IP Geolocation API with Threat Intelligence: ipdata

Look up the location, network owner and threat profile of any IP address through the ipdata API with your own API key, as one clean dataset row per IP or ASN.

ipdata is an IP intelligence API that returns city level geolocation, ASN and company data, mobile carrier, time zone, currency and languages, plus threat intelligence: Tor, VPN, iCloud Private Relay, proxy and datacenter detection, known attacker and abuser flags, 100+ blocklists and machine learning IP reputation scores. This actor wraps its documented API on api.ipdata.co (and the EU endpoint eu-api.ipdata.co), so you can enrich sign up logs, block fraud and free trial abuse, localise content, and feed IP data into CRMs, SIEM tools, BI dashboards, Google Sheets or AI agents. Bring your own API key.

BYOK, not live tested: every route, parameter and field comes from the ipdata documentation at docs.ipdata.co, and the routes were probed on 2026-10-24 with an invalid key. The actor has not been run against a live ipdata key.

What it does

• IP lookup: country, region, city, postal code, latitude and longitude, continent, EU flag, calling code, flag, ASN (number, name, domain, route, usage type), company, mobile carrier (name, MCC, MNC), time zone with current time, currency, languages and the full threat object for each IP. Pick only the fields you need.
• Bulk IP lookup: the same record for up to 100 IPs per request, for large log files and lists (paid ipdata plans).
• Threat intelligence: is_tor, is_vpn, is_icloud_relay, is_proxy, is_datacenter, is_anonymous, is_known_attacker, is_known_abuser, is_threat and is_bogon, the blocklists the IP appears on, and the vpn, proxy, threat and trust scores from 0 to 100.
• Company lookup: the organisation an IP network is assigned to, with its domain, network prefix and usage type (hosting, isp, edu, gov, mil, business).
• ASN lookup: the Advanced ASN profile with name, domain, usage, IPv4 and IPv6 prefixes, number of IPs, registry, country, allocation date, status, upstreams, downstreams and peers.
• EU data residency: switch to the EU endpoint to keep the IPs you send on EU servers.
• Pay only for results: private, reserved, invalid and refused lookups are recorded as a free row that says why, never charged.

How to use it

1. Sign up at dashboard.ipdata.co and copy the API key shown on the dashboard. Bulk lookups, company data, VPN flags, reputation scores and the ASN API need the paid plans named below.
2. Paste the key into the API key field (or set the DATA_API_KEY secret). It is sent only to ipdata in the api-key query parameter and is removed from everything the actor logs.
3. Pick a mode, add IP addresses or AS numbers, and start the run. Download the rows as JSON, CSV or Excel, or call the actor from your own code.

A missing or rejected key, an exhausted quota or a plan that does not cover the chosen mode ends the run cleanly with a status message that says what to change.

Input

Field	Modes	Description
mode	all	ipLookup (default), bulkLookup, threatLookup, companyLookup or asnLookup
ips	IP, bulk, threat, company	Public IPv4 or IPv6 addresses, one per line
asns	ASN lookup	AS numbers such as AS15169 or 15169
fields	IP lookup	Optional list of response fields, such as city, country_code, asn, threat
endpoint	all	global (api.ipdata.co) or eu (eu-api.ipdata.co)
maxResults	all	Most rows to return and charge for
requestsPerMinute	all	Pacing for calls to ipdata
apiKey	all	Your ipdata API key (secret)

Output

Every row keeps every field ipdata returns, plus flat columns that are easy to filter: ip, country_code, country_name, city, asNumber, asName, asDomain, asRoute, usageType, companyName, companyDomain, companyNetwork, carrierName, timeZoneName, isThreat, isAnonymous, isVpn, isProxy, isTor, isDatacenter, isKnownAttacker, isKnownAbuser, isBogon, trustScore, threatScore, vpnScore, proxyScore and blocklistNames. A refused lookup has found set to false and a note with ipdata's own words.

Example IP lookup row (values from the ipdata documentation samples):

{
    "mode": "ipLookup",
    "modeLabel": "IP lookup",
    "recordType": "ipRecord",
    "query": "2.2.2.2",
    "found": true,
    "ip": "2.2.2.2",
    "country_code": "FR",
    "country_name": "France",
    "city": null,
    "asNumber": "AS3215",
    "asName": "Orange S.A.",
    "asDomain": "orange.com",
    "asRoute": "2.2.0.0/16",
    "usageType": "isp",
    "carrierName": "Orange",
    "timeZoneName": "Europe/Paris",
    "isThreat": false,
    "isAnonymous": false,
    "isVpn": false,
    "isProxy": false,
    "isTor": false,
    "isDatacenter": false,
    "trustScore": 100,
    "threatScore": 1,
    "blocklistNames": [],
    "is_eu": true,
    "continent_name": "Europe",
    "latitude": 48.8582,
    "longitude": 2.3387,
    "asn": { "asn": "AS3215", "name": "Orange S.A.", "domain": "orange.com", "route": "2.2.0.0/16", "type": "isp" },
    "carrier": { "name": "Orange", "mcc": "208", "mnc": "01" },
    "currency": { "name": "Euro", "code": "EUR", "symbol": "€", "native": "€", "plural": "euros" },
    "time_zone": { "name": "Europe/Paris", "abbr": "CET", "offset": "+0100", "is_dst": false },
    "threat": { "is_tor": false, "is_vpn": false, "is_proxy": false, "is_datacenter": false, "is_threat": false, "blocklists": [], "scores": { "vpn_score": 0, "proxy_score": 0, "threat_score": 1, "trust_score": 100 } },
    "count": "370577",
    "retrievedAt": "2026-10-24T12:00:00.000Z",
    "note": null
}

Threat rows carry the threat flags, blocklistNames and the four scores. Company rows carry companyName, companyDomain, companyNetwork and usageType. ASN rows carry asNumber, asName, asDomain, usageType and the full profile with ipv4_prefixes, ipv6_prefixes, num_ips, upstream, downstream and peers.

Pricing

Event	Price	Charged for
ip-lookup	0.006 USD	Each IP looked up, single or bulk
threat-check	0.005 USD	Each IP threat intelligence record
company-lookup	0.005 USD	Each IP to company record
asn-profile	0.01 USD	Each Advanced ASN profile

Private, reserved, invalid, unknown and refused lookups are never charged. Your ipdata plan and quota are billed separately by ipdata.

FAQ

What is the ipdata API?

ipdata is an IP geolocation and threat intelligence API run by ipdata LLC. One call to api.ipdata.co returns the location, ASN, company, mobile carrier, time zone, currency and threat profile of an IPv4 or IPv6 address, backed by 14 AWS regions, with a separate EU endpoint for data residency.

Do I need my own ipdata API key?

Yes. This is a bring your own key actor: it calls ipdata with your key, under your plan, its quota and its terms. Get the key from the ipdata dashboard at dashboard.ipdata.co.

Can I use the free ipdata tier with this actor?

Technically yes for the IP, threat and single field lookups, but ipdata's terms say free accounts are only for testing and development and may not be used in a commercial product. Bulk lookups, company data and the ASN API need a paid plan, and VPN detection, reputation scores and commercial blocklists need the Business plan or above.

How do I detect VPN, proxy and Tor users?

Run Threat intelligence (or IP lookup with the threat field) on the IPs. Filter on isVpn, isProxy, isTor, isAnonymous or isDatacenter, and use trustScore (60 to 100 low risk, 40 to 60 moderate, below 40 high risk) for IPs that are not on any blocklist yet.

How do I geolocate a large list of IP addresses?

Use Bulk IP lookup: the actor sends up to 100 IPs per request and accepts up to 10,000 IPs per run. Each IP still counts as one request against your ipdata quota, and the run log reports your 24 hour request count as ipdata returns it.

Can I find which company owns an IP address?

Yes. Company lookup returns the end user organisation an IP network is assigned to (ipdata covers about 2.7 million companies across 11 million subnets) with its domain, network prefix and usage type. It needs the Startup plan or above.

How fresh is the threat data?

ipdata says its threat data changes every 15 minutes and is published hourly, and IP allocation changes are checked daily. Each row carries retrievedAt, so schedule the actor to keep threat flags current.

What do I pay?

Pay per result: 0.005 USD per threat or company record, 0.006 USD per full IP lookup and 0.01 USD per ASN profile. Refused and invalid lookups are free. See the pricing table above.

Keyword map

IP geolocation API, IP lookup API, IP to location, IP to country, IP to city, IP threat intelligence API, VPN detection API, proxy detection, Tor exit node detection, datacenter IP detection, IP reputation score, IP blocklist check, IP to company, IP to ASN, ASN lookup API, mobile carrier lookup, bulk IP geolocation, fraud prevention IP data, ipdata API, ipdata IP lookup, ipdata threat data.

Licensing and data use

This actor works only with your own ipdata account and API key. The ipdata Terms of Service say free accounts are only intended for testing and development and may not be used in a commercial product; use a paid plan for production or commercial work. The licence ipdata grants is personal, non assignable and non exclusive. The terms set no limit on how long you may keep results. This actor is not affiliated with or endorsed by ipdata.