iplook APIiplook.io ↗
Look up geolocation, ASN, RIR, currency, and threat flags (VPN, Tor, proxy, bogon) for any IPv4 or IPv6 address via the iplook.io API.
What is the iplook API?
The iplook.io API exposes 13 fields per IP address — including geographic location, network ownership, and anonymity threat flags — through a single lookup_ip endpoint. Pass any IPv4 or IPv6 address to get country, region, city, coordinates, timezone, ASN, RIR, ISO 4217 currency code, and a threats object covering Tor exit nodes, VPNs, proxies, bogon ranges, abusers, and data-center hosts. Omit the address parameter to resolve the caller's own IP.
curl -X GET 'https://api.parse.bot/scraper/57eb0aa2-7f75-4dd6-9060-b6957c883551/lookup_ip?ip=8.8.8.8' \ -H 'X-API-Key: $PARSE_API_KEY'
Typed, relational, agent-ready
A generated client with real types, enums, and the links between objects — the structure a flat JSON response can't carry. Autocompletes in your editor and reads cleanly to coding agents.
- Fully typed · autocompletes
- Objects link to objects
- Typed errors & pagination
Typed Python client. Set up the SDK in your uv project, then pull this API’s typed client:
uv add parse-sdk uv run parse init uv run parse add --marketplace iplook-io-api
uv run parse add --marketplace pulls a pinned snapshot of this canonical API — it won’t change underneath you. To customize it, subscribe and swap to your own copy.
"""Walkthrough: iplook SDK — look up IP geolocation and threat data."""
from parse_apis.iplook_io_api import Iplook, InputFormatInvalid
client = Iplook()
# Look up a well-known public DNS resolver.
try:
addr = client.ip_addresses.get(ip="8.8.8.8")
except InputFormatInvalid:
print("invalid IP format")
raise
print(addr.ip, addr.country, addr.country_code)
print("coords:", addr.latitude, addr.longitude)
print("timezone:", addr.timezone, "local:", addr.local_time)
print("org:", addr.organization, "asn:", addr.asn)
# Inspect threat/anonymity flags on the result.
threats = addr.threats
print("vpn:", threats.is_vpn, "tor:", threats.is_tor, "proxy:", threats.is_proxy)
print("datacenter:", threats.is_data_center, "bogon:", threats.is_bogon)
# Look up the caller's own IP by omitting the argument.
me = client.ip_addresses.get()
print("my ip:", me.ip, me.country, me.city)
print("exercised: ip_addresses.get (named + caller-own)")
Returns one record with the geolocation, network and threat profile of a single IP address. Pass an IPv4 or IPv6 address; when omitted, the address the request originates from is looked up instead. One round trip, no pagination. Geographic fields are nullable: region and city are only populated when the site resolves the address to a sub-country level (many datacenter/anycast addresses resolve to country-only), and private, reserved or otherwise bogon addresses return a record with only ip and threats populated (threats.is_bogon true) while every location and network field is null. Coordinates are numbers in decimal degrees; local_time is the site's 'YYYY-MM-DD HH:MM:SS' wall-clock string in the returned timezone. A syntactically invalid address is rejected before any request is made.
| Param | Type | Description |
|---|---|---|
| ip | string | IPv4 or IPv6 address to look up (e.g. 8.8.8.8). Omitted = the requesting client's own address. |
{
"type": "object",
"fields": {
"ip": "the IP address that was resolved (string)",
"asn": "autonomous system number as a string of digits, or null",
"rir": "regional internet registry (e.g. ARIN) or null",
"city": "city name; null when the site resolves only to country level",
"region": "state/province/region name; null when the site resolves only to country level",
"country": "country name, null for bogon addresses",
"threats": "object of boolean flags: is_tor, is_vpn, is_proxy, is_bogon, is_abuser, is_data_center",
"asn_name": "registry short name of the AS or null",
"currency": "ISO 4217 currency code of the country or null",
"latitude": "decimal degrees (number) or null",
"timezone": "IANA timezone name or null",
"longitude": "decimal degrees (number) or null",
"local_time": "current wall-clock time at the location, 'YYYY-MM-DD HH:MM:SS', or null",
"country_code": "ISO 3166-1 alpha-2 country code, null for bogon addresses",
"network_type": "site's network classification such as hosting, or null",
"organization": "organization operating the network or null",
"asn_description": "registry description of the AS or null",
"organization_domain": "web domain of the organization or null"
},
"sample": {
"data": {
"ip": "168.93.225.7",
"asn": "401152",
"rir": null,
"city": "Secaucus",
"region": "New Jersey",
"country": "United States",
"threats": {
"is_tor": false,
"is_vpn": false,
"is_bogon": false,
"is_proxy": false,
"is_abuser": false,
"is_data_center": false
},
"asn_name": null,
"currency": "USD",
"latitude": 40.7908,
"timezone": "America/New_York",
"longitude": -74.056,
"local_time": "2026-09-16 07:37:54",
"country_code": "US",
"network_type": null,
"organization": null,
"asn_description": "UNASSIGNED",
"organization_domain": null
},
"status": "success"
}
}About the iplook API
What lookup_ip Returns
The lookup_ip endpoint accepts a single optional ip parameter — an IPv4 or IPv6 string such as 8.8.8.8. When the parameter is omitted, the API resolves the IP address of the client making the request. The response is a flat object; there is no pagination and no secondary request needed.
Geographic fields — city, region, country, latitude — are nullable. Addresses that resolve only to country level will return null for city and region. Bogon addresses (private ranges, reserved blocks) return null for country and most geographic fields, but threats.is_bogon will be true.
Network and Registry Fields
asn returns the autonomous system number as a digit string (e.g. "15169"), and asn_name gives the registry short name for that AS. rir identifies the regional internet registry responsible for the address block — values like ARIN, RIPE, or APNIC. Both fields can be null when the block is unallocated or private.
currency returns the ISO 4217 code (e.g. "USD", "EUR") for the country the IP maps to, useful when building localization pipelines that derive a user's likely currency from their network location.
Threat Flags
The threats object contains six boolean flags: is_tor, is_vpn, is_proxy, is_bogon, is_abuser, and is_data_center. These can be evaluated independently or combined — for example, checking is_data_center alongside is_vpn to distinguish cloud-hosted traffic from consumer VPN exit nodes. All six flags are always present in the response; none are omitted when false.
The iplook API is a managed, monitored endpoint for iplook.io — not a raw scraper you maintain. Every endpoint is automatically health-checked on a schedule, and when iplook.io changes and a check fails, the API is automatically queued for repair and re-verified. It is built to keep working as the site underneath it changes.
This isn't an official iplook.io API — it's an independent, maintained REST wrapper over public data. Where the source has no official API (or only a limited one), Parse gives you a stable contract over a source that never promised one, and keeps it current. Need a new endpoint or field? You can revise it yourself in plain English and the agent rebuilds it against the live site in minutes — contributing the change back to the shared API is free.
Will this API break when the source site changes?+
Is this an official API from the source site?+
Can I fix or extend this API myself if I need a new endpoint or field?+
What happens if I call an endpoint that has an issue?+
- Block or challenge sign-ups originating from known Tor exit nodes using the
is_torflag. - Localize storefronts by reading
currencyandcountryfrom the caller's resolved IP on page load. - Flag high-risk transactions where
is_vpn,is_proxy, oris_abuseris true. - Restrict content by geography using
countryandregionwithout a separate geolocation service. - Identify cloud or scraper traffic by checking
is_data_centeron inbound API requests. - Build an ASN allowlist or blocklist using the
asnandasn_namefields from inbound connections. - Filter analytics dashboards to exclude bogon and reserved-range addresses via
is_bogon.
| Tier | Price | Credits/month | Rate limit |
|---|---|---|---|
| Free | $0/mo | 200 | 5 req/min |
| Hobby | $30/mo | 1,000 | 20 req/min |
| Developer | $100/mo | 5,000 | 100 req/min |
| Team | $300/mo | 20,000 | 300 req/min |
| Company | $1,000/mo | 100,000 | 500 req/min |
Each endpoint has a fixed posted price per successful call — most fall between 1 and 10 credits — shown on this API's page before you run it. Exceeding the rate limit returns a 429 response. Authenticate with the X-API-Key header.
Does iplook.io offer an official developer API?+
What does the threats object actually contain?+
threats object always returns six boolean fields: is_tor, is_vpn, is_proxy, is_bogon, is_abuser, and is_data_center. All six are present in every response — when a flag does not apply, the value is false rather than omitted. There is no severity score or timestamp; only the current boolean state is returned.Are city and region always populated?+
city and region are nullable. Some IP blocks are mapped only to country level, in which case both fields return null. Bogon and reserved-range addresses return null for all geographic fields. country can also be null for bogon ranges.Does the API cover bulk lookups or batch requests?+
lookup_ip endpoint resolves one IP address per call. You can fork this API on Parse and revise it to add a batch endpoint that accepts an array of addresses.Is longitude returned alongside latitude?+
latitude but not longitude. Geographic precision is limited to the fields listed — country, region, city, and latitude. You can fork this API on Parse and revise it to surface additional coordinate fields if the source exposes them.