# IP Geolocation API with Threat Intelligence: ipdata (`nabeelbaghoor/ip-geolocation-threat-intelligence-api`) Actor

IP geolocation and threat intelligence from the ipdata API: country, city, coordinates, ASN, company, mobile carrier, time zone, currency, VPN, proxy, Tor and datacenter flags, blocklists and IP reputation scores, plus bulk lookups and Advanced ASN profiles. Bring your own key.

- **URL**: https://apify.com/nabeelbaghoor/ip-geolocation-threat-intelligence-api.md
- **Developed by:** [Nabeel Hassan](https://apify.com/nabeelbaghoor) (community)
- **Categories:** Developer tools, Business, Integrations
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $6.00 / 1,000 ip lookup returneds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## IP Geolocation API with Threat Intelligence: ipdata

Look up the location, network owner and threat profile of any IP address through the ipdata API with your own API key, as one clean dataset row per IP or ASN.

ipdata is an IP intelligence API that returns city level geolocation, ASN and company data, mobile carrier, time zone, currency and languages, plus threat intelligence: Tor, VPN, iCloud Private Relay, proxy and datacenter detection, known attacker and abuser flags, 100+ blocklists and machine learning IP reputation scores. This actor wraps its documented API on api.ipdata.co (and the EU endpoint eu-api.ipdata.co), so you can enrich sign up logs, block fraud and free trial abuse, localise content, and feed IP data into CRMs, SIEM tools, BI dashboards, Google Sheets or AI agents. Bring your own API key.

BYOK, not live tested: every route, parameter and field comes from the ipdata documentation at docs.ipdata.co, and the routes were probed on 2026-10-24 with an invalid key. The actor has not been run against a live ipdata key.

### What it does

- **IP lookup**: country, region, city, postal code, latitude and longitude, continent, EU flag, calling code, flag, ASN (number, name, domain, route, usage type), company, mobile carrier (name, MCC, MNC), time zone with current time, currency, languages and the full threat object for each IP. Pick only the fields you need.
- **Bulk IP lookup**: the same record for up to 100 IPs per request, for large log files and lists (paid ipdata plans).
- **Threat intelligence**: is_tor, is_vpn, is_icloud_relay, is_proxy, is_datacenter, is_anonymous, is_known_attacker, is_known_abuser, is_threat and is_bogon, the blocklists the IP appears on, and the vpn, proxy, threat and trust scores from 0 to 100.
- **Company lookup**: the organisation an IP network is assigned to, with its domain, network prefix and usage type (hosting, isp, edu, gov, mil, business).
- **ASN lookup**: the Advanced ASN profile with name, domain, usage, IPv4 and IPv6 prefixes, number of IPs, registry, country, allocation date, status, upstreams, downstreams and peers.
- **EU data residency**: switch to the EU endpoint to keep the IPs you send on EU servers.
- **Pay only for results**: private, reserved, invalid and refused lookups are recorded as a free row that says why, never charged.

### How to use it

1. Sign up at dashboard.ipdata.co and copy the API key shown on the dashboard. Bulk lookups, company data, VPN flags, reputation scores and the ASN API need the paid plans named below.
2. Paste the key into the API key field (or set the DATA_API_KEY secret). It is sent only to ipdata in the api-key query parameter and is removed from everything the actor logs.
3. Pick a mode, add IP addresses or AS numbers, and start the run. Download the rows as JSON, CSV or Excel, or call the actor from your own code.

A missing or rejected key, an exhausted quota or a plan that does not cover the chosen mode ends the run cleanly with a status message that says what to change.

### Input

| Field | Modes | Description |
| --- | --- | --- |
| `mode` | all | `ipLookup` (default), `bulkLookup`, `threatLookup`, `companyLookup` or `asnLookup` |
| `ips` | IP, bulk, threat, company | Public IPv4 or IPv6 addresses, one per line |
| `asns` | ASN lookup | AS numbers such as AS15169 or 15169 |
| `fields` | IP lookup | Optional list of response fields, such as city, country_code, asn, threat |
| `endpoint` | all | `global` (api.ipdata.co) or `eu` (eu-api.ipdata.co) |
| `maxResults` | all | Most rows to return and charge for |
| `requestsPerMinute` | all | Pacing for calls to ipdata |
| `apiKey` | all | Your ipdata API key (secret) |

### Output

Every row keeps every field ipdata returns, plus flat columns that are easy to filter: `ip`, `country_code`, `country_name`, `city`, `asNumber`, `asName`, `asDomain`, `asRoute`, `usageType`, `companyName`, `companyDomain`, `companyNetwork`, `carrierName`, `timeZoneName`, `isThreat`, `isAnonymous`, `isVpn`, `isProxy`, `isTor`, `isDatacenter`, `isKnownAttacker`, `isKnownAbuser`, `isBogon`, `trustScore`, `threatScore`, `vpnScore`, `proxyScore` and `blocklistNames`. A refused lookup has `found` set to false and a `note` with ipdata's own words.

Example IP lookup row (values from the ipdata documentation samples):

```json
{
    "mode": "ipLookup",
    "modeLabel": "IP lookup",
    "recordType": "ipRecord",
    "query": "2.2.2.2",
    "found": true,
    "ip": "2.2.2.2",
    "country_code": "FR",
    "country_name": "France",
    "city": null,
    "asNumber": "AS3215",
    "asName": "Orange S.A.",
    "asDomain": "orange.com",
    "asRoute": "2.2.0.0/16",
    "usageType": "isp",
    "carrierName": "Orange",
    "timeZoneName": "Europe/Paris",
    "isThreat": false,
    "isAnonymous": false,
    "isVpn": false,
    "isProxy": false,
    "isTor": false,
    "isDatacenter": false,
    "trustScore": 100,
    "threatScore": 1,
    "blocklistNames": [],
    "is_eu": true,
    "continent_name": "Europe",
    "latitude": 48.8582,
    "longitude": 2.3387,
    "asn": { "asn": "AS3215", "name": "Orange S.A.", "domain": "orange.com", "route": "2.2.0.0/16", "type": "isp" },
    "carrier": { "name": "Orange", "mcc": "208", "mnc": "01" },
    "currency": { "name": "Euro", "code": "EUR", "symbol": "€", "native": "€", "plural": "euros" },
    "time_zone": { "name": "Europe/Paris", "abbr": "CET", "offset": "+0100", "is_dst": false },
    "threat": { "is_tor": false, "is_vpn": false, "is_proxy": false, "is_datacenter": false, "is_threat": false, "blocklists": [], "scores": { "vpn_score": 0, "proxy_score": 0, "threat_score": 1, "trust_score": 100 } },
    "count": "370577",
    "retrievedAt": "2026-10-24T12:00:00.000Z",
    "note": null
}
```

Threat rows carry the threat flags, `blocklistNames` and the four scores. Company rows carry `companyName`, `companyDomain`, `companyNetwork` and `usageType`. ASN rows carry `asNumber`, `asName`, `asDomain`, `usageType` and the full profile with `ipv4_prefixes`, `ipv6_prefixes`, `num_ips`, `upstream`, `downstream` and `peers`.

### Pricing

| Event | Price | Charged for |
| --- | --- | --- |
| `ip-lookup` | 0.006 USD | Each IP looked up, single or bulk |
| `threat-check` | 0.005 USD | Each IP threat intelligence record |
| `company-lookup` | 0.005 USD | Each IP to company record |
| `asn-profile` | 0.01 USD | Each Advanced ASN profile |

Private, reserved, invalid, unknown and refused lookups are never charged. Your ipdata plan and quota are billed separately by ipdata.

### FAQ

#### What is the ipdata API?

ipdata is an IP geolocation and threat intelligence API run by ipdata LLC. One call to api.ipdata.co returns the location, ASN, company, mobile carrier, time zone, currency and threat profile of an IPv4 or IPv6 address, backed by 14 AWS regions, with a separate EU endpoint for data residency.

#### Do I need my own ipdata API key?

Yes. This is a bring your own key actor: it calls ipdata with your key, under your plan, its quota and its terms. Get the key from the ipdata dashboard at dashboard.ipdata.co.

#### Can I use the free ipdata tier with this actor?

Technically yes for the IP, threat and single field lookups, but ipdata's terms say free accounts are only for testing and development and may not be used in a commercial product. Bulk lookups, company data and the ASN API need a paid plan, and VPN detection, reputation scores and commercial blocklists need the Business plan or above.

#### How do I detect VPN, proxy and Tor users?

Run Threat intelligence (or IP lookup with the threat field) on the IPs. Filter on `isVpn`, `isProxy`, `isTor`, `isAnonymous` or `isDatacenter`, and use `trustScore` (60 to 100 low risk, 40 to 60 moderate, below 40 high risk) for IPs that are not on any blocklist yet.

#### How do I geolocate a large list of IP addresses?

Use Bulk IP lookup: the actor sends up to 100 IPs per request and accepts up to 10,000 IPs per run. Each IP still counts as one request against your ipdata quota, and the run log reports your 24 hour request count as ipdata returns it.

#### Can I find which company owns an IP address?

Yes. Company lookup returns the end user organisation an IP network is assigned to (ipdata covers about 2.7 million companies across 11 million subnets) with its domain, network prefix and usage type. It needs the Startup plan or above.

#### How fresh is the threat data?

ipdata says its threat data changes every 15 minutes and is published hourly, and IP allocation changes are checked daily. Each row carries `retrievedAt`, so schedule the actor to keep threat flags current.

#### What do I pay?

Pay per result: 0.005 USD per threat or company record, 0.006 USD per full IP lookup and 0.01 USD per ASN profile. Refused and invalid lookups are free. See the pricing table above.

### Keyword map

IP geolocation API, IP lookup API, IP to location, IP to country, IP to city, IP threat intelligence API, VPN detection API, proxy detection, Tor exit node detection, datacenter IP detection, IP reputation score, IP blocklist check, IP to company, IP to ASN, ASN lookup API, mobile carrier lookup, bulk IP geolocation, fraud prevention IP data, ipdata API, ipdata IP lookup, ipdata threat data.

### Licensing and data use

This actor works only with your own ipdata account and API key. The ipdata Terms of Service say free accounts are only intended for testing and development and may not be used in a commercial product; use a paid plan for production or commercial work. The licence ipdata grants is personal, non assignable and non exclusive. The terms set no limit on how long you may keep results. This actor is not affiliated with or endorsed by ipdata.

# Actor input Schema

## `mode` (type: `string`):

IP lookup returns the full ipdata record per IP (location, ASN, company, carrier, time zone, currency and threat data). Bulk IP lookup sends up to 100 IPs per request and needs a paid plan. Threat intelligence and Company lookup call the single field routes. ASN lookup reads the Advanced ASN API (paid plans).

## `ips` (type: `array`):

IP, bulk, threat and company modes. One public IPv4 or IPv6 address per line. Private and reserved addresses are refused by the API and never charged.

## `asns` (type: `array`):

ASN lookup only. One AS number per line, such as AS15169 or 15169.

## `fields` (type: `array`):

IP lookup only, optional. Only these fields come back (the IP is always included). Empty means every field your plan returns.

## `endpoint` (type: `string`):

The global endpoint api.ipdata.co, or the EU endpoint eu-api.ipdata.co, which keeps the IP addresses you send on EU servers (Frankfurt, Paris and Ireland).

## `maxResults` (type: `integer`):

The most rows this run returns and charges for.

## `requestsPerMinute` (type: `integer`):

Pacing for calls to ipdata. Throttled calls are retried after a pause. A bulk request of 100 IPs counts as one call here and as 100 requests against your ipdata quota.

## `apiKey` (type: `string`):

Your own ipdata API key, from the dashboard at dashboard.ipdata.co. Stored as a secret and sent only to ipdata in the api-key query parameter; it is never logged. You can instead set the DATA_API_KEY environment secret.

## Actor input object example

```json
{
  "mode": "ipLookup",
  "ips": [
    "8.8.8.8"
  ],
  "endpoint": "global",
  "maxResults": 100,
  "requestsPerMinute": 300
}
```

# Actor output Schema

## `records` (type: `string`):

One row per IP address or AS number the chosen mode returns.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "ips": [
        "8.8.8.8"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("nabeelbaghoor/ip-geolocation-threat-intelligence-api").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "ips": ["8.8.8.8"] }

# Run the Actor and wait for it to finish
run = client.actor("nabeelbaghoor/ip-geolocation-threat-intelligence-api").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "ips": [
    "8.8.8.8"
  ]
}' |
apify call nabeelbaghoor/ip-geolocation-threat-intelligence-api --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,nabeelbaghoor/ip-geolocation-threat-intelligence-api"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/ZDxYXVcI8NfmmVQZN/builds/Vh5et6leMYja3TI5W/openapi.json