Online API · self-hosted
IP risk profile
Give us an IP address and we return what we can currently say about its risk, together with its
network and geographic ownership. Proxies, VPNs, dial-up pools, cloud phones and datacenters are
the infrastructure attackers hide behind — and the traces they leave on the network can be captured.
The biggest difference from a traditional IP intelligence database:
what we return is a judgement that expires, not a label that stays true forever.
The same address that was a proxy last week may or may not still be one today; it depends on how
old the evidence is.
Try an address →
Why permanent labels make you block the wrong people
An IP address is not a fixed asset; it moves. A residential line held by a dial-up pool today may be
back with a real subscriber next week; a cloud host used as a proxy gets its address reassigned once
the lease ends. Keeping a permanent “proxy” label on addresses like those stops being a
defence against attackers and starts being a tax on whoever inherits the address.
So every judgement we return carries when it was last observed. The older the
evidence, the lower the score; past the freshness window for that class of risk, the score reaches
zero and the judgement is void. Letting conclusions expire on their own is the core design
of this product.
What the score is, and what it is not
The response contains no Chinese. Place names, usage types and risk types come back
as standard codes or stable slugs, so your parsing layer never has to deal with Chinese text.
The code tables are below and in the API reference.
| Field | What it means |
|---|
risk.score |
0–100. The freshness and strength of verifiable risk evidence, decaying as
the evidence ages. It is not the probability that the address belongs to an
attacker. This product gives exactly one score per address:
score on /pulse/v1/ip has the same source and the same value. |
risk.level |
high / medium / low / none, derived from risk.score.
none means “we hold no currently verifiable evidence”, which
is not the same as safe. |
network / geo |
Address ownership, in the same shape as the professional tier of /pulse/v1/ip.
network.asn plus a usage_type code; geo gives the
continent code, ISO 3166-1 country code, coordinates and time zone.
Chinese addresses additionally get subdivision (ISO 3166-2) and
admin_code (GB/T 2260, six digits, down to district);
everywhere else gets Latin region / city.
Operator names are not returned; the machine-readable identity is asn. |
evidence_state |
active: fresh evidence that still scores. stale: seen before, but past the freshness window
with a score of zero — usable as a weak signal, not as a blocking reason on its own.
none: never seen, which may mean a coverage gap. |
tag_details[].last_seen |
When that class of evidence was last captured, as an RFC3339 timestamp with a
UTC offset (e.g. 2026-08-20T10:51:05+08:00). A tag can still be
present while the score has decayed to 0 — that means the evidence expired, not
that the address is clean. Judge by how long ago last_seen was. |
signals.* |
Boolean signals. hosting / mobile are derived from the network
usage type and are not risks in themselves; the rest map one-to-one onto tags. |
A score of 0 does not mean safe
Zero only says we hold no currently verifiable evidence — the address may genuinely
be clean, or we may simply never have captured it. Read it as “nothing found”, not as
“cleared”. Route on evidence_state rather than on the score alone.
Where it gets used
Signup and login risk
Bulk registration, credential stuffing and account farming nearly all need a proxy pool to rotate
addresses. Check once at signup and on anomalous logins, and keep out requests that plainly
come from attack infrastructure.
Promotions and ad spend
Where coupon claims, referral pushes and campaign entries come from — and where ad impressions and
clicks come from. An abnormal share of datacenter and proxy addresses usually means that batch
is not human.
Content and API scraping
Scrapers rotate exits across proxy pools. Routing by risk type and sharing level catches more of
them, and hurts fewer real users, than rate limiting alone.
Post-incident review and arbitration
Whether a transaction should have been blocked has to be judged on the evidence available
at the time. The API can score against a specified moment, so you are not holding
yesterday's decision to today's conclusion.
Two ways to deploy
Online API
Usable as soon as you sign up, billed per call, with a free allowance active the same day. Suited to
traffic you control, where sending lookups over the public internet is acceptable. Integration is below.
Pulse self-hosted
We deliver the entire intelligence set onto your machines and every lookup happens
inside your network — we never learn which addresses you checked. The interface is identical to the
online version. About Pulse self-hosted →
Integration
The same profiling capability, callable from your risk system. No registration needed to try it; sign in to create a key and raise the limit.
GEThttps://ip99.com/v1/ip/{ip}
# No key needed (anonymous allowance)
curl https://ip99.com/v1/ip/8.8.8.8
# With a key you create yourself, the allowance is per account
curl -H "X-API-Key: YOUR_KEY" https://ip99.com/v1/ip/8.8.8.8
To ask what the risk state was at a past moment (post-incident review,
chargeback arbitration), use ?at= on the Pulse endpoint:
GET /pulse/v1/ip/{ip}?at=2026-08-26T13:34:36Z (RFC3339, up to 30 days back; the returned
computed_at is exactly the moment you asked for). The profile endpoint on this page
answers for now only and does not accept at.
Pulse is professional-tier only: without a professional key it answers
403 professional_required, while the free profile stays open at /v1/ip;
for history, contact sales.
Response fields, allowances, error formats and the phone-number capability are all in the
API reference.
Coverage and refresh
10 risk signals
Proxy, VPN, dial-up pool, hijacked shared proxy, cloud phone, serverless egress, datacenter,
crawler, open-source intel and mobile network. Geolocation down to district level, with ASN.
10-second refresh
Risk data arrives incrementally within a minute and lands in seconds; the geolocation database is
rebuilt daily. Every response carries a data version, so you can archive the version alongside the
conclusion you acted on.
Contact sales
Higher allowances, self-hosted deployment, or a trial run against your own data — tell us the use case
and the rough volume.
Open the contact form →