Every field. 10 groups.
One IP lookup.

Name: GeoIPHub API
Availability: InStock
Author: GeoIPHub

Every GeoIPHub lookup returns the same complete response: IP geolocation, ASN routing, WHOIS, network evidence, anonymizer detection, threat flags, and an explainable risk score. No field paywall, the free tier returns every field a paid plan does.

Start free Read the API docs

9
Response groups: 99.9%
Uptime: <50ms
Median response

GET /v1/lookup?ip=203.0.113.42200 OK

{
"ip": "203.0.113.42",
"geo": { "city": "Amsterdam", "geo_confidence": 0.92 },
"asn": { "asn": "AS14061", "connection_type": "datacenter" },
"detection": { "is_vpn": true, "vpn_provider": "NordVPN" },
"threat": { "is_abusive": true, "threat_types": ["proxy"] },
"scoring": { "fraud_score": 87, "recommended_action": "block" }
}

What you actually get per lookup

One REST call returns nine response groups. Every group, every field, on every plan.

The address you asked about, echoed back as IPv4 or IPv6.

ip

asn

Who routes this IP and what kind of network it is, from a BGP/ASN table refreshed every 3 days.

asn · org · asn_type · isp · domain · connection_type

Datacenter IP check

geo

Country, region, city, coordinates, and timezone, with geo_confidence instead of false certainty.

country_code · country_name · region · city · timezone · latitude · longitude · geo_confidence

IP Geolocation

whois

Registration intelligence from RDAP across all 5 RIRs: netname, allocation status, registration dates, scanned for 46 VPN and 27 hosting keywords.

org · country · netname · status · registered · last_changed · has_vpn_keywords · has_hosting_keywords

Methodology

network

What the wire shows: open ports from active probes, the published abuse contact, and the cloud region.

abuse_contact · open_ports · service · cloud_region

detection

VPN, proxy, Tor, hosting, and relay flags verified by real protocol handshakes, with the VPN provider named when its own server list says so.

is_vpn · is_proxy · is_tor · is_hosting · is_relay · is_anonymous · proxy_type · anonymity_level · vpn_provider · vpn_provider_tier · vpn_confidence · proxy_score · last_seen

VPN & Proxy Detection

threat

Seven threat flags from named daily feeds, plus verified crawler and AI-bot identification from 9 official IP-range feeds.

is_abusive · is_spammer · is_scanner · is_botnet · is_crawler · is_bogon · is_cgnat · threat_types · dnsbl_sources · crawler{} · botnet{} · honeypot{}

Threat Intelligence

scoring

An explainable 0 to 100 fraud score from 40+ weighted signals, a recommended action, and the exact signals that fired.

fraud_score · confidence · recommended_action · detection_methods

IP Risk Scoring