IP Lookup

Look up intelligence about an IP address — geolocation, VPN/proxy/Tor detection, ASN, company, timezone, abuse reports, malware analysis, and scanner classification.

POST /api/agent/ip

IP Lookup

cURL

curl --request POST \
  --url https://encrata.com/api/agent/ip \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "ip": "<string>"
}
'

200

{
  "ip_address": "<string>",
  "security": {
    "is_vpn": true,
    "is_proxy": true,
    "is_tor": true,
    "is_hosting": true,
    "is_relay": true,
    "is_mobile": true,
    "is_abuse": true
  },
  "asn": {
    "asn": 123,
    "name": "<string>",
    "domain": "<string>",
    "type": "<string>"
  },
  "company": {
    "name": "<string>",
    "domain": "<string>",
    "type": "<string>"
  },
  "location": {
    "city": "<string>",
    "region": "<string>",
    "country": "<string>",
    "country_code": "<string>",
    "postal_code": "<string>",
    "continent": "<string>",
    "longitude": 123,
    "latitude": 123
  },
  "timezone": {
    "name": "<string>",
    "abbreviation": "<string>",
    "utc_offset": 123
  },
  "threat": {
    "abuse_score": 123,
    "total_reports": 123,
    "last_reported_at": "<string>",
    "usage_type": "<string>",
    "is_tor": true,
    "is_whitelisted": true,
    "distinct_users": 123,
    "is_scanner": true,
    "is_known_service": true,
    "classification": "<string>",
    "scanner_name": "<string>",
    "last_seen": "<string>"
  },
  "malware": {
    "malicious_count": 123,
    "suspicious_count": 123,
    "harmless_count": 123,
    "undetected_count": 123,
    "reputation": 123,
    "network": "<string>"
  }
}

Authentication

Requires an API key in the Authorization header.

Authorization: Bearer YOUR_API_KEY

Request

ip · string · required

The IP address to look up (IPv4 or IPv6).

Example request

cURL (API Key)

curl -X POST "https://encrata.com/api/agent/ip" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip": "8.8.8.8"}'

Response

ip_address · string

The IP address that was looked up.

security · object

Security/threat detection flags.

Show security fields

is_vpn · boolean

Whether the IP is a known VPN exit node.

is_proxy · boolean

Whether the IP is a known proxy server.

is_tor · boolean

Whether the IP is a Tor exit node.

is_hosting · boolean

Whether the IP belongs to a hosting/data center provider.

is_relay · boolean

Whether the IP is a known relay (e.g. iCloud Private Relay).

is_mobile · boolean

Whether the IP is from a mobile carrier.

is_abuse · boolean

Whether the IP has been flagged for abuse.

asn · object

Autonomous System Number details.

Show asn fields

asn · number

The AS number (e.g. 15169).

name · string

ASN organization name (e.g. "GOOGLE").

domain · string

Domain associated with the ASN.

type · string

ASN type — "isp", "hosting", "business", or "education".

company · object

Company or organization that owns the IP range.

Show company fields

name · string

Company name (e.g. "Google LLC").

domain · string

Company domain.

type · string

Company type — "isp", "hosting", "business", or "education".

location · object

Geolocation data.

Show location fields

city · string

City name.

region · string

Region/state name.

country · string

Full country name.

country_code · string

ISO 3166-1 alpha-2 country code.

postal_code · string

Postal/ZIP code.

continent · string

Continent name.

longitude · number

Longitude coordinate.

latitude · number

Latitude coordinate.

timezone · object

Timezone information.

Show timezone fields

name · string

IANA timezone name (e.g. "America/Los_Angeles").

abbreviation · string

Timezone abbreviation (e.g. "PDT").

utc_offset · number

UTC offset in hours (e.g. -7).

threat · object

Threat intelligence data.

Show threat fields

abuse_score · number

Abuse confidence score (0–100).

total_reports · number

Total abuse reports filed.

last_reported_at · string

ISO 8601 timestamp of last report.

usage_type · string

IP usage classification.

is_tor · boolean

Known Tor exit node.

is_whitelisted · boolean

Whitelisted as a known safe address.

distinct_users · number

Distinct reporters.

is_scanner · boolean

Observed scanning the internet.

is_known_service · boolean

Known benign service (e.g. search engine crawler, CDN).

classification · string

"malicious", "benign", or "unknown".

scanner_name · string

Identified scanner/service name.

last_seen · string

Last seen date (YYYY-MM-DD).

malware · object

Malware analysis results.

Show malware fields

malicious_count · number

Vendors flagging as malicious.

suspicious_count · number

Vendors flagging as suspicious.

harmless_count · number

Vendors classifying as harmless.

undetected_count · number

Vendors with no opinion.

reputation · number

Community reputation score.

network · string

CIDR network range.

Example response

200 OK

{
  "ip_address": "8.8.8.8",
  "security": {
    "is_vpn": false,
    "is_proxy": false,
    "is_tor": false,
    "is_hosting": true,
    "is_relay": false,
    "is_mobile": false,
    "is_abuse": false
  },
  "asn": {
    "asn": 15169,
    "name": "GOOGLE",
    "domain": "google.com",
    "type": "hosting"
  },
  "company": {
    "name": "Google LLC",
    "domain": "google.com",
    "type": "hosting"
  },
  "location": {
    "city": "Mountain View",
    "region": "California",
    "country": "United States",
    "country_code": "US",
    "postal_code": "94043",
    "continent": "North America",
    "longitude": -122.0775,
    "latitude": 37.4056
  },
  "timezone": {
    "name": "America/Los_Angeles",
    "abbreviation": "PDT",
    "utc_offset": -7
  },
  "threat": {
    "abuse_score": 0,
    "total_reports": 87,
    "last_reported_at": "2026-05-10T14:22:00+00:00",
    "usage_type": "Data Center/Web Hosting/Transit",
    "is_tor": false,
    "is_whitelisted": true,
    "distinct_users": 42,
    "is_scanner": false,
    "is_known_service": true,
    "classification": "benign",
    "scanner_name": "Google DNS",
    "last_seen": "2026-05-11"
  },
  "malware": {
    "malicious_count": 0,
    "suspicious_count": 0,
    "harmless_count": 74,
    "undetected_count": 12,
    "reputation": 30,
    "network": "8.8.8.0/24"
  }
}

Notes

• This endpoint is free — no credits are deducted.
• Supports both IPv4 and IPv6 addresses.
• Results are cached — repeat lookups within the cache window are instant.
• If a provider is unavailable, the response still includes data from the remaining providers.
• Rate limited to 60 requests per minute.