Skip to content

IP lookup

Request

Use this endpoint to get geolocation, network, mobile carrier, time zone, currency, and threat intelligence data for a public IPv4 or IPv6 address. Threat intelligence includes Tor, VPN, proxy, and datacenter usage, blocklists, and risk scores.

This endpoint is available only with an API key. It is not available for form-token authentication or test mode requests.

Each successful request is charged. A request that ends with an error is not charged.

Our system caches the response for 7 days. A repeated request for the same IP address in this period returns the same data, including threat and time_zone.current_time as they were at the first request. A repeated request is also charged.

A field without data has the value null.

Security
API-Key
Path
ipstringrequired

Public IPv4 or IPv6 address, for example 8.8.8.8 or 2001:4860:4860::8888.

Private, loopback, link-local, carrier-grade NAT, multicast, and reserved addresses are rejected.

Examples:
IPv4 address
8.8.8.8
IPv6 address
2001:4860:4860::8888
curl -i -X GET \
  https://api.kycaid.com/services/ip-lookup/8.8.8.8 \
  -H 'API-Key: YOUR_API_KEY_HERE'

Responses

OK

The request was successful, and our system returned an expected response.

Bodyapplication/json
dataobjectrequired
errorsArray of anyrequired

Empty array in a successful response

Example:
[]
Response
{
  "data": {
    "ip": "8.8.8.8",
    "is_eu": false,
    "city": "Mountain View",
    "region": "California",
    "region_code": "CA",
    "region_type": "state",
    "country_name": "United States",
    "country_code": "US",
    "continent_name": "North America",
    "continent_code": "NA",
    "latitude": 37.386,
    "longitude": -122.0838,
    "postal": "94035",
    "calling_code": "1",
    "flag": "https://ipdata.co/flags/us.png",
    "emoji_flag": "🇺🇸",
    "emoji_unicode": "U+1F1FA U+1F1F8",
    "carrier": {
      "name": "Verizon Wireless",
      "mcc": "311",
      "mnc": "480"
    },
    "currency": {
      "name": "US Dollar",
      "code": "USD",
      "symbol": "$",
      "native": "$",
      "plural": "US dollars"
    },
    "time_zone": {
      "name": "America/Los_Angeles",
      "abbr": "PDT",
      "offset": "-0700",
      "is_dst": true,
      "current_time": "2026-09-28T05:12:40-07:00"
    },
    "threat": {
      "is_tor": false,
      "is_vpn": false,
      "is_icloud_relay": false,
      "is_proxy": false,
      "is_datacenter": true,
      "is_anonymous": false,
      "is_known_attacker": false,
      "is_known_abuser": false,
      "is_threat": false,
      "is_bogon": false,
      "blocklists": [
        {
          "name": "Spamhaus DROP",
          "site": "https://www.spamhaus.org/drop/",
          "type": "spam"
        }
      ],
      "scores": {
        "vpn_score": 0,
        "proxy_score": 0,
        "threat_score": 0,
        "trust_score": 90
      }
    },
    "asn": {
      "asn": "AS15169",
      "name": "Google LLC",
      "domain": "google.com",
      "route": "8.8.8.0/24",
      "type": "business"
    },
    "asn_advanced": {
      "name": "Google LLC",
      "domain": "google.com",
      "usage": "business",
      "ipv4_prefixes": [
        "8.8.8.0/24"
      ],
      "ipv6_prefixes": [
        "2001:4860::/32"
      ],
      "num_ips": "17408",
      "registry": "ARIN",
      "country": "US",
      "date": "2000-03-30",
      "status": "assigned",
      "upstream": [
        "AS3356"
      ],
      "downstream": [
        "AS36040"
      ],
      "peers": [
        "AS174"
      ]
    },
    "company": {
      "name": "Google LLC",
      "domain": "google.com",
      "network": "8.8.8.0/24",
      "type": "business"
    }
  },
  "errors": []
}