--- title: "Get IP intelligence from client request" method: GET path: "/api/v1/ip" tags: ["IP Geolocation & Security API"] --- # Get IP intelligence from client request `GET /api/v1/ip` Automatically analyzes the client's IP address from HTTP request headers for comprehensive intelligence gathering. **IP Detection Strategy**: 1. **X-Real-IP Header**: Preferred for load balancers and reverse proxies 2. **X-Forwarded-For**: First non-private IP in the chain 3. **RemoteAddr**: Direct connection IP (fallback) **Analysis Includes**: - Precise geolocation with city-level accuracy - Real-time timezone calculation with DST detection - Comprehensive security threat assessment - Network classification (residential, datacenter, mobile) - ISP and organization identification **Use Cases**: - User session fraud detection - Content personalization by location - Timezone-aware application behavior - Real-time security monitoring **Privacy**: No personal information is logged or stored ## Response `200` IP intelligence gathered successfully with complete analysis - IpInfoV1Dto — Comprehensive IP address intelligence response containing geolocation, security analysis, and network information. Provides detailed analysis including precise location data, threat intelligence assessment, timezone information, and network classification for fraud prevention and security applications. **Data Sources**: Global threat intelligence feeds, geolocation databases, ISP registries **Update Frequency**: Real-time threat data, weekly geolocation updates - `ip` string, required — The IP address that was analyzed, returned in standard format. **Normalization Applied**: - IPv4: Standard dotted decimal notation - IPv6: Compressed format when possible - Case normalization for IPv6 **Note**: Returned format may differ from input due to standardization - `isp` string, nullable — Internet Service Provider name derived from the ASN organization field. - `asn` string, nullable — Autonomous System Number in AS format. - `suspicious_factors` SuspiciousFactorsV1Dto, required — Comprehensive security threat assessment and suspicious activity indicators. Contains boolean flags for various types of potentially malicious or suspicious network behavior, enabling fine-grained security decision making. **Detection Methods**: - Machine learning classification models - Real-time threat intelligence feeds - Behavioral pattern analysis - Network fingerprinting techniques - `is_proxy` boolean, required — Indicates if the IP address is operating as a proxy server. **Proxy Types Detected**: - HTTP/HTTPS proxies (transparent, anonymous, elite) - SOCKS proxies (v4/v5) - Residential proxy services - Data center proxy pools **Detection Accuracy**: 99.5% with < 0.1% false positive rate **Risk Level**: Medium to High (depends on proxy type) **Use Cases**: Fraud prevention, content protection, geo-compliance - `is_tor_node` boolean, required — Indicates if the IP address is part of the Tor anonymity network. **Node Types Detected**: - Tor exit nodes (highest risk) - Tor relay nodes (medium risk) - Tor bridge nodes (medium risk) **Data Source**: Real-time Tor consensus data updated every hour **Risk Level**: High - Often blocked due to anonymization **Detection Confidence**: 100% (official Tor directory) - `is_spam` boolean, required — Indicates if the IP address has been associated with spam or malicious email activity. **Activity Types Detected**: - Email spam campaigns - Phishing email sources - Malware distribution via email - Compromised email servers - Botnet email activity **Risk Level**: High - Strong indicator of malicious intent **Data Sources**: Multiple global spam databases and threat feeds **Update Frequency**: Real-time with hourly consolidation - `is_crawler` boolean, required — Indicates if the IP address is identified as a web crawler, scraper, or automated bot. **Bot Types Detected**: - Search engine crawlers (Google, Bing, etc.) - Social media bots - Content scrapers - Price monitoring bots - SEO analysis tools **Risk Level**: Low to Medium (legitimate vs. malicious crawlers) **Use Cases**: Rate limiting, content protection, analytics filtering **Note**: Includes both legitimate and potentially harmful automated traffic - `is_datacenter` boolean, required — Indicates if the IP address originates from a datacenter or cloud hosting environment. **Infrastructure Types**: - Major cloud providers (AWS, GCP, Azure, etc.) - Dedicated server hosting - Virtual private servers (VPS) - Colocation facilities - Content delivery networks (CDN) **Risk Level**: Medium - Less likely to be genuine residential users **Use Cases**: Bot detection, user verification, residential filtering **Coverage**: 5000+ hosting providers globally - `is_vpn` boolean, required — Indicates if the IP address belongs to a VPN (Virtual Private Network) service. **VPN Types Detected**: - Commercial VPN providers (NordVPN, ExpressVPN, etc.) - Corporate VPN gateways - Self-hosted VPN servers (OpenVPN, WireGuard) - Mobile VPN applications **Detection Methods**: - ISP classification analysis - Traffic pattern recognition - Known VPN server databases **Risk Level**: Medium - Privacy tool but can indicate location spoofing **Database Coverage**: 2000+ VPN providers with 50M+ IP ranges - `is_threat` boolean, required — Indicates if the IP address has been flagged as an active security threat. **Threat Categories**: - Malware command & control servers - Botnet participants - Attack source IPs (DDoS, bruteforce) - Phishing and fraud infrastructure - Compromised devices and servers **Risk Level**: Very High - Immediate security concern **Data Sources**: Global threat intelligence partnerships **Response Recommendation**: Block or apply enhanced scrutiny **Update Frequency**: Real-time threat feed integration - `location` LocationV1Dto, required — Comprehensive geographic location and timezone intelligence for an IP address. Provides detailed location data including administrative regions, precise coordinates, timezone information, and real-time local time calculations with daylight saving awareness. **Geolocation Accuracy**: - Country: 99.8% accuracy - Region/State: 95% accuracy - City: 85-95% accuracy (varies by region and population density) - Coordinates: Median accuracy radius of ~50km **Data Sources**: Multiple commercial and open geolocation databases - `country` string, nullable — Full country name where the IP address is geolocated. **Language**: English country names using ISO 3166-1 standard **Coverage**: All 249 countries and territories **Null when**: IP address cannot be geolocated (private ranges, invalid IPs) **Examples**: "United States", "United Kingdom", "Germany", "Japan\" - `country_code` string, nullable — ISO 3166-1 alpha-2 country code (two-letter country identifier). **Standard**: ISO 3166-1 alpha-2 (official country codes) **Format**: Two uppercase letters **Null when**: Country cannot be determined **Examples**: "US", "GB", "DE", "JP", "CA", "AU" **Use Cases**: Country-based filtering, compliance rules, localization - `city` string, nullable — City or municipality name where the IP address is located. **Accuracy**: 85-95% depending on region (higher in developed countries) **Language**: English city names with local variations **Null when**: City cannot be determined or IP is in rural area **Examples**: "New York", "London", "Tokyo", "San Francisco" **Note**: May include districts or boroughs for large metropolitan areas - `latitude` number, double, nullable — Latitude coordinate of the estimated IP address location in decimal degrees. **Format**: Decimal degrees (-90.0 to 90.0) **Precision**: Up to 6 decimal places **Accuracy**: Median radius of ~50km from actual location **Coordinate System**: WGS84 (World Geodetic System 1984) **Positive values**: North of equator **Negative values**: South of equator **Null when**: Location cannot be determined - `longitude` number, double, nullable — Longitude coordinate of the estimated IP address location in decimal degrees. **Format**: Decimal degrees (-180.0 to 180.0) **Precision**: Up to 6 decimal places **Accuracy**: Median radius of ~50km from actual location **Coordinate System**: WGS84 (World Geodetic System 1984) **Positive values**: East of Prime Meridian **Negative values**: West of Prime Meridian **Null when**: Location cannot be determined - `zip` string, nullable — Postal or ZIP code for the IP address location. **Format**: Country-specific postal code formats **Availability**: Varies by country (high coverage in US/Canada/Europe) **Accuracy**: Generally accurate to postal district level **Null when**: Postal code not available or cannot be determined **Examples**: - US: "94105", "10001" - UK: "SW1A 1AA", "M1 1AA" - Canada: "K1A 0A6" - Germany: "10115\" - `timezone` string, nullable — IANA timezone identifier for the IP address location. **Format**: IANA Time Zone Database format (Area/Location) **Examples**: "America/New_York", "Europe/London", "Asia/Tokyo" **Null when**: Timezone cannot be determined **Use Cases**: - Localized time display - Business hours calculation - Scheduling applications - Regulatory compliance (trading hours, etc.) - `local_time` string, nullable — Current local time at the IP address location in ISO 8601 format. **Format**: ISO 8601 with timezone offset (YYYY-MM-DDTHH:mm:ssZ) **Calculation**: Real-time based on system clock and timezone data **DST Aware**: Automatically adjusts for daylight saving time **Null when**: Timezone information not available **Examples**: - "2023-06-21T14:30:00-07:00" (PDT) - "2023-06-21T22:30:00+01:00" (BST) - "2023-06-22T07:30:00+09:00" (JST) - `local_time_unix` integer, nullable — Current local time as Unix timestamp (seconds since epoch). **Format**: Integer seconds since January 1, 1970 00:00:00 UTC **Precision**: Second-level accuracy **Timezone**: Adjusted to local timezone (not UTC) **Null when**: Timezone information not available **Use Cases**: - Programming language datetime conversion - Database timestamp storage - Cross-platform time synchronization **Example**: 1687385400 represents "2023-06-21T14:30:00-07:00\" - `is_daylight_savings` boolean, nullable — Indicates whether the location is currently observing daylight saving time. **True**: Location is currently in daylight saving time (summer time) **False**: Location is in standard time (winter time) **Null**: Timezone information not available OR location doesn't observe DST **DST Regions**: North America, Europe, parts of Australia, etc. **Non-DST Regions**: Most of Asia, Africa, South America **Update Frequency**: Real-time calculation based on current date and timezone rules **Use Cases**: Business hours calculation, scheduling, compliance ## Other responses - `400` — Bad Request - Unable to extract valid IP address from request headers - `422` — Unprocessable Entity - Private IP address cannot be geolocated - `429` — Too Many Requests - Rate limit exceeded (check X-RateLimit-* headers) - `500` — Internal Server Error - Geolocation service temporarily unavailable --- [API](https://skmtc.dev/ip-api/apis/ip-api-io-ip-geolocation-security-api.md) · [All operations](https://skmtc.dev/ip-api/apis/ip-api-io-ip-geolocation-security-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ip-api/ip-api-io-ip-geolocation-security-api/revisions/a6862f586bf3/schema)