4 and IPv6, including compressed IPv6 notation and IPv4-mapped IPv6 addresses. The response includes a version field set to 4 or 6 so you can branch your logic accordingly. Reverse DNS, ASN lookups, and bogon detection all work identically across both address families.

If you omit the ip query parameter, the API falls back to the caller's own IP using Cloudflare's CF-Connecting-IP header. This is ideal for building "what's my IP" widgets and client diagnostics. If that header is unavailable — for example during local development — and no ip is supplied, the API returns a 400 error indicating that no IP could be determined.

A bogon is an IP address that should never appear on the public internet, including private RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback, link-local, and other reserved blocks. When an address falls into one of these ranges the API sets is_bogon to true and returns null for the ASN, BGP prefix, registry, and country fields, since there is no public network ownership to report.

ASN, AS name, BGP prefix, RIR registry, and allocation date are sourced from the authoritative Team Cymru IP-to-ASN service, queried in real time over DNS-over-HTTPS from the Cloudflare edge. This means there are no stale local databases to maintain and no third-party API keys to manage — the data reflects the current global routing table.

The IP Intelligence API runs entirely on the Cloudflare global edge across 300+ locations, so every lookup is resolved from the data center nearest to your request. Typical responses complete in under 200ms. Because lookups run over DNS-over-HTTPS rather than scraping or querying a centralized database, latency stays low and consistent even under high concurrency.

Absolutely. The API is designed for log enrichment, SIEM pipelines, fraud and abuse scoring, allow/deny-list automation, and CDN/anycast attribution. The clean, flat JSON response is easy to parse and join against your event data, and the bogon flag lets you immediately filter out internal traffic. The Ultra plan supports up to 1,000,000 requests per month for high-volume security workloads.