Frequently Asked Questions

A free IP intelligence API. Look up any IPv4 or IPv6 address and get country, ASN, ISP, hosting detection, VPN detection, Tor exit node identification, and abusive network scoring. One JSON response. No signup.

No. The free tier needs no key and no signup — just call the endpoint (limits are tracked per IP address). If you want Pro or Enterprise limits, send your key in the X-API-Key header or as ?api_key=. You can issue a free key instantly with POST /v1/keys.

https://ipto.to. All endpoints are under /v1/. CORS is enabled on all endpoints.

GET https://ipto.to/v1/ip — no parameter needed. Returns your IP along with city, state, timezone, and lat/lon. Or run curl ipto.to in a terminal.

Yes. curl ipto.to auto-detects the curl User-Agent and returns compact JSON for your own IP, fields including country, city, ASN, and live weather. curl ipto.to/8.8.8.8 does the same for any IP (no weather). Wget and HTTPie also work.

IP geolocation maps IP ranges to the physical location of the network infrastructure, not the end user. ISPs route traffic through regional exchange points that can be hundreds of miles away. Country accuracy is high. City-level precision degrades for residential and mobile IPs.

When connected to a VPN, your traffic exits from the VPN server's IP address. ipto reports the location of that exit server, not your physical location. The is_vpn flag will be true in this case.

Data quality depends on how accurately ISPs and organisations register their IP blocks in WHOIS and route registries. Large cloud providers and ISPs have highly accurate records. Smaller or older allocations can be imprecise.

Yes. IPv6 addresses return ASN, organisation, and IP-range data, plus city-level location (city, region, postal code, latitude/longitude) from the MaxMind dataset where the range is covered, and bogon/private ranges are identified. The one gap: the VPN, Tor, and abuse flags are IPv4-only for now, because those feeds are published as IPv4 ranges — on an IPv6 address they come back false rather than guessed.

A bogon (bogus) IP is any address that should not appear as a source on the public internet: loopback (127.x.x.x), RFC 1918 private ranges (10.x, 172.16–31.x, 192.168.x), link-local (169.254.x), multicast (224–239.x), and IANA reserved blocks. ipto detects these before any database lookup and returns bogon: true with a bogon_type reason. Check any address on the bogon IP checker.

ipto maintains a database of known VPN server IP ranges, built from BGP routing analysis and active enumeration. Each IP is checked against this database on lookup. Provider attribution is derived from ASN ownership: when an ASN is registered exclusively to a VPN operator, the provider is identified. Test any IP on the VPN & proxy checker.

The Tor exit node list is sourced from the official Tor Project bulk exit node list at check.torproject.org. This is the authoritative list of IPs currently able to originate Tor exit traffic. It is refreshed every 6 hours.

The IP falls within a network range that has been flagged by multiple independent threat intelligence feeds as hosting abusive infrastructure: spam sources, malware command-and-control servers, botnet relays, or mass-exploitation tooling. A higher abuse score means more feeds agreed independently.

is_datacenter means the IP belongs to a hosting provider, cloud platform, or CDN. is_residential means the IP is classified as a consumer broadband connection. Most IPs are neither — they belong to ISP infrastructure that is neither hosting nor residential.

Flags known proxy exit points not categorised as VPN or Tor. Currently limited to data from the threat feed pipeline. Coverage is lower than VPN and Tor detection.

An Autonomous System Number (ASN) is a unique identifier for a network that independently manages its own IP routing policies on the internet. Examples: Google is AS15169, Amazon is AS16509. Every IP block is announced by exactly one ASN. Look any ASN up directly on the ASN lookup tool.

The category of the organisation that operates the ASN. Values: hosting (cloud or server hosting), isp (internet service provider), business (enterprise network), education (university or research), government, mobile (carrier), residential.

The IP block is registered to a mobile carrier. Mobile IPs are commonly reassigned between users and often appear in different geographic locations than the carrier's headquarters.

Yes — GET /v1/asn/:asn/ranges?limit=&offset= returns the actual ranges (each with country code and hosting/mobile/residential/bot/blacklist flags), paginated up to 200 per request. The main GET /v1/asn/:asn lookup also includes ip_range_count and a rank — the ASN's size rank within its country by range count — without needing the ranges endpoint. See the ASN lookup tool.

GET /v1/asn/:asn/whois returns the RIR registration record (name, status, country, registration/last-changed dates, contacts) via RDAP. GET /v1/asn/:asn/relationships returns known peers, upstream providers, and downstream customers from CAIDA's AS-relationships dataset; GET /v1/asn/:asn/related instead finds other ASNs likely run by the same organisation. All three appear together on the ASN lookup page.

Yes — All IP Ranges (GET /v1/ip-ranges) is a browsable directory of all 256 possible /8 blocks, drilling down through /16 to the actual assigned ranges and the ASN each one belongs to.

The free tier allows 1,000 requests/day per IP address, no signup or key required. Pro keys get 100,000/day; Enterprise is unlimited. Exceeding your limit returns HTTP 429. See pricing for details.

POST a JSON array of IP strings to /v1/ip/bulk — up to 100 per request, Pro/Enterprise only (see pricing). The response is an object keyed by IP. Parallel cache reads make this faster than sequential calls. Each IP counts against your daily budget, same as an individual lookup.

Add ?fields=field1,field2 to any single-IP request. Example: /v1/ip/1.1.1.1?fields=ip,country_code,is_vpn,is_tor. The ip field is always included.

JSON (default), CSV, plain text, XML, and YAML. Add ?format=csv, ?format=text, ?format=xml, or ?format=yaml to any single-IP request. CSV and text return flat key/value pairs; XML and YAML preserve nested objects like flags.

No official SDK yet. The API is a standard HTTP JSON endpoint — any HTTP client works. See the docs for curl, JavaScript, Python, PHP, and Go examples.

Yes — https://ipto.to/mcp is a Model Context Protocol (MCP) server that exposes the same lookups as callable tools over JSON-RPC — IP (single and bulk), ASN with its ranges/whois/relationships, IP whois, RPKI, company, carrier, hosted domains, unified search, nearby places, country, reverse DNS, user-agent, phone, email, fraud score, language, currency, weather, trademark, and patent — so an MCP-capable client can call them directly instead of making raw HTTP requests. It uses the same X-API-Key and rate-limit rules as the REST API.

The ASN/IP-range dataset is refreshed daily at 04:00 UTC. City-level geolocation merges two independent sources on their own schedules — IP2Location monthly, MaxMind weekly — so precision can improve between ASN refreshes. Threat feeds (VPN, Tor, abuse) sync every 6 hours. The edge cache TTL is 5 minutes.

We gather info from several key industry data providers, updated daily. VPN detection uses BGP-derived range intelligence. Tor node data comes from the official Tor Project registry and verified relay lists. Abuse networks use cross-corroborated multi-source blacklist intelligence.

VPN and Tor detection has high recall for major providers and all confirmed exit nodes. Smaller or newer VPN services that lease IP space from generic hosting ASNs may not be identified by provider name. Abuse scoring uses cross-feed corroboration — a network requires 3+ independent sources to appear at Medium tier, and 8+ sources for Critical.

abuse_score is a 1–10 severity score based on cross-feed corroboration: how many independent threat sources flag the same network. threat_type names which category triggered the flag — tor_exit, vpn, or abuser. risk_tier groups the score into critical (8–10), high (5–7), or medium (3–4). Try a live check on the IP abuse checker.

Yes. Any response with a resolved country includes currency_code and exchange_rate_usd — a daily reference rate covering 154 world currencies. Currencies outside that list return null for the rate.

Each response with country data includes languages (official languages spoken), tld (country-code top-level domains), capital, and borders (ISO codes of neighboring countries) — useful for localizing content or building country-aware forms without a second API call.

GET /v1/ip/:ip/hostname performs a live PTR lookup over DNS-over-HTTPS and returns { ip, hostname }. It's a single on-demand lookup, not a cached domain-enumeration database — hostname is null if no PTR record exists. There's also a browser tool at /reverse-dns-lookup.

Yes. GET /v1/datasets/:kind returns CSV exports for asn, ranges, and geo-city — the same datasets the API queries internally, refreshed on the same schedule. geo-city takes an optional ?source=primary (default) or ?source=secondary, since city-level data is merged from two independent sources with different coverage.

A Pro key unlocks a 100,000 requests/day limit and bulk lookup (POST /v1/ip/bulk, up to 100 IPs per request) — bulk isn't available on Free at all. Enterprise (unlimited requests) adds a custom SLA and dedicated support. City/postal/lat-lon precision is included at every tier, including Free. POST /v1/keys issues a Free-tier key (1,000 requests/day, usage tracking via GET /v1/keys/usage?key=X) — see pricing to upgrade.

Both, when geo_precision allows it. Your own IP (GET /v1/ip) always gets city-level data from the edge network you're connecting through. Explicit IP lookups (GET /v1/ip/:ip) get city-level data when that IP falls inside the city-level dataset's coverage; otherwise geo_precision drops to country and city/state/lat/lon return null.

Add ?lang= to any request with one of: pt, fr, de, zh-TW, ko, zh-CN, ja-JP, es-ES, ar-SA, hi-IN (en is the default). This localizes country_name and continent into the target language. Field names and threat data stay in English regardless of locale.

Yes — GET /v1/email/:email checks syntax, a live MX record lookup, and disposable/temporary-domain detection against a synced blocklist. Free, no signup. Try the Email Checker.

Yes — GET /v1/phone/:number parses any E.164 or national-format number for validity, country, region, and line type (mobile, landline, or VoIP) against a synced MCC/MNC carrier dataset. Try the Phone Number Checker.

GET /v1/fraud-score combines IP threat signals, email deliverability, phone validity, and User-Agent bot detection into one fused 0–100 risk score — the one thing none of the major standalone IP-intelligence APIs offer. All four inputs are optional; a signal you don't pass is simply absent, not scored as clean. Try the Fraud Score Checker.

Yes — GET /v1/language identifies the language of any text across 76 languages via local trigram-frequency analysis. No text is sent to a third-party vendor or AI model, and nothing is logged. Try the Language Detector.

Yes — GET /v1/currency/convert and GET /v1/currency/rates expose the same daily exchange-rate feed that already powers exchange_rate_usd on every IP/country lookup, covering 154 currencies, plus GET /v1/currency/history for 90-day historical rates. Try the Currency Converter.

Yes — GET /v1/weather returns current conditions for any place name, postal code, or coordinate pair; add &detail=1 for an hourly outlook and 3-day forecast. The homepage's own-IP weather widget and the Weather Lookup tool both use it.

Yes — GET /v1/trademark/:serial proxies USPTO's TSDR API for live case status by 8-digit serial number. Case-status text is a U.S. government work and public domain, so every response carries a source/attribution field; trademark logo/image data is deliberately out of scope. Registration-number lookup isn't supported — only the serial-number path is documented by USPTO today. Try the Trademark Lookup tool.

Yes — GET /v1/patent/:number proxies USPTO's live Patent File Wrapper API for grant status by 7-8 digit utility patent number. Coverage starts at applications filed in 2001, and the data is prosecution/bibliographic (filing date, status, inventors, attorney of record) — not a citation graph, patent family, or legal-status field the way Lens.org, Espacenet, or Google Patents show. Design, plant, and reissue patents aren't supported yet. Try the Patent Lookup tool.

A single request — GET /v1/search/:query. It detects whether you typed an IP, ASN, country code, email, or phone number, then fans out server-side to every relevant check (IP lookup, RPKI, company, whois, carrier, hosted domains, places) in parallel. One search only draws one request against your daily rate-limit budget, not one per feature.

Yes — GET /v1/ip/:ip/rpki (and the explicit GET /v1/rpki?asn=&prefix= form) resolves route-origin validation live via RIPEstat, which aggregates ROA data from all five RIRs. Status is only ever valid, invalid, or unknown — never inferred from any other signal. Try the RPKI Validator.

GET /v1/ip/:ip/company combines RDAP registrant data with the IP's own ASN organization name into one categorical confidence (high/medium/low/none) — a single "who owns this" verdict. GET /v1/ip/:ip/whois returns the underlying RDAP record itself instead: the network block, allocation type, registration dates, and every registrant/admin/abuse contact on file, closer to classic WHOIS output. Try IP to Company or IP Whois.

Best-effort, and only for IPs already classified as mobile networks. GET /v1/ip/:ip/carrier fuzzy-matches the ASN's organization name against an MCC/MNC operator directory scoped to the IP's country. There is deliberately no single carrier: "X" field — a bare name would read as a live per-subscriber claim the data can't honestly support. Try the IP to Mobile Carrier tool.

GET /v1/ip/:ip/hosted-domains finds domains via the IP's reverse-DNS hostname plus certificate-transparency logs (crt.sh) — it is not a general reverse-IP lookup. The response's own limitations field spells out what it structurally can't see: IPs with no PTR record, unrelated domains on shared hosting, and domains that were never CT-logged. Try Hosted Domains.

GET /v1/places/:ip reverse-geocodes an IP's existing city-level location, then returns nearby points of interest (restaurants, parks, schools, transit), notable landmarks, local crime data where a source exists (UK and US only), and an optional on-demand driving commute estimate when you supply a destination. Try Nearby.

connection_type on GET /v1/ip/:ip is a single best-effort label — mobile, datacenter, or unknown — derived from the same ASN classification as the flags object. It replaces device-count/NAT-based connection detection, which isn't something a Cloudflare Worker can observe (no raw TCP/IP packet access) — so rather than fake it, unclassified ASNs honestly return unknown.

Yes, as a premium layer on top of the always-free local check. GET /v1/phone/:number still runs the free local validation first (format, region, line type — unchanged, see the previous question) and, budget permitting, adds live carrier, original_carrier, is_ported, a phone_type classification, and a locality-level phone_region and country_prefix from our real-time carrier-lookup provider. A full country_name display name is included regardless of tier, and is localized via ?lang=/Accept-Language exactly like every other endpoint's country_name field — check the response's lang/lang_source to see which language was actually applied. The response's source field tells you which tier answered: "premium" or "local".

100 premium lookups per IP address per month on the Free tier, 1,000/month per API key on Pro, and 5,000/month on Enterprise — see pricing. This is separate from, and on top of, the existing free local phone-lookup budget (100/day on Free), which has no monthly cap of its own.

Nothing breaks. GET /v1/phone/:number falls back seamlessly to the free local engine for the rest of the month — you still get a full 200 response with format, region, and line-type data, just without the live carrier/is_ported fields (which come back null and source: "local"). No errors, no signup required to keep using the free tier.

They're two independent classifications from two different engines, kept separate on purpose rather than merged. line_type comes from the always-free local check (its own enum, e.g. MOBILE, FIXED_LINE, PREMIUM_RATE). phone_type only appears when source is "premium" and uses the carrier-lookup provider's own categories: mobile, fixed_line, voip, toll_free, premium_rate, shared_cost, personal_number, pager, uan, voicemail, or unknown. premium_rate is worth watching specifically if you're using this for fraud signals — premium-rate numbers (billed at a higher per-minute rate than a normal line) are a common vector for international revenue-share fraud (IRSF), and this endpoint surfaces that classification directly rather than only flagging VoIP.

Only when a premium lookup actually runs (i.e. your monthly budget in the previous question isn't exhausted) — the free local check never leaves ipto.to's own Cloudflare Workers. When a premium lookup does run, the number is sent to our carrier-lookup provider solely to answer that one request; we don't store the provider's API key anywhere reachable from a public request, and per ipto.to's standard logging policy (see About) we don't log query history ourselves either.

Every day at 00:00 UTC. A request over the limit returns HTTP 429 with a Retry-After header and a retry_after_seconds field telling you exactly how long until the window resets.

Call POST /v1/keys for an instant Free-tier key, or sign in — signing in creates an account on the Free tier automatically and shows your key and usage on the dashboard. Pro and Enterprise are upgrades from pricing.

In the X-API-Key header (preferred, since query strings can end up in logs) or as ?api_key= on the URL. Requests that carry a key are counted against that key's budget instead of your IP's. Check a key's usage with GET /v1/keys/usage?key=X.

Mostly. A search-bar search or an MCP tool call is one request even when it fans out to several checks server-side. Bulk calls are charged per item — each IP in POST /v1/ip/bulk and each number in a bulk phone lookup counts individually. Nearby (places) and premium phone lookups also have their own separate budgets on top of the general one.

No. ipto doesn't log the IP addresses you look up, store query history, or build profiles; only aggregate request counts are kept for capacity planning. Your homepage search history and starred lookups live only in your own browser. Details are on the privacy page.

Yes. The API is CORS-enabled, versioned under /v1/, and returns stable JSON. The Free tier is meant for individuals and light use (1,000 requests/day); for production traffic use a Pro key (100,000/day) or Enterprise (unlimited, with a custom SLA). See pricing and the status page for live health.