Address lookups

Look up one IPv4 address for its type, risk score, proxy, VPN, Tor and relay flags, residential proxy record, network, routing and location.

An address lookup tells you what one IPv4 address is and how risky it is. The paid answer adds whether it is a residential proxy exit now, and who runs and leases the space.

Request	Tier	Cost
`GET /open/{ip}`	Open	Free
`GET /me`	Open, for your own address	Free
`GET /v1/{ip}`	Paid	1 credit

A residential proxy exit

curl -H "Authorization: Bearer $KEY" https://api.layer3intel.com/v1/203.0.113.117

{
  "ip": "203.0.113.117",
  "type": "residential",
  "risk": { "score": 75, "level": "high", "reasons": ["residential_proxy"] },
  "flags": {
    "anonymizer": false,
    "proxy": true,
    "residential_proxy": true,
    "vpn": false,
    "tor": false,
    "relay": false,
    "hosting": false
  },
  "residential_proxy": {
    "score": 100,
    "last_seen": "2026-11-01",
    "days_seen_30d": 30,
    "days_seen_7d": 7,
    "providers": ["Oxylabs", "Infatica", "IPRoyal", "Bright Data"]
  },
  "location": {
    "country": "UA",
    "region": "Kyiv City",
    "city": "Kyiv",
    "latitude": 50.4501,
    "longitude": 30.5234,
    "timezone": "Europe/Kyiv",
    "confidence": "high"
  },
  "network": {
    "asn": 64500,
    "name": "Example Broadband",
    "type": "access",
    "prefix": "203.0.113.0/24",
    "registered": "2009-05-22",
    "rpki": "valid",
    "abuse_email": "abuse@example.net",
    "company": "Example Broadband"
  },
  "routing": {
    "shape": "stable",
    "first_seen": "2016-05-19",
    "origins": 1,
    "current_since": "2016-05-19"
  },
  "proxy_map": { "exits_24": 251, "always_on_24": 122 }
}

The address and network are illustrative documentation values: a residential exit is a real subscriber's connection. The open answer for such an address reads risk.level: low with nothing about a proxy; only the proxy_map counts for its /24 show the exits around it.

A privacy relay or corporate gateway

The open answer names privacy relays and corporate gateways in privacy.operators:

curl https://api.layer3intel.com/open/172.224.226.10

{
  "ip": "172.224.226.10",
  "type": "relay",
  "risk": { "score": 35, "level": "medium", "reasons": ["relay"] },
  "flags": {
    "anonymizer": false,
    "proxy": false,
    "vpn": false,
    "tor": false,
    "relay": true,
    "hosting": true
  },
  "privacy": {
    "operators": [
      {
        "name": "iCloud Private Relay",
        "kind": "relay",
        "group": "relay",
        "role": "operator",
        "parent": "Apple"
      }
    ]
  },
  "location": {
    "country": "GB",
    "region": "England",
    "city": "London",
    "latitude": 51.5085,
    "longitude": -0.1257,
    "timezone": "Europe/London",
    "confidence": "high"
  },
  "network": {
    "asn": 36183,
    "name": "Akamai Technologies, Inc.",
    "type": "cdn",
    "prefix": "172.224.226.0/24",
    "registered": "2013-03-15",
    "rpki": "valid",
    "abuse_email": "abuse@akamai.com",
    "company": "Akamai Technologies, Inc."
  },
  "routing": {
    "shape": "stable",
    "first_seen": "2021-08-25",
    "origins": 1,
    "current_since": "2021-08-25"
  },
  "proxy_map": { "exits_24": 0, "always_on_24": 0 }
}

A corporate gateway answers type: corporate_proxy, with the vendor in privacy.operators (for example Cisco Umbrella, kind: swg). See the Open API example.

Fields

Field	Type	Description
`ip`	string	The address, in standard dotted form. Always present.
`type`	string	What the address is. See address types.
`risk.score`	integer, 0–100	How strongly the address suggests hidden, automated or abusive traffic.
`risk.level`	string	`critical` (score 85 or above), `high` (60 or above), `medium` (25 or above), `low`.
`risk.reasons`	string[]	Why, most significant first. Empty when there is no reason. See risk reasons.
`flags.anonymizer`	boolean	It hides its users: an ISP or datacenter proxy, a VPN or a Tor exit. A residential proxy exit does not set it: the device belongs to a real subscriber.
`flags.proxy`	boolean	An ISP or datacenter proxy. Paid: also `true` for a residential proxy exit.
`flags.residential_proxy`	boolean	Paid only. A residential proxy exit now. Always present on paid answers; `false` when there is no record.
`flags.vpn`	boolean	A commercial VPN server.
`flags.tor`	boolean	A Tor exit relay.
`flags.relay`	boolean	A privacy relay built into a browser or OS (iCloud Private Relay, Cloudflare WARP): real users, address hidden.
`flags.hosting`	boolean	A server in a data center or cloud.
`residential_proxy`	object	Paid only, when there is a current record. See below.
`privacy`	object	When names apply: `operators[]` and `leased_from[]`. Open: `operators[]` only, for privacy relays and corporate gateways. Paid: every operator, and `leased_from[]`. See Operators and lessors.
`sharing`	string	When shared: `cgnat` or `mobile`. Many people use the address at once. See sharing.
`crawler`	object	Known crawlers and monitors: `operator` (for example `Google`), `purposes[]` (crawler purposes) and `names[]`, the crawlers' own names (for example `facebookexternalhit`).
`connection.access`	string[]	When it applies: `satellite`, `maritime`, `in-flight`. See connection.
`connection.tcp_termination`	string	When it applies: `network` or `partial`. A middlebox terminates TCP connections.
`location.country`	string	ISO 3166-1 alpha-2 country code, when located.
`location.region`, `location.city`	string	Names, when known.
`location.latitude`, `location.longitude`	number	The city's position, not the device's, when known.
`location.timezone`	string	IANA time zone, when known.
`location.confidence`	string	`high`, `medium` or `low`, when located. See location confidence.
`network.asn`	integer	The network announcing the address.
`network.name`	string	That network's name.
`network.type`	string	What kind of network it is, when classified. See network types.
`network.prefix`	string	The announced block covering the address.
`network.registered`	date	When the registry record for the block was created, when known. A very recent date on proxy-like space is a signal.
`network.rpki`	string	The route's RPKI status, when known. See RPKI.
`network.abuse_email`	string	The registry's abuse contact for the block, when published.
`network.drop_listed`	`true`	Listed networks only. The announcing network is on Spamhaus's ASN-DROP list.
`network.company`	string	The organization using the address, which may differ from the network announcing it, when known.
`routing.shape`	string	`stable`, `rotating` or `reactivated`, when known. See routing shape.
`routing.first_seen`	date	The earliest date the block appears in the routing history.
`routing.origins`	integer	How many different networks have announced the block.
`routing.current_since`	date	Since when the current network has announced the block.
`hostname`	string	Reverse DNS, when there is one.
`proxy_map.exits_24`	integer	Residential proxy exits recently observed in the address's /24. A neighborhood count: it doesn't say whether this address is one.
`proxy_map.always_on_24`	integer	Of those, the exits observed nearly every day.

network.* fields are present for announced addresses; type, risk, flags and proxy_map for every public address.

`residential_proxy`

Paid only, present when there is a current record for the address.

Field	Type	Description
`score`	integer, 0–100	How strongly the address is a residential proxy exit now: higher for an exit in use recently and often. At 50 or above, `flags.residential_proxy` is `true`. On a shared address (mobile, carrier NAT) the score never exceeds 50, since the proxy is one of many users.
`last_seen`	date	The last day the address was seen as a residential proxy exit.
`days_seen_30d`	integer	Days in the last 30 on which it was seen as one.
`days_seen_7d`	integer	Days in the last 7. Absent when unavailable.
`providers`	string[]	The residential proxy providers the address was seen with, by brand name. Up to 20 are listed; a busy exit can have more.

A record with a low score is an old sighting: the address was a proxy exit and has stopped. flags.residential_proxy is then false.

Use the answer

Block or challenge anonymizers: flags.anonymizer is true for ISP proxies, datacenter proxies, VPN servers and Tor exits.
Catch residential proxy exits (paid): flags.residential_proxy is true for an exit in use now. residential_proxy.score, last_seen and days_seen_30d tell you how recent and how frequent.
Treat relays and corporate gateways as real people: type: relay and type: corporate_proxy are ordinary users behind a privacy relay or their company's gateway, not anonymizers.
Take care with shared addresses: when sharing is present, blocking the address blocks everyone behind it.