What does IP Intelligence detect?

VPN exit ranges, current Tor exit nodes, cloud and hosting servers, Apple iCloud Private Relay and verified search engine crawlers, together with the network, its registration and the address's location. A risk score combines the signals.

How is it different from IP Geolocation?

IP Geolocation returns only where an address is. IP Intelligence returns the same location plus the network, privacy flags and risk score. Both cost 1 credit, so use Intelligence whenever you need to decide whether to trust the traffic.

Should I block high-risk addresses?

Usually not outright. Many legitimate people use VPNs, iCloud Private Relay or company networks on cloud providers. Use the score to add friction, such as a second factor or a review, and combine it with your own signals.

Where does the data come from?

From openly published data loaded onto Finowl's own servers and refreshed daily: DB-IP Lite location and ASN data, the regional internet registries' delegation files, the cloud providers' and search engines' published IP ranges, the Tor exit list, Apple's Private Relay egress list and an open VPN range list. Only a reverse DNS query is made per lookup.

Is the IP address stored?

No. The address is processed only to return a result and is not stored afterwards.

FINOWL / IP INTELLIGENCE

Know whether an IP can be trusted.

Flag VPNs, Tor exits, hosting servers and iCloud Private Relay in real time, with geolocation, network and ASN, and a risk score in a single request. Answered from data on Finowl's own servers, refreshed daily.

Start building Try the sandbox

Isometric IP address card connected to a shield block and a risk result.

HOW IT WORKS

One address in.
A trust decision out.

A single request returns the signals your signup, sign-in or abuse workflow needs.

STEP / 01

Send an IP address

Post an IPv4 or IPv6 address to the IP Intelligence endpoint, authenticated with your API key.

STEP / 02

Check every signal

Finowl matches the address against VPN, Tor, cloud, relay and crawler ranges, registry data and location data, all held in memory and refreshed daily.

STEP / 03

Decide with context

Receive the flags, the network and ASN, the location and a risk score with the factors behind it, in one response.

SEE IT IN ACTION

From an IP address
to a risk score.

RequestcURL

1curl https://api.finowl.co/v1/ip/intelligence \2  -H "Authorization: Bearer $FINOWL_API_KEY" \3  -H "Content-Type: application/json" \4  --data '{5    "ip": "8.8.8.8"6  }'

ResponseJSON200 OK

1{2  "ip": "8.8.8.8",3  "version": 4,4  "country_code": "US",5  "country": "United States",6  "region": "California",7  "city": "Mountain View",8  "asn": 15169,9  "as_name": "Google LLC",10  "hosting": true,11  "hosting_provider": "google_cloud",12  "tor": false,13  "reserved": false,14  "location": {15    "latitude": 37.422,16    "longitude": -122.085,17    "timezone": "America/Los_Angeles",18    "local_time": "2026-10-15T10:27:05-07:00",19    "utc_offset": "-07:00"20  },21  "country_info": {22    "code": "US",23    "name": "United States",24    "flag": "🇺🇸",25    "continent": "North America",26    "currency": "USD",27    "language": "en",28    "in_eu": false,29    "calling_code": 130  },31  "network": {32    "asn": 15169,33    "as_name": "Google LLC",34    "cidr": "8.8.8.0/24",35    "rir": "ARIN",36    "allocated": "2023-12-28",37    "registered_country": "US",38    "type": "hosting",39    "reverse_dns": "dns.google"40  },41  "privacy": {42    "hosting": true,43    "hosting_provider": "google_cloud",44    "tor": false,45    "vpn": false,46    "icloud_private_relay": false,47    "crawler": null48  },49  "risk": {50    "score": 40,51    "level": "medium",52    "factors": [53      "hosting"54    ]55  }56}

WHERE IT FITS

Act before
you trust.

Guide: sign-up fraud checks

Signup screening
Send signups from Tor exits, VPNs or cloud servers to extra verification instead of letting them straight in.
Sign-in protection
Notice a sign-in from an anonymizing network or a new country, and ask for a second factor before you continue.
Abuse and bot traffic
Rate-limit traffic from hosting networks, and let verified search engine crawlers through without a challenge.

These signals describe a network, not a person. Use them for a proportionate response, such as extra verification, not as the only reason to block someone.

THE RESPONSE

Clear fields. Honest limits.

Every response says how traffic reaches you and where it comes from, with unknown fields left empty.

VPN, Tor and hosting signals are reasons to look closer, not proof of abuse. The risk score shows the factors behind it, so you can decide what matters to you.

IP geolocation by DB-IP, licensed under CC BY 4.0.

Time zones from GeoNames, licensed under CC BY 4.0.

VPN ranges from X4BNet lists_vpn, licensed under MIT.

privacy: Whether the address is a VPN, a current Tor exit, a cloud or hosting server or iCloud Private Relay, and the crawler name for verified search engine bots such as googlebot.
risk: A 0 to 100 score, a low, medium or high level, and the factors behind it, such as tor_exit, vpn or hosting.
network: The matched CIDR range, its regional registry and allocation date, the reverse DNS name and a network type such as isp, hosting or education.
asn, as_name: The autonomous system that announces the address, such as 15169 and Google LLC.
hosting, hosting_provider, tor: Top-level copies of the most used flags, with the provider, such as aws or cloudflare.
country, region, city: The country the address is registered to, and its approximate region and city.
location, country_info: Coordinates, time zone and local time, and the country's flag, continent, currency, language, calling code and EU membership.
reserved: True for private, loopback, link-local and other non-public ranges. Location and network fields are then empty.

A FEW GOOD QUESTIONS

IP Intelligence questions, answered.

Trust traffic on your terms.

Add VPN, Tor, hosting and risk signals to your next signup or sign-in check.

Start building View pricing API reference