IP Insights
Threat Detection & Risk Scoring
Real-time IP threat and risk intelligence that empowers security teams, engineers, and developers to detect fraud, classify connection types, enrich traffic decisions, and act on threat signals, all via a single API backed by 30+ intelligence sources.
14-day free trial. No credit card required. Includes 100 free credits.
Want to explore live data?
IP Insights Response
Risk Intelligence
IP Metadata
Geolocation
WHOIS / ASN
- 4849 ALPHA RD.
- DALLAS
- TX
- 75244
- UNITED STATES
- ARMONK
- NY
- US
- 10504-1722
WHOIS Contacts
Provider Trust
Blocklist
8-Dimension IP Intelligence
Every IP analyzed across risk scoring, connection type, threat and blocklist status, trusted provider recognition, geolocation, WHOIS and ASN ownership, reverse DNS, and a real-time developer API.
Explainable Risk Report
Every IP receives a normalized risk score with the specific reasons behind it, so your security and fraud teams can prioritize review and route decisions with confidence.
- Normalized risk score from 200 (safest) to 1,000 (riskiest) across five levels: lowest, low, medium, high, and highest
- Up to 3 ranked reason codes per analysis explaining exactly why an IP was flagged (for example ip-blocklisted, tor-exit-node, open-proxy, vpn)
- Weighted scoring that combines blocklist status, abuse reports, connection type, geography, reverse DNS, and WHOIS completeness into one actionable number
- Minimum score floors for dangerous patterns: blocklisted IPs, Tor exit nodes, and open proxies are guaranteed to surface as high risk
- Trusted provider recognition applies a scoring reduction so known enterprise and ZTNA traffic is not penalized
- Optional scoring: request risk analysis on demand, or fetch enrichment-only responses when a score is not needed
Connection Type Classification
Classifies how an IP connects to the internet, so you can tell residential traffic apart from anonymized, hosted, or high-risk connections instantly.
- 8 connection types: wired, mobile, enterprise, satellite, cloud provider, VPN, open proxy, and Tor
- Tor exit node detection sourced from Tor Project feeds
- Open proxy detection from continuously collected proxy feeds
- VPN identification across a broad set of commercial VPN providers
- Satellite network detection by ASN, including Starlink, Viasat, Hughes, Eutelsat, and Inmarsat
- Priority-based detection that resolves overlapping signals in a deterministic order
Threat & Blocklist Intelligence
Checks each IP against aggregated abuse and threat feeds, revealing whether it has a history of spam, malicious activity, or abuse reports.
- Aggregated status from curated DNS-based blocklists (DNSBL/RBL) covering spam and abuse activity
- Intelligence for harvester, spam server, and dictionary attacker activity
- Community threat intelligence for recently reported malicious IPs
- Active abuse report counts and the number of distinct source types that flagged the IP
- Last detected timestamp so you can weigh recent activity more heavily than stale reports
- Part of 30+ continuously updated threat intelligence sources feeding the platform
Trusted Provider Recognition
Identifies IPs that belong to known trusted providers, so legitimate enterprise and Zero Trust traffic is not mistaken for a threat.
- Zero Trust Network Access (ZTNA) recognition for providers including Zscaler, Cloudflare Access, Palo Alto Networks, Okta, and Netskope
- Enterprise and major infrastructure provider identification (Akamai, Cisco, Microsoft, and more)
- Provider name and provider type returned so you can build allowlists and routing rules
- Trusted status applies a risk score reduction to reduce false positives on corporate traffic
- ZTNA connections are classified as enterprise to keep policy decisions clean
Geolocation Intelligence
Resolves where an IP is located using a multitude of techniques, including triangulation across a global network of over 12,000 probes, so you can power geofencing, localization, and geography-aware risk decisions.
- Continent, country (code, name, and short name), region, city, and postal code
- Latitude and longitude coordinates for mapping and distance checks
- Timezone, international phone code, currency code, and spoken languages
- Domain extension hint for the registered country
- Location derived from multiple techniques, including triangulation across a network of 12,000+ measurement probes
- Continuously refreshed reference and routing data rather than crowd-sourced guesses
WHOIS & ASN Ownership
Reveals who owns an IP and which network operates it, giving your team the transparency needed for investigation, escalation, and abuse reporting.
- Regional Internet Registry source across all 5 RIRs: ARIN, RIPE, APNIC, LACNIC, and AFRINIC
- Autonomous System Number (ASN) with AS name and description
- Organization ownership details for the IP block
- Abuse, admin, and technical contact addresses for escalation
Reverse DNS & Host Verification
Resolves the hostname behind an IP to confirm origin legitimacy and surface impersonation attempts, without ever blocking your request.
- Real-time reverse DNS (PTR) resolution of the host behind the IP
- Hostname signals feed connection type detection (for example ZTNA, cloud, and Tor host patterns)
- Missing reverse DNS is factored into the risk score as a weak-signal indicator
Real-Time API & Developer Experience
Delivers all of this intelligence through a single REST API with pre-computed data, so you get sub-second responses with no external lookups at request time.
- Full IPv4 and IPv6 support with the same response shape
- Pre-computed intelligence: no external API calls at request time
- Single request returns geolocation, connection type, WHOIS, blocklist status, trusted provider, and optional risk report
- SDKs in Node.js, Python, PHP, and Java plus a documented REST API
- Clear, structured error responses for malformed requests, invalid IPs, and unregistered addresses
14-day free trial. No credit card required. Includes 100 free credits.
Use Cases for IP Insights
Threat Detection & Fraud Prevention
Proactive Risk Detection: Instantly detect risky IP addresses and decide how to handle them to help reduce malicious activity and protect your network.
Fraud Detection: Identify potential fraud in real-time through accurate IP risk reporting and anomaly detection.
Risk Intelligence & Data Integrity
Real-Time Risk Assessment: Evaluate IP addresses in real time against 30+ intelligence sources, ensuring accurate threat classification, reduced false positives, and improved decision confidence.
Automated Data Cleansing: Automatically validate, enrich, and correct IP-related data, maximizing accuracy and reliability for decision-making.
Compliance & Threat Audit Support
Regulatory Compliance: Effectively manage IP-related data to comply with data protection regulations, providing clear documentation for audits and compliance purposes.
Comprehensive Reporting: Generate detailed analytics on IP address risks, threats, and validations, ensuring transparency across your organization.
Geolocation & Localization
Geofencing: Effectively implement geolocation-based policies, providing accurate localized content and restricting access where necessary.
Personalized Experiences: Deliver content tailored to specific locations, increasing relevance, user satisfaction, and customer trust.
Infrastructure Optimization
Traffic Management: Use IP analytics to effectively manage network traffic, optimize resources, and enhance overall infrastructure efficiency.
Load Balancing and Network Efficiency: Leverage precise IP data to intelligently distribute traffic, improving service reliability and resource utilization.
Security, Operations & Developers Covered
We offer the most commonly used programming languages SDKs. Check out our documentation to facilitate easier setup.
{
"ipAddress": "74.86.209.74",
"ipAddressNumber": 1247203658,
"ipType": "IPv4",
"ipCidr": "74.86.0.0/16",
"connectionType": "cloud-provider",
"hostReverse": "4a.d1.564a.ip4.static.sl-reverse.com",
"geo": {
"continent": "NA",
"countryCode": "US",
"countryName": "United States",
"countryShortName": "United States",
"city": "Dallas",
"currencyCode": "USD",
"domainExtension": ".us",
"languages": "en-US,es-US,haw,fr",
"latitude": 32.78306,
"longitude": -96.80667,
"phoneIntCode": "1",
"region": "Texas",
"timezone": "America/Chicago"
},
"whois": {
"rir": "ARIN",
"asn": {
"asnId": "AS36351"
},
"organization": {
"orgId": "IBMC-24",
"orgName": "IBM CLOUD",
"address": [
"4849 ALPHA RD.",
"DALLAS",
"TX",
"75244",
"UNITED STATES",
"ARMONK",
"NY",
"US",
"10504-1722"
],
"country": "US"
},
"abuseContact": {
"contactId": "ABUSE1025-ARIN",
"name": "ABUSE",
"phone": [
"+1-214-442-0605"
],
"email": [
"abuse@softlayer.com"
]
},
"adminContact": {
"contactId": "IPADM258-ARIN",
"name": "IP ADMIN",
"phone": [
"+1-214-442-0600"
],
"email": [
"ipadmin@softlayer.com"
]
},
"techContact": {
"contactId": "IPADM258-ARIN",
"name": "IP ADMIN",
"phone": [
"+1-214-442-0600"
],
"email": [
"ipadmin@softlayer.com"
]
}
},
"trustedProvider": {
"isKnownProvider": false
},
"blocklisted": {
"isBlockListed": true,
"sources": 437,
"activeReports": 67610159104,
"lastDetected": "2026-09-28T12:01:56.004Z"
},
"riskReport": {
"score": 900,
"level": "highest",
"baseAnalysis": [
"ip-blocklisted",
"active-abuse-reports",
"multiple-blocklist-sources"
]
}
}
import { IPInsights } from '@opportify/sdk-nodejs';
const clientIpInsights = new IPInsights({
version: '1.0',
apiKey: 'YOUR-API-KEY-HERE'
});
async function analyzeIP() {
try {
const response = await clientIpInsights.analyze({
ip: '8.8.8.8',
enableAI: true // only available for paid plans.
});
console.log('response', response);
} catch (error: unknown) {
console.error('error', error);
}
}
analyzeIP();
use Opportify\Sdk\IpInsights;
$ipInsights = new IpInsights("<YOUR-KEY-HERE>");
$params = [
"ip" => "3.1.122.82",
"enableAi" => true
];
$result = $ipInsights->analyze($params);
// Import classes:
import ai.opportify.client.ApiClient;
import ai.opportify.client.ApiException;
import ai.opportify.client.Configuration;
import ai.opportify.client.auth.*;
import ai.opportify.client.model.*;
import ai.opportify.client.api.IpInsightsApi;
public class Example {
public static void main(String[] args) {
ApiClient defaultClient = Configuration.getDefaultApiClient();
defaultClient.setBasePath("https://api.opportify.ai/insights/v1");
// Configure API key authorization: opportifyToken
ApiKeyAuth opportifyToken = (ApiKeyAuth) defaultClient.getAuthentication("opportifyToken");
opportifyToken.setApiKey("YOUR API KEY");
IpInsightsApi apiInstance = new IpInsightsApi(defaultClient);
AnalyzeIpRequest analyzeIpRequest = new AnalyzeIpRequest();
analyzeIpRequest.ip("8.8.8.8");
analyzeIpRequest.enableAI(true); // only available for paid plans.
try {
AnalyzeIp200Response result = apiInstance.analyzeIp(analyzeIpRequest);
System.out.println(result);
} catch (ApiException e) {
System.err.println("Exception when calling IpInsightsApi#analyzeIP");
System.err.println("Status code: " + e.getCode());
System.err.println("Reason: " + e.getResponseBody());
System.err.println("Response headers: " + e.getResponseHeaders());
e.printStackTrace();
}
}
}
from opportify_sdk import IpInsights
# Initialize the wrapper with your API key
api_key = "<YOUR-API-KEY-HERE>"
ip_insights = IpInsights(api_key)
# Optional: Configure host, version, and debug mode
ip_insights.set_version("v1")
# Define request parameters
params = {
"ip": "<SOME-IP-HERE>",
"enableAi": True
}
# Call the API
try:
result = ip_insights.analyze(params)
print("Response:", result)
except Exception as e:
print(f"Error: {e}")
Rapidly Expanding Integrations Ecosystem
As a dynamic startup, we're committed to rapidly expanding the integration ecosystem. Our API integrations merge the power of proprietary Insights products with industry-leading platforms. Join us on this exciting journey of growth and innovation, with new and exciting integrations coming your way!
Frequently asked questions
What is IP Insights?
- Explainable risk scoring
- Connection type classification
- Threat and blocklist intelligence
- Trusted provider recognition
- Geolocation, WHOIS, and ASN ownership
How does the Explainable Risk Report work?
The report also returns up to three ranked reason codes that explain exactly why an IP was scored the way it was, such as
ip-blocklisted, tor-exit-node, or open-proxy. Risk scoring is returned on demand when you request it, so you can also fetch enrichment-only responses when a score is not needed.What connection types can IP Insights detect?
- Wired (standard ISP or residential)
- Mobile
- Enterprise
- Satellite (including Starlink, Viasat, and Hughes)
- Cloud provider
- VPN
- Open proxy
- Tor
How does IP Insights check for threats and blocklists?
The response tells you whether the IP is blocklisted, how many active abuse reports exist, how many distinct source types flagged it, and when it was last detected. This is part of 30+ threat intelligence sources that continuously feed the platform.
What is trusted provider recognition?
When an IP is a trusted provider, its risk score is reduced so that legitimate corporate traffic is not treated as a threat. The response includes the provider name and type so you can build allowlists and routing rules.
Can IP Insights identify the geographic location of an IP?
- Continent, country, region, and city
- Postal code and latitude/longitude
- Timezone and international phone code
- Currency code and spoken languages
What WHOIS and ownership data is included?
- Autonomous System Number (ASN), AS name, and description
- Organization ownership details
- Abuse, admin, and technical contacts for escalation
Does IP Insights support IPv6?
How fast is IP Insights, and does it call external services?
The underlying threat, geolocation, and ownership data is refreshed continuously so lookups stay both fast and current.
How do I integrate IP Insights with my systems?
A single request returns geolocation, connection type, WHOIS, blocklist status, trusted provider recognition, and an optional risk report. See the pricing page for current plans and included credits.
Who benefits most from IP Insights?
- Security teams: Identify risky connections and act on threat signals across 8 connection types and 30+ sources.
- Developers: Pre-computed intelligence with no external calls at runtime and sub-second responses.
- E-commerce and SaaS providers: Protect signups and checkout from fraudulent or anonymized traffic.
- Operations and compliance teams: Enrich IP databases with geolocation and WHOIS from 5 RIR databases.