IP check

Request

Send an IPv4 or IPv6 address. There is no wait parameter here because the answer is always synchronous.

curl -X POST https://api.digifootprint.dev/v2/ip \
  -H "Authorization: Bearer dfp_live_..." \
  -H "Content-Type: application/json" \
  -d '{"ip": "45.83.91.1"}'

{
  "lookupId": "643a1996-a566-4720-a27f-5ff9051067fd",
  "ip": {
    "address": "45.83.91.1",
    "isProxy": false,
    "isVpn": true,
    "isTor": false,
    "isHosting": true,
    "isScraper": false,
    "isCompromised": false,
    "isResidentialProxy": false,
    "isMobile": false,
    "isAnonymous": true,
    "confidence": 100,
    "operator": "NordVPN",
    "asn": "AS9009",
    "isp": "M247 Europe SRL",
    "connectionType": "Hosting",
    "location": {
      "countryCode": "SE",
      "countryName": "Sweden",
      "region": "Stockholm County",
      "city": "Stockholm",
      "postalCode": null,
      "latitude": 59.3996,
      "longitude": 17.9484,
      "timezone": "Europe/Stockholm"
    },
    "risk": {
      "score": 25,
      "signals": [
        { "id": "ip.vpn", "module": "ip", "label": "Address belongs to a VPN service", "points": 15, "severity": "medium" },
        { "id": "ip.datacenter", "module": "ip", "label": "Address is hosted in a datacenter, not an ISP", "points": 10, "severity": "medium" }
      ]
    }
  }
}

What comes back

risk.score is our 0–100 score for the address, from the rules on risk scores (add "checks": {"riskSignals": true} for the named signals). confidence says how sure the network source is of its own assessment. isResidentialProxy marks a detected proxy exiting through a home or mobile connection — the hardest kind to spot. isAnonymous is true when any of VPN, proxy or Tor is. The booleans are independent: isHosting means a datacenter range, while isCompromised means a machine believed to be part of a botnet — a victim, which is a different fact from a deliberately operated proxy.

operator names the VPN or proxy brand when it can be identified. A known Tor exit node comes back like this:

{
  "isProxy": true,
  "isTor": true,
  "isCompromised": true,
  "operator": "TOR",
  "isp": "Stiftung Erneuerbare Freiheit",
  "location": { "countryCode": "DE", "...": "..." },
  "risk": { "score": 90 }
}

connectionType is one of Business, Residential, Hosting or Wireless. It is often the most useful single field: a signup from a Hosting range is a very different thing from one on a Residential line.

null is not false

Every risk field can be null. Geolocation and risk come from different sources, and when only the geolocation source answers there is no risk assessment to report. In that case isVpn, isProxy and the rest are null — never false. Treating a missing assessment as a clean one is how a bad address gets waved through, so the two are kept apart.

Geolocation is a city centroid with an accuracy radius, never a user position, and it is weakest on mobile carrier ranges where the address maps to a gateway rather than a person.

Speed

This is the fastest endpoint on the API. A cold check measures around 230ms and a repeat check inside the cache window around 35ms, because it runs one lookup instead of the roughly 1,900 platform checks a full footprint sweep runs.

Billing

One IP check is billed as one IP module unit and appears in your history with its own lookupId, so it reconciles against your invoice. You can also add an IP to a full lookup instead — see Running a lookup and the checks object.