IP check

Request

Send an IPv4 or IPv6 address. There is no wait parameter here because the answer is always synchronous.

curl -X POST https://api.digifootprint.dev/v1/ip \
  -H "Authorization: Bearer dfp_live_..." \
  -H "Content-Type: application/json" \
  -d '{"ip": "45.83.91.1"}'

{
  "lookupId": "643a1996-a566-4720-a27f-5ff9051067fd",
  "query": "45.83.91.1",
  "ipDetails": {
    "ip": "45.83.91.1",
    "riskScore": 50,
    "confidence": 100,
    "isProxy": false,
    "isVpn": true,
    "isTor": false,
    "isHosting": true,
    "isScraper": false,
    "isCompromised": false,
    "operator": "NordVPN",
    "asn": "AS9009",
    "isp": "M247 Europe SRL",
    "connectionType": "Hosting",
    "countryCode": "SE",
    "regionName": "Stockholm",
    "cityName": "Stockholm",
    "latitude": 59.3294,
    "longitude": 18.0687,
    "timezone": "Europe/Stockholm"
  }
}

What comes back

riskScore is the network source’s own 0–100 risk figure for the address, and confidence says how sure it is of that assessment. The booleans are independent: isHosting means a datacenter range, while isCompromised means a machine believed to be part of a botnet — a victim, which is a different fact from a deliberately operated proxy.

operator names the VPN or proxy brand when it can be identified. A known Tor exit node comes back like this:

{
  "riskScore": 100,
  "isProxy": true,
  "isTor": true,
  "isCompromised": true,
  "operator": "TOR",
  "isp": "Stiftung Erneuerbare Freiheit",
  "countryCode": "DE"
}

connectionType is one of Business, Residential, Hosting or Wireless. It is often the most useful single field: a signup from a Hosting range is a very different thing from one on a Residential line.

null is not false

Every risk field can be null. Geolocation and risk come from different sources, and when only the geolocation source answers there is no risk assessment to report. In that case riskScore, isVpn and the rest are null — never false. Treating a missing assessment as a clean one is how a bad address gets waved through, so the two are kept apart.

Geolocation is a city centroid with an accuracy radius, never a user position, and it is weakest on mobile carrier ranges where the address maps to a gateway rather than a person.

Speed

This is the fastest endpoint on the API. A cold check measures around 230ms and a repeat check inside the cache window around 35ms, because it runs one lookup instead of the roughly 1,900 platform checks a full footprint sweep runs.

Billing

One IP check is billed as one lookup and appears in your history with its own lookupId, so it reconciles against your invoice. You can also add an IP to a full lookup instead — see Running a lookup and the checks object.