Tor exit node and data center IP detection
Every IP lookup carries is_tor, is_hosting and hosting_provider, built from the lists the Tor Project and the cloud providers publish themselves.
What it does
City, region, coordinates, ASN, and network for any IPv4 or IPv6 address, plus country details and Tor exit and cloud or hosting flags. Call it without an IP to locate the calling device.
- GET /v1/ip
- GET /v1/ip/{ip}
- GET /v1/ip/{ip}/{field}
Limits: Postal code stays null for looked-up IPs. Time zone comes from the city coordinates. No VPN or residential proxy detection: is_hosting only covers published cloud ranges and known hosting networks.
Use cases
- Add friction to signups and logins coming from Tor or from servers instead of people.
- Separate bot and scraper traffic on cloud IPs from real visitors in analytics.
- Skip fraud checks for known cloud webhooks, or apply stricter limits to them.
Data sources and freshness
Tor Project bulk exit list (CC0); AWS ip-ranges.json, Google Cloud cloud.json, Azure Service Tags, Cloudflare IP list, Oracle Cloud public_ip_ranges.json, DigitalOcean geo feed; DB-IP ASN Lite (CC BY 4.0) for hosting ASNs.
Tor list refreshed hourly; cloud ranges refreshed daily.
Pricing
Every new account gets 100 free calls. Packs of 10,000 ($5), 100,000 ($15) and 250,000 calls ($29) never expire, or choose Unlimited for $39 a month. Only successful responses use a call. See pricing.
FAQ
Where do the flags come from?
is_tor uses the Tor Project bulk exit list, refreshed hourly. is_hosting uses the official IP range files of AWS, Google Cloud, Microsoft Azure (AzureCloud service tag), Cloudflare, Oracle Cloud and DigitalOcean, refreshed daily, plus hosting networks without a published list (Hetzner, OVHcloud, Linode, Vultr, Scaleway, Contabo, Leaseweb and others) matched by ASN.
Does it detect VPNs?
No, and there is no is_vpn field. Commercial VPNs often run on the hosting networks above, so is_hosting catches many of them, but no open source can say an address is a VPN, and LiveAPI does not guess.
What does null mean?
The risk data has not been loaded yet. false means the address was checked and is not listed.
Does it cost extra?
No. The flags are part of every /v1/ip lookup at no extra cost.