IP risk API: VPN, proxy and Tor detection

Updated 2026-09-29

Know what is behind the address before you trust the session: VPN, proxy, Tor, residential proxy, datacenter or a compromised machine - with the network owner, the location and a risk score that explains itself.

One call

POST /v2/ip
curl -X POST "https://api.digifootprint.dev/v2/ip" \
  -H "Authorization: Bearer dfp_your_key" \
  -H "Content-Type: application/json" \
  -d '{"ip": "185.220.101.1"}'
200 OK
{
  "lookupId": "c242b368-...",
  "ip": {
    "address": "185.220.101.1",
    "isProxy": true,
    "isVpn": false,
    "isTor": true,
    "isHosting": false,
    "isResidentialProxy": null,
    "isCompromised": true,
    "isAnonymous": true,
    "operator": "TOR",
    "asn": "AS60729",
    "connectionType": "Business",
    "location": { "countryCode": "DE", "city": "Brandenburg an der Havel", "timezone": "Europe/Berlin" },
    "risk": { "score": 90 }
  }
}

What comes back

Anonymity flags - VPN, proxy, Tor, residential proxy, datacenter hosting, known automated traffic and compromised machines - each on its own, because a datacenter address and a botnet victim mean different things. Network - operator (the VPN brand when known), ASN, ISP and connection type. Location - country, region, city, coordinates and timezone.

A risk score you can read. The score is the total of the named signals that fired, and every rule can be tuned for your own traffic from the dashboard. Unknown is never clean: when only location could be answered, the risk flags are null, not false.

Frequently asked questions

What API detects VPN and proxy IP addresses?
The Digital Footprint IP risk API flags VPN, proxy, Tor, residential proxy, datacenter and compromised addresses in one call, with the network owner, location and a 0-100 risk score, typically in under a second.
Can an IP API detect residential proxies?
Yes, on the Scale plan and above: isResidentialProxy marks a detected proxy that exits through a home or mobile connection, the hardest kind to spot. It is never inferred from the connection type alone.
What is an IP reputation API?
An IP reputation API tells you how much to trust the address a request came from: whether it is a VPN, proxy, Tor exit or datacenter, who operates the network, where it is, and a risk score. The Digital Footprint IP API returns all of that in one sub-second call.
Does the IP API return geolocation and ISP?
Yes. Every IP check returns the country, region and city where they can be determined, the ASN and the ISP or network owner, alongside the VPN, proxy, Tor and datacenter flags.
How fast is an IP risk check?
A fresh check typically answers in a few hundred milliseconds and a repeat inside the cache window in tens of milliseconds.
Can I combine the IP check with email and phone checks?
Yes. Send the IP with the email or phone in one lookup and add a rule such as phone country differs from IP country - the overall score is the total of every signal that fired.

Related

Start free with 15 lookupsTry a lookup