API documentation

A JSON API over HTTPS for IP addresses, AS numbers, networks and organisations. No SDK needed.

Base URL: https://ip-fd.net/api/v1. All responses are JSON encoded as UTF-8. Cross-origin requests are allowed, so the API can be called from a browser.

Authentication

Requests work without a key at a low rate. For higher limits, create a key on the API keys page and send it in a header:

curl -H "X-API-Key: ipfd_your_key" https://ip-fd.net/api/v1/ip/193.0.6.139

Authorization: Bearer ipfd_your_key works as well. Passing the key as ?key= is supported but not recommended, because URLs end up in logs.

Rate limits

  • Without a key: 100 requests per minute per IP address.
  • With a free key: 500 requests per minute and 10,000 requests per day.
  • After the daily quota is used up, the key falls back to the anonymous limit until midnight UTC.

Every response carries RateLimit and RateLimit-Policy headers. A 429 response means you should wait before retrying. Need more? Contact us.

Errors

Errors use standard HTTP status codes and a JSON body with an error message:

HTTP/1.1 404 Not Found
{ "error": "AS4294967200 is not in our registry data." }

400 invalid input, 401 invalid key, 403 suspended account, 404 not found, 429 rate limited, 5xx server error.

All endpoints

Lookups answer from our stored data. The only outside request made while you wait is the abuse report check on calls with an API key, and only when no recent result is stored. Single fields such as /me/ip or /ip/{address}/city return plain text (add ?format=json for JSON).

Open Example under an endpoint for code in cURL, Node.js, Python, PHP and Go, and to see a response. The examples show only what the endpoint needs: the API key header appears where a key is required. To use your key elsewhere for higher limits, add the header X-API-Key: YOUR_KEY. The language you pick is remembered for every example.

Your own address

GET /api/v1/me
Full lookup of the address you call from. Try
Example
curl "https://ip-fd.net/api/v1/me"
Runs the request above from your browser.
GET /api/v1/me/ip
Only your IP address, as plain text. Add ?format=json for JSON. Try
Example
curl "https://ip-fd.net/api/v1/me/ip"
Runs the request above from your browser.
GET /api/v1/me/country
Your country code (also country-name, region, city, coordinates). Try
Example
curl "https://ip-fd.net/api/v1/me/country"
Runs the request above from your browser.
GET /api/v1/me/city
Your city. Try
Example
curl "https://ip-fd.net/api/v1/me/city"
Runs the request above from your browser.
GET /api/v1/me/asn
Your AS number (also as-name, org, network, route). Try
Example
curl "https://ip-fd.net/api/v1/me/asn"
Runs the request above from your browser.
GET /api/v1/me/location
Your location as JSON with accuracy and source. Try
Example
curl "https://ip-fd.net/api/v1/me/location"
Runs the request above from your browser.
GET /api/v1/me/{field}
Any single field, see the list below.
Example
curl "https://ip-fd.net/api/v1/me/city"
Runs the request above from your browser.

IP address

GET /api/v1/ip/{address}
Full lookup: registration, routing, RPKI, location, flags and abuse contact. Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139"
Runs the request above from your browser.
GET /api/v1/ip/{address}/{field}
One field: ip, version, country, country-name, region, city, coordinates, location, asn, as-name, org, network, route, netname, description, registry, abuse, flags, rpki, hosting, vpn, tor, proxy. Usage type fields are listed under Usage type. Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/city"
Runs the request above from your browser.
GET /api/v1/ip/{address}/history
Changes to the holder, routing, RPKI state and location of the /24 or /48. Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/history"
Runs the request above from your browser.
GET /api/v1/ip/{address}/reputation
Spamhaus ZEN listing and AbuseIPDB reports we already have (no live AbuseIPDB call). Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/reputation"
Runs the request above from your browser.
GET /api/v1/ip/{address}/reputation/stream
All 18 DNS blocklists, streamed as Server-Sent Events.
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/reputation/stream"
Runs the request above from your browser.
GET /api/v1/ip/{address}/abuseipdb
Stored AbuseIPDB result for the address, if any.
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/abuseipdb"
Runs the request above from your browser.
POST /api/v1/bulk
Many addresses in one request (25 without a key, 500 with a key): {"ips": ["1.1.1.1", ...]}.
Example
curl -X POST "https://ip-fd.net/api/v1/bulk" \
  -H "Content-Type: application/json" \
  -d '{"ips":["193.0.6.139","2001:67c:2e8:22::c100:68b"]}'
Sends the example body from your browser.

Usage type

GET /api/v1/ip/{address}/usage-type
Usage type code as plain text, for example DCH or ISP/MOB. Add ?format=json for JSON. Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/usage-type"
Runs the request above from your browser.
GET /api/v1/ip/{address}/usage-type-name
Usage type name, for example Data Center/Web Hosting/Transit. Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/usage-type-name"
Runs the request above from your browser.
GET /api/v1/ip/{address}/usage
Usage type as JSON: code, name, source, confidence and every true/false check. Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/usage"
Runs the request above from your browser.
GET /api/v1/me/usage-type
Usage type of your own address (also /me/usage-type-name and /me/usage). Try
Example
curl "https://ip-fd.net/api/v1/me/usage-type"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/datacenter
true, false or unknown. Data center, web hosting or transit (DCH). Alias: hosting. Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/datacenter"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/residential
true, false or unknown. Home or mobile internet access (ISP or MOB, and not DCH, CDN or SES). Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/residential"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/isp
true, false or unknown. Fixed line ISP (ISP). Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/isp"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/mobile
true, false or unknown. Mobile ISP (MOB). Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/mobile"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/commercial
true, false or unknown. Business network (COM). Alias: business. Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/commercial"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/organization
true, false or unknown. Organization (ORG). Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/organization"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/government
true, false or unknown. Government (GOV). Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/government"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/military
true, false or unknown. Military (MIL). Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/military"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/education
true, false or unknown. University, college or school (EDU). Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/education"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/library
true, false or unknown. Library (LIB). Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/library"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/cdn
true, false or unknown. Content delivery network (CDN). Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/cdn"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/search-engine
true, false or unknown. Search engine spider (SES). Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/search-engine"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/reserved
true, false or unknown. Reserved address space (RSV). Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/reserved"
Runs the request above from your browser.
GET /api/v1/ip/{address}/is/suspicious
true or false: data center range, many abuse reports, or a listed VPN, Tor or proxy address. Add ?format=json for the reasons. Try
Example
curl "https://ip-fd.net/api/v1/ip/193.0.6.139/is/suspicious"
Runs the request above from your browser.
GET /api/v1/me/is/{type}
Any of the checks above for your own address. Try
Example
curl "https://ip-fd.net/api/v1/me/is/residential"
Runs the request above from your browser.
GET /api/v1/usage-types
All usage type codes and checks as JSON. Try
Example
curl "https://ip-fd.net/api/v1/usage-types"
Runs the request above from your browser.

Allow or block

GET /api/v1/check/{address}
One answer: allow or block, with the reasons. Follows your own access rules when called with an API key. Add ?format=text for only the word. Try
Example
curl "https://ip-fd.net/api/v1/check/193.0.6.139"
Runs the request above from your browser.
POST /api/v1/check/bulk
Up to 100 addresses: {"ips": ["193.0.6.139", ...]}. Every address counts as one request.
Example
curl -X POST "https://ip-fd.net/api/v1/check/bulk" \
  -H "Content-Type: application/json" \
  -d '{"ips":["193.0.6.139","2001:67c:2e8:22::c100:68b"]}'
Sends the example body from your browser.
GET /api/v1/account/access
Your allow and block list and what you chose to block.
Example
curl "https://ip-fd.net/api/v1/account/access" \
  -H "X-API-Key: YOUR_KEY"
Needs an API key, so this is an example response.
{
  "settings": {
    "block_datacenter": true,
    "block_vpn": true,
    "block_tor": true,
    "block_proxy": true,
    "block_abuse": true,
    "abuse_score": 25
  },
  "rules": [
    {
      "id": 4,
      "target": "192.0.2.0/24",
      "action": "allow",
      "note": "Office",
      "created_at": "2026-10-08T09:00:00.000Z"
    }
  ]
}
POST /api/v1/account/access/rules
Add or change an entry: {"target": "192.0.2.0/24", "action": "allow", "note": "Office"}.
Example
curl -X POST "https://ip-fd.net/api/v1/account/access/rules" \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"target":"192.0.2.0/24","action":"allow","note":"Office"}'
Needs an API key, so this is an example response.
{
  "ok": true,
  "target": "192.0.2.0/24",
  "action": "allow"
}
DELETE /api/v1/account/access/rules/{id}
Remove an entry.
Example
curl -X DELETE "https://ip-fd.net/api/v1/account/access/rules/1" \
  -H "X-API-Key: YOUR_KEY"
Needs an API key, so this is an example response.
{
  "ok": true
}
POST /api/v1/account/access/settings
What to block: {"block_datacenter": true, "block_vpn": true, "block_tor": true, "block_proxy": true, "block_abuse": true, "abuse_score": 25}.
Example
curl -X POST "https://ip-fd.net/api/v1/account/access/settings" \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"block_datacenter":true,"block_vpn":true,"block_tor":true,"block_proxy":true,"block_abuse":true,"abuse_score":25}'
Needs an API key, so this is an example response.
{
  "ok": true
}

Custom endpoints

GET /api/v1/custom/{id}/{address}
Your own endpoint, created on the dashboard: true or false for your conditions, or JSON with only the fields you chose. Counts as two requests. Works only with your own API key.
Example
curl "https://ip-fd.net/api/v1/custom/1/193.0.6.139" \
  -H "X-API-Key: YOUR_KEY"
Needs an API key, so this is an example response.
{
  "country": "DK",
  "asn": 3292,
  "rpki": "valid",
  "match": true
}

AS numbers

GET /api/v1/asn/{asn}
Holder, prefixes, neighbours, RPKI, health and WHOIS. Try
Example
curl "https://ip-fd.net/api/v1/asn/3333"
Runs the request above from your browser.
GET /api/v1/asn/{asn}/prefixes
Announced IPv4 and IPv6 prefixes with counts. Try
Example
curl "https://ip-fd.net/api/v1/asn/3333/prefixes"
Runs the request above from your browser.
GET /api/v1/asn/{asn}/neighbours
Upstreams, downstreams and peers (also /upstreams, /downstreams, /peers). Try
Example
curl "https://ip-fd.net/api/v1/asn/3333/neighbours"
Runs the request above from your browser.
GET /api/v1/asn/{asn}/graph
Upstreams and their upstreams, as nodes and edges. Try
Example
curl "https://ip-fd.net/api/v1/asn/3333/graph"
Runs the request above from your browser.
GET /api/v1/asn/{asn}/health
Network health score, grade and checks. Try
Example
curl "https://ip-fd.net/api/v1/asn/3333/health"
Runs the request above from your browser.
GET /api/v1/asn/{asn}/rating
Overall rating: position among all AS numbers, score 0 to 100 and the six components. Also in the asn field of every IP lookup. Try
Example
curl "https://ip-fd.net/api/v1/asn/3333/rating"
Runs the request above from your browser.
GET /api/v1/asn/{asn}/rpki
RPKI state per announced prefix. Try
Example
curl "https://ip-fd.net/api/v1/asn/3333/rpki"
Runs the request above from your browser.
GET /api/v1/asn/{asn}/changes
Prefix and neighbour changes in the last 30 days. Try
Example
curl "https://ip-fd.net/api/v1/asn/3333/changes"
Runs the request above from your browser.
GET /api/v1/asn/{asn}/whois
Registry record as text. Try
Example
curl "https://ip-fd.net/api/v1/asn/3333/whois"
Runs the request above from your browser.
GET /api/v1/asn/{asn}/name
Display name, plain text (also /country). Try
Example
curl "https://ip-fd.net/api/v1/asn/3333/name"
Runs the request above from your browser.

Networks, organisations and domains

GET /api/v1/network/{prefix}
Registry network with parents, children and origin. Try
Example
curl "https://ip-fd.net/api/v1/network/193.0.0.0/21"
Runs the request above from your browser.
GET /api/v1/org/{handle}
Organisation with its AS numbers and networks. Try
Example
curl "https://ip-fd.net/api/v1/org/ORG-RIEN1-RIPE"
Runs the request above from your browser.
GET /api/v1/domain/{name}
Addresses, mail, name servers, SPF, DMARC and CAA of a domain. Try
Example
curl "https://ip-fd.net/api/v1/domain/ripe.net"
Runs the request above from your browser.
GET /api/v1/search?q={name}
AS numbers and organisations by name. Try
Example
curl "https://ip-fd.net/api/v1/search?q=hetzner"
Runs the request above from your browser.

Countries, routing and RPKI

GET /api/v1/countries
Address space and AS numbers per country. Try
Example
curl "https://ip-fd.net/api/v1/countries"
Runs the request above from your browser.
GET /api/v1/country/{code}
One country with its largest networks. Try
Example
curl "https://ip-fd.net/api/v1/country/dk"
Runs the request above from your browser.
GET /api/v1/rpki/validate?asn={asn}&prefix={prefix}
RFC 6811 origin validation. Try
Example
curl "https://ip-fd.net/api/v1/rpki/validate?asn=3333&prefix=193.0.0.0/21"
Runs the request above from your browser.
GET /api/v1/outages
Current and recent routing outages of the largest networks per country. Try
Example
curl "https://ip-fd.net/api/v1/outages"
Runs the request above from your browser.
GET /api/v1/status
Service status and data freshness. Try
Example
curl "https://ip-fd.net/api/v1/status"
Runs the request above from your browser.

DNS and web tools

GET /api/v1/tools/propagation?name={domain}&type={type}
A record on 21 public resolvers worldwide. Try
Example
curl "https://ip-fd.net/api/v1/tools/propagation?name=ripe.net&type=A"
Runs the request above from your browser.
POST /api/v1/tools/email-headers
Analyze email headers: {"headers": "Received: ..."}. Hops, networks, delays, SPF, DKIM, DMARC.
Example
curl -X POST "https://ip-fd.net/api/v1/tools/email-headers" \
  -H "Content-Type: application/json" \
  -d '{"headers":"Received: from mail.example.com (mail.example.com [193.0.6.139]) by mx.example.net with ESMTPS; Thu, 8 Oct 2026 09:00:00 +0000\nFrom: alice@example.com\nTo: bob@example.net\nSubject: Hello\nAuthentication-Results: mx.example.net; spf=pass smtp.mailfrom=example.com"}'
Sends the example body from your browser.
GET /api/v1/tools/firewall?asn={asn}&format={format}
Firewall list for one or more AS numbers (comma separated) as plain text. format: plain, nginx, ipset, nftables, iptables, mikrotik. family: 4, 6 or both. Try
Example
curl "https://ip-fd.net/api/v1/tools/firewall?asn=AS3333&format=nginx&family=4"
Runs the request above from your browser.
POST /api/v1/tools/firewall
The same as JSON: {"asns": ["AS3333"], "format": "ipset", "family": "both", "name": "blocklist"}.
Example
curl -X POST "https://ip-fd.net/api/v1/tools/firewall" \
  -H "Content-Type: application/json" \
  -d '{"asns":["AS3333"],"format":"ipset","family":"both","name":"blocklist"}'
Sends the example body from your browser.
GET /api/v1/rankings/{category}
Top networks by rating, ipv4-addresses, ipv6-networks, peers, downstreams or upstreams. Add ?country=DE for one country. Try
Example
curl "https://ip-fd.net/api/v1/rankings/peers"
Runs the request above from your browser.
POST /api/v1/tools/traceroute
Trace the route from our server to a public address or hostname: {"target": "ripe.net"}. Hops with network, name, place and time. Our own first routers are returned without address.
Example
curl -X POST "https://ip-fd.net/api/v1/tools/traceroute" \
  -H "Content-Type: application/json" \
  -d '{"target":"ripe.net"}'
Example response.
{
  "mode": "server",
  "target": {
    "input": "ripe.net",
    "ip": "193.0.11.51",
    "hostname": "ripe.net"
  },
  "origin": {
    "label": "IP-FD.net",
    "country": "DE",
    "countryName": "Germany",
    "city": "Frankfurt am Main",
    "latitude": 50.11,
    "longitude": 8.68
  },
  "reached": true,
  "hops": [
    {
      "n": 1,
      "hidden": true,
      "label": "IP-FD.net",
      "ip": null,
      "hostname": null,
      "rtt": 0.4,
      "country": "DE",
      "city": "Frankfurt am Main"
    },
    {
      "n": 3,
      "hidden": false,
      "ip": "80.249.208.71",
      "hostname": "ams-ix.ripe.net",
      "rtt": 7.9,
      "asn": 3333,
      "asName": "RIPE-NCC-AS",
      "country": "NL",
      "countryName": "Netherlands",
      "city": "Amsterdam",
      "latitude": 52.37,
      "longitude": 4.89,
      "locationSource": "hostname",
      "approx": false
    }
  ],
  "summary": {
    "hops": 6,
    "answered": 6,
    "countries": [
      "DE",
      "NL"
    ],
    "networks": [
      {
        "asn": 3333,
        "name": "RIPE-NCC-AS"
      }
    ],
    "distanceKm": 364
  },
  "tracedAt": "2026-10-08T09:00:00.000Z"
}
POST /api/v1/tools/traceroute/parse
The same for traceroute, tracert or mtr output you send: {"text": "..."}.
Example
curl -X POST "https://ip-fd.net/api/v1/tools/traceroute/parse" \
  -H "Content-Type: application/json" \
  -d '{"text":" 1  192.168.1.1  0.4 ms\n 2  be3.cr1.cph.example.net (203.0.113.1)  4.8 ms\n 3  193.0.11.51  14.2 ms"}'
Sends the example body from your browser.
POST /api/v1/tools/prefix
Prefix tools: {"action": "aggregate|range|ipv6|reverse", "input": "..."}.
Example
curl -X POST "https://ip-fd.net/api/v1/tools/prefix" \
  -H "Content-Type: application/json" \
  -d '{"action":"aggregate","input":"193.0.0.0/22\n193.0.4.0/22"}'
Sends the example body from your browser.
POST /api/v1/dnsleak
Start a DNS leak test: returns names to look up.
Example
curl -X POST "https://ip-fd.net/api/v1/dnsleak"
Sends the example body from your browser.
GET /api/v1/dnsleak/{token}
Resolvers that looked up the test names, with their networks.
Example
curl "https://ip-fd.net/api/v1/dnsleak/k3v9x2m1"
Example response.
{
  "token": "k3v9x2m1",
  "resolvers": [
    {
      "ip": "2a00:1450:4001::1",
      "queries": 6,
      "clientSubnet": null,
      "first": "2026-10-08T09:00:00.000Z",
      "network": {
        "asn": 15169,
        "asName": "Google LLC",
        "org": "Google LLC",
        "network": "2a00:1450::/32",
        "country": "IE",
        "city": "Dublin",
        "flags": null
      }
    }
  ]
}
GET /api/v1/status-page/{slug}
Public status page of a user as JSON.
Example
curl "https://ip-fd.net/api/v1/status-page/acme"
Example response.
{
  "slug": "acme",
  "title": "Acme status",
  "updated": "2026-10-08T09:00:00.000Z",
  "monitors": [
    {
      "name": "Website",
      "type": "http",
      "target": null,
      "status": "up",
      "since": "2026-09-30T12:00:00.000Z",
      "lastChecked": "2026-10-08T09:00:00.000Z",
      "uptime24h": 100,
      "uptime30d": 99.98,
      "responseMs": 182,
      "days": [
        {
          "date": "2026-10-08",
          "uptime": 100
        }
      ]
    }
  ],
  "overall": "up"
}
POST /api/v1/dns/lookup
DNS records: {"domain": "example.com", "type": "MX"}.
Example
curl -X POST "https://ip-fd.net/api/v1/dns/lookup" \
  -H "Content-Type: application/json" \
  -d '{"domain":"ripe.net","type":"MX"}'
Sends the example body from your browser.
POST /api/v1/dns/mail
MX, SPF and DMARC check: {"domain": "example.com"}.
Example
curl -X POST "https://ip-fd.net/api/v1/dns/mail" \
  -H "Content-Type: application/json" \
  -d '{"domain":"ripe.net"}'
Sends the example body from your browser.
POST /api/v1/tools/ssl
TLS certificate: {"hostname": "example.com"}.
Example
curl -X POST "https://ip-fd.net/api/v1/tools/ssl" \
  -H "Content-Type: application/json" \
  -d '{"hostname":"ripe.net"}'
Sends the example body from your browser.
POST /api/v1/tools/http-headers
HTTP response headers: {"url": "https://example.com"}.
Example
curl -X POST "https://ip-fd.net/api/v1/tools/http-headers" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://www.ripe.net"}'
Sends the example body from your browser.
POST /api/v1/tools/blacklist
All DNS blocklists for one IPv4 address: {"ip": "192.0.2.10"}.
Example
curl -X POST "https://ip-fd.net/api/v1/tools/blacklist" \
  -H "Content-Type: application/json" \
  -d '{"ip":"193.0.6.139"}'
Sends the example body from your browser.
POST /api/v1/tools/subnet
Subnet calculator: {"cidr": "10.0.0.0/22"}.
Example
curl -X POST "https://ip-fd.net/api/v1/tools/subnet" \
  -H "Content-Type: application/json" \
  -d '{"cidr":"10.0.0.0/22"}'
Sends the example body from your browser.
POST /api/v1/tools/geofeed-check
Validate a geofeed: {"url": "https://..."} or {"content": "..."}.
Example
curl -X POST "https://ip-fd.net/api/v1/tools/geofeed-check" \
  -H "Content-Type: application/json" \
  -d '{"content":"193.0.0.0/21,NL,NL-NH,Amsterdam,"}'
Sends the example body from your browser.

Your account (API key required)

GET /api/v1/account/blocklists
Your blocklist watches with current listings.
Example
curl "https://ip-fd.net/api/v1/account/blocklists" \
  -H "X-API-Key: YOUR_KEY"
Needs an API key, so this is an example response.
{
  "watches": [
    {
      "id": 12,
      "user_id": 7,
      "target": "192.0.2.10",
      "label": "Mail",
      "active": 1,
      "last_checked": "2026-10-08T09:00:00.000Z",
      "last_manual": null,
      "created_at": "2026-09-01T10:00:00.000Z",
      "addresses": 1,
      "listings": [
        {
          "watch_id": 12,
          "ip": "192.0.2.10",
          "list": "Spamhaus ZEN",
          "response": "127.0.0.2",
          "listed_since": "2026-10-08T09:00:00.000Z"
        }
      ]
    }
  ]
}
POST /api/v1/account/blocklists
Watch an address: {"target": "192.0.2.10", "label": "Mail"}.
Example
curl -X POST "https://ip-fd.net/api/v1/account/blocklists" \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"target":"192.0.2.10","label":"Mail"}'
Needs an API key, so this is an example response.
{
  "ok": true,
  "id": 12,
  "target": "192.0.2.10",
  "addresses": 1
}
DELETE /api/v1/account/blocklists/{id}
Stop watching.
Example
curl -X DELETE "https://ip-fd.net/api/v1/account/blocklists/1" \
  -H "X-API-Key: YOUR_KEY"
Needs an API key, so this is an example response.
{
  "ok": true
}
GET /api/v1/account/bgp/watches
Your BGP watches.
Example
curl "https://ip-fd.net/api/v1/account/bgp/watches" \
  -H "X-API-Key: YOUR_KEY"
Needs an API key, so this is an example response.
{
  "watches": [
    {
      "id": 3,
      "kind": "asn",
      "asn": 3333,
      "prefix": null,
      "label": "RIPE NCC",
      "allowed_origins": null,
      "active": 1,
      "created_at": "2026-09-01T10:00:00.000Z"
    }
  ]
}
POST /api/v1/account/bgp/watches
Watch an AS or prefix: {"target": "AS3333"} or {"target": "193.0.0.0/21", "allowed_origins": "3333"}.
Example
curl -X POST "https://ip-fd.net/api/v1/account/bgp/watches" \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"target":"AS3333"}'
Needs an API key, so this is an example response.
{
  "ok": true,
  "id": 3,
  "message": "Watching AS3333 and its 4 announced prefixes."
}
DELETE /api/v1/account/bgp/watches/{id}
Stop watching.
Example
curl -X DELETE "https://ip-fd.net/api/v1/account/bgp/watches/1" \
  -H "X-API-Key: YOUR_KEY"
Needs an API key, so this is an example response.
{
  "ok": true
}
GET /api/v1/account/bgp/events
Open alerts and the last 30 days.
Example
curl "https://ip-fd.net/api/v1/account/bgp/events" \
  -H "X-API-Key: YOUR_KEY"
Needs an API key, so this is an example response.
{
  "events": [
    {
      "id": 41,
      "watch_id": 3,
      "kind": "more_specific",
      "severity": "high",
      "prefix": "193.0.0.0/22",
      "origin_asn": 64500,
      "other_asn": 3333,
      "detail": "193.0.0.0/22 is announced by AS64500 inside 193.0.0.0/21 of AS3333.",
      "sample_path": "1299 64500",
      "peers": 12,
      "started_at": "2026-10-08T09:00:00.000Z",
      "last_seen": "2026-10-08T09:00:00.000Z",
      "resolved_at": null
    }
  ]
}
GET /api/v1/account/status-page
Your status page settings.
Example
curl "https://ip-fd.net/api/v1/account/status-page" \
  -H "X-API-Key: YOUR_KEY"
Needs an API key, so this is an example response.
{
  "page": {
    "user_id": 7,
    "slug": "acme",
    "title": "Acme status",
    "enabled": 1,
    "show_targets": 0,
    "updated_at": "2026-10-08T09:00:00.000Z"
  },
  "monitors": [
    {
      "id": 1,
      "name": "Website",
      "showOnStatus": true
    }
  ]
}
POST /api/v1/account/status-page
Save it: {"enabled": true, "slug": "acme", "title": "Acme status", "monitors": [1, 2]}.
Example
curl -X POST "https://ip-fd.net/api/v1/account/status-page" \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"enabled":true,"slug":"acme","title":"Acme status","monitors":[1,2]}'
Needs an API key, so this is an example response.
{
  "ok": true,
  "slug": "acme"
}
POST /api/v1/account/weekly-report
Turn the weekly report on or off: {"enabled": true}.
Example
curl -X POST "https://ip-fd.net/api/v1/account/weekly-report" \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"enabled":true}'
Needs an API key, so this is an example response.
{
  "weeklyReport": true
}

IP address

GET/api/v1/ip/{address}

Accepts an IPv4 or IPv6 address, or a hostname (resolved to its first address). Returns registration, routing, location and abuse data.

{
  "ip": "193.0.6.139",
  "version": 4,
  "found": true,
  "hostname": "www.ripe.net",
  "network": {
    "prefix": "193.0.0.0 - 193.0.7.255",
    "cidrs": ["193.0.0.0/21"],
    "first": "193.0.0.0", "last": "193.0.7.255", "size": "2048",
    "netname": "RIPE-NCC", "country": "NL",
    "status": "ASSIGNED PA", "org_id": "ORG-RIEN1-RIPE",
    "registry": "RIPE", "updated": "2026-09-30T00:00:00.000Z"
  },
  "delegation": { "registry": "RIPE", "country": "NL", "block": "193.0.0.0 - 193.0.7.255" },
  "asn": { "asn": 3333, "name": "RIPE-NCC-AS", "route": "193.0.0.0/21", "country": "NL" },
  "organisation": { "id": "ORG-RIEN1-RIPE", "name": "Reseaux IP Europeens Network Coordination Centre (RIPE NCC)", "country": "NL" },
  "abuse": { "handle": "ops4-ripe", "email": "abuse@ripe.net" },
  "rpki": { "state": "valid", "reason": "ROA 193.0.0.0/21 allows AS3333 up to /21" },
  "usageType": {
    "code": "ORG", "name": "Organization", "codes": ["ORG"], "known": true,
    "source": "network", "confidence": "network",
    "is": { "datacenter": false, "residential": false, "organization": true, ... }
  },
  "location": {
    "country": "NL", "region": "North Holland", "city": "Amsterdam",
    "latitude": 52.374, "longitude": 4.8897,
    "accuracy": "city", "confidence": "medium",
    "source": "ipmap", "sourceLabel": "RIPE IPmap measurement",
    "candidates": [ ... ]
  },
  "queryTimeMs": 41
}

Your address

GET/api/v1/me

Same response as the IP endpoint for the address the request came from. Add ?format=text to get only the address as plain text.

Usage type

What kind of network an address belongs to. Every IP response has a usageType object, and these endpoints return only that part. Answers come from data we store and update every month; no other service is asked while you wait.

GET/api/v1/ip/{address}/usage-type
GET/api/v1/ip/{address}/usage-type-name
GET/api/v1/ip/{address}/usage

usage-type returns the code as plain text (DCH, or a combination such as ISP/MOB), usage-type-name the name, and usage the whole object as JSON. Use /api/v1/me/usage-type for your own address. There is always an answer.

curl https://ip-fd.net/api/v1/ip/193.0.6.139/usage-type
ORG
CodeMeaning
COMCommercial (business network)
ORGOrganization
GOVGovernment
MILMilitary
EDUUniversity, college or school
LIBLibrary
CDNContent delivery network
ISPFixed line ISP
MOBMobile ISP
DCHData center, web hosting or transit
SESSearch engine spider
RSVReserved

True or false checks

GET/api/v1/ip/{address}/is/{type}
GET/api/v1/me/is/{type}

Plain text true or false. Add ?format=json for { "ip", "check", "result", "usageType", "usageTypeName", "source", "confidence" }, .

curl https://ip-fd.net/api/v1/ip/193.0.6.139/is/datacenter
false
TypeTrue when the usage type is
datacenter or hostingDCH
residentialISP or MOB, and not DCH, CDN or SES
ispISP
mobileMOB
commercial or businessCOM
organizationORG
governmentGOV
militaryMIL
educationEDU
libraryLIB
cdnCDN
search-engineSES
reservedRSV

/api/v1/usage-types returns all codes and checks as JSON.

Where the answer comes from

source and confidence say how the usage type was found:

  • override (listed): a correction we made for this network.
  • database (listed): the address is in a listed range of our range database.
  • list (listed): a range published by the operator, such as Googlebot, Bingbot, Cloudflare or a cloud provider.
  • reputation (listed): the usage type stored with the abuse reports for this address.
  • nearby (nearby): listed ranges in the same /24, /48 or registered network all have this usage type.
  • prefix (prefix): most listed ranges in the announced prefix have this usage type.
  • network (network): most listed ranges in the AS have this usage type.
  • range, asinfo, estimate (estimate): from reverse DNS and network names.
  • default (default): nothing says the address is in a data center, so it counts as a normal connection (ISP). A data center answer always comes from a listed range or a published list, never from a guess.

Suspicious

GET/api/v1/ip/{address}/is/suspicious

true when the address is in a data center range, has many abuse reports, or is a listed VPN server, Tor exit or open proxy. A home connection with many abuse reports is suspicious too. With ?format=json the answer lists the reasons.

Allow or block

GET/api/v1/check/{address}
POST/api/v1/check/bulk { "ips": ["193.0.6.139", ...] }

One answer for "should this address get in": action is allow or block, with the reasons. Add ?format=text for only the word. With an API key the answer follows your own access rules: your allow and block list first, then what you chose to block (data centers, VPN servers, Tor, open proxies, abuse score). Without a key the default rules apply.

{
  "ip": "193.0.6.139", "action": "allow", "allowed": true, "reasons": [], "rule": null,
  "usageType": "ISP", "datacenter": false, "residential": true,
  "vpn": false, "tor": false, "proxy": false, "abuseScore": 0
}

The bulk call takes up to 100 addresses. Every address counts as one request against your per-minute limit and daily quota. Your list can also be managed through the API: GET /api/v1/account/access, POST /api/v1/account/access/rules and DELETE /api/v1/account/access/rules/{id}.

Custom endpoints

GET/api/v1/custom/{id}/{address}

An endpoint you define yourself on the dashboard. You choose conditions on the usage type, country, city, AS number and RPKI state, and what it answers: plain true or false, or JSON with only the fields you pick. The address of an endpoint is random and it only answers calls made with your own API key. Every call counts as two requests.

curl "https://ip-fd.net/api/v1/custom/4f9c2a7be1d05836/193.0.6.139" -H "X-API-Key: YOUR_KEY"
true

AS number

GET/api/v1/asn/{asn}

Holder, country, registry, announced IPv4 and IPv6 prefixes, upstreams, downstreams and peers. The number can be given with or without the AS prefix.

Network

GET/api/v1/network/{prefix}

A registry record by CIDR (193.0.0.0/21), range (193.0.0.0-193.0.7.255) or single address. Includes parent allocations, up to 250 more specific assignments, announced routes and a WHOIS style text block.

Organisation

GET/api/v1/org/{handle}

An organisation by its registry handle, for example ORG-RIEN1-RIPE, with its AS numbers and up to 500 networks.

Domain

GET/api/v1/domain/{domain}

Addresses with their provider, location and RPKI state, mail servers, name servers, SPF, DMARC and CAA.

History

GET/api/v1/ip/{address}/history

Changes we recorded for the /24 (or /48) of an address: network, holder, origin AS, RPKI state and location, with the first and last time each state was seen.

Bulk lookup

POST/api/v1/bulk

Look up to 100 addresses per request (500 with an API key). Each address counts as one request against your quota. Live checks such as reverse DNS are skipped to keep the call fast.

curl -X POST https://ip-fd.net/api/v1/bulk \
  -H "Content-Type: application/json" -H "X-API-Key: ipfd_your_key" \
  -d '{"ips": ["193.0.6.139", "2001:67c:2e8:22::c100:68b"]}'

Reputation

GET/api/v1/ip/{address}/reputation

Live Spamhaus ZEN listing and, when configured, the AbuseIPDB confidence score. IPv4 only.

DNS and web checks

POST/api/v1/dns/lookup { "domain": "example.com", "type": "MX" }
POST/api/v1/dns/mail { "domain": "example.com" }
POST/api/v1/tools/ssl { "hostname": "example.com" }
POST/api/v1/tools/http-headers { "url": "https://example.com" }
POST/api/v1/tools/blacklist { "ip": "192.0.2.10" }
POST/api/v1/tools/subnet { "cidr": "10.0.0.0/22" }

Location fields

location.source tells you where the answer came from. Sources are tried in this order and the first one that names a city is used:

  • override: a correction we made after a verified report.
  • geofeed: the network operator's RFC 8805 geofeed.
  • geoloc: coordinates in the registry object.
  • rule: a rule we maintain for a network that publishes no geofeed.
  • ipmap: a RIPE IPmap measurement based on RIPE Atlas latency.
  • rdns: a city or airport code in the reverse DNS name.
  • registry_text: a city named in the netname or description.
  • cloud: the region list published by AWS, Google Cloud or Oracle.
  • org_address: the registered address of the holder (same country only).
  • atlas: our own RIPE Atlas latency measurement, used when nothing else names a city.
  • country: only the registry country is known.

accuracy is city, region or country. confidence is high, medium, low or country. candidates lists every source that returned something. More on the data page.

Privacy flags

Every IP response has a flags object. Each flag is null or an object with evidence and confidence: listed (the address is on a published list), likely or estimate.

  • tor: a Tor exit node (Tor Project exit lists, refreshed every 30 minutes).
  • vpn: a VPN server, with provider. Listed from the server lists of Mullvad, NordVPN, Private Internet Access, AirVPN, IVPN and Surfshark; likely from VPN reverse DNS names.
  • proxy: an open proxy seen in the last 7 days.
  • relay: an iCloud Private Relay egress address.
  • hosting: a hosting or cloud network.
  • anonymous: true when any of tor, vpn, proxy or relay is set.

No list is complete. A missing flag means the address is not on any list we know, not that it is a regular connection.

Legacy endpoints

The old endpoints /api/ip/{address}, /api/asn/{asn}, /api/range/{prefix}, /api/dns/* and /api/tools/* keep working with their previous response format. New integrations should use /api/v1.