Response guide

FindIP API response model

The GET /{ip} endpoint returns one JSON object: geolocation and network traits from the IP database, plus a top-level intelligence object for proxy, VPN, Tor, hosting, malicious, and network-service signals.

Request

Public authenticated lookup

GET https://api.findip.net/{ip}/?token={token}

tokenRequired API token passed as a query parameter.

returnIpOptional boolean. When true, the looked-up IP is echoed where source data supports it.

Status codes200 success, 400 validation or token errors, 404 no IP data, 429 throttling.

How to read the response

Start broad, then drill into evidence.

1. LocationUse country, city, location, and subdivisions for user-facing geography.

2. Network ownerUse traits.isp, organization, and ASN fields for routing, analytics, and enrichment.

3. IntelligenceUse summary.verdict, risk, and flags for fast decisions, then inspect categories and evidence for explanations.

Representative JSON

Shape returned by GET /8.8.8.8?token=....

{
  "city": {
    "geoname_id": 5375480,
    "names": {
      "en": "Mountain View"
    }
  },
  "continent": {
    "code": "NA",
    "geoname_id": 6255149,
    "names": {
      "en": "North America"
    }
  },
  "country": {
    "geoname_id": 6252001,
    "is_in_european_union": false,
    "iso_code": "US",
    "names": {
      "en": "United States"
    }
  },
  "location": {
    "accuracy_radius": 1000,
    "latitude": 37.386,
    "longitude": -122.0838,
    "metro_code": 807,
    "time_zone": "America/Los_Angeles",
    "weather_code": "USCA0746"
  },
  "postal": {
    "code": "94035"
  },
  "registered_country": {
    "geoname_id": 6252001,
    "is_in_european_union": false,
    "iso_code": "US",
    "names": {
      "en": "United States"
    }
  },
  "subdivisions": [
    {
      "geoname_id": 5332921,
      "iso_code": "CA",
      "names": {
        "en": "California"
      }
    }
  ],
  "traits": {
    "autonomous_system_number": 15169,
    "autonomous_system_organization": "GOOGLE",
    "connection_type": "Corporate",
    "ip_address": "8.8.8.8",
    "isp": "Google LLC",
    "organization": "Google LLC"
  },
  "intelligence": {
    "summary": {
      "verdict": "network_service",
      "description": "Public DNS resolver signals were detected for this IP. No malicious, proxy, VPN, or Tor signals were found."
    },
    "flags": {
      "is_anonymous": false,
      "is_proxy": false,
      "is_vpn": false,
      "is_tor": false,
      "is_relay": false,
      "is_malicious": false,
      "is_hosting": false,
      "is_network_service": true
    },
    "risk": {
      "score": 20,
      "level": "low"
    },
    "anonymous": {
      "is_anonymous": false,
      "is_proxy": false,
      "is_vpn": false,
      "is_tor": false,
      "is_relay": false,
      "types": [],
      "confidence": 0,
      "last_seen": null
    },
    "security": {
      "is_malicious": false,
      "threat_score": 0,
      "threat_level": "low",
      "threat_types": [],
      "confidence": 0,
      "last_seen": null
    },
    "hosting": {
      "is_hosting": false,
      "types": [],
      "confidence": 0,
      "last_seen": null
    },
    "network_services": {
      "is_network_service": true,
      "types": [],
      "is_public_dns": true,
      "is_public_doh": false,
      "is_scanner": false,
      "confidence": 95,
      "last_seen": "2026-06-07T00:00:00+00:00"
    },
    "tags": [
      "public_dns"
    ],
    "categories": [
      {
        "category": "network_service",
        "subcategory": "public_dns",
        "label": "Public DNS resolver",
        "confidence": 95,
        "signal_count": 3,
        "last_seen": "2026-06-07T00:00:00+00:00"
      }
    ],
    "evidence": {
      "source_count": 2,
      "signal_count": 3,
      "first_seen": "2026-05-01T00:00:00+00:00",
      "last_seen": "2026-06-07T00:00:00+00:00"
    }
  }
}

Field reference

Core fields and how to use them.

Field	Type	Use
`city.names`	object	Localized city names keyed by locale, commonly `en`.
`country.iso_code`	string	ISO 3166-1 alpha-2 country code.
`location`	object	Latitude, longitude, time zone, accuracy radius, and related location metadata.
`subdivisions[]`	array	State, province, or region records where available.
`traits`	object	ISP, organization, connection type, ASN, and ASN organization.
`intelligence.summary`	object	Top-line verdict and readable explanation.
`intelligence.flags`	object	Boolean detection rollups for anonymous, proxy, VPN, Tor, relay, malicious, hosting, and network service.
`intelligence.risk`	object	Normalized score from `0` to `100` plus a severity level.
`intelligence.anonymous`	object	Anonymous traffic details, types, confidence, and last seen time.
`intelligence.security`	object	Malicious activity details, threat types, confidence, and last seen time.
`intelligence.hosting`	object	Hosting/data-center details, types, confidence, and last seen time.
`intelligence.network_services`	object	Public DNS, DoH, scanner, and network-service details.
`intelligence.categories[]`	array	Detailed signal categories with labels, confidence, counts, and last seen time.
`intelligence.evidence`	object	Source count, signal count, first seen, and last seen timestamps.