IP Intelligence

Analyze IP addresses for fraud signals including VPN/proxy detection, geolocation, ISP reputation, and Tor exit node identification. Useful for enriching risk decisions during onboarding or transaction flows.

POST/intelligence/ip

Analyze an IP address for risk signals and geolocation data.

Request Body

Parameter	Type	Description
`ip`required	string	IPv4 or IPv6 address to analyze
`userId`	string	Optional user ID to link this check to a user profile

Code Examples

curl -X POST https://api.verifyhq.com/v1/intelligence/ip \
  -H "X-API-Key: your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "ip": "41.215.241.30",
    "userId": "user_123"
  }'

Response

200 OKjson

{
  "ip": "41.215.241.30",
  "riskScore": 0.08,
  "riskLevel": "LOW",
  "geolocation": {
    "country": "NG",
    "countryName": "Nigeria",
    "region": "Lagos",
    "city": "Lagos",
    "latitude": 6.4541,
    "longitude": 3.3947
  },
  "network": {
    "isp": "MTN Nigeria Communications Limited",
    "organization": "MTN Nigeria",
    "asn": "AS29465",
    "connectionType": "MOBILE"
  },
  "threats": {
    "isVpn": false,
    "isProxy": false,
    "isTor": false,
    "isDatacenter": false,
    "isKnownAbuser": false,
    "threatTypes": []
  },
  "checkedAt": "2026-02-18T13:00:01Z"
}

Threat Types

Parameter	Type	Description
`VPN`	threat	IP belongs to a known VPN provider
`PROXY`	threat	IP is an open or anonymous proxy
`TOR`	threat	IP is a Tor exit node
`DATACENTER`	threat	IP belongs to a hosting/cloud provider (not residential)
`KNOWN_ABUSER`	threat	IP has been flagged for abuse in threat intelligence feeds
`BOTNET`	threat	IP is part of a known botnet

Connection Types

Parameter	Type	Description
`MOBILE`	type	Mobile network (3G/4G/5G)
`RESIDENTIAL`	type	Residential ISP connection
`BUSINESS`	type	Business/enterprise connection
`DATACENTER`	type	Cloud or hosting provider
`SATELLITE`	type	Satellite internet connection