IP Intelligence

Request

All business routes use POST with an IPv4 or IPv6 address:

{ "ip": "1.1.1.1" }

Authenticate with Authorization: Bearer <API_KEY>. All routes require the tools plan feature.

Route	Cost
`GET /tools/ip-intelligence`	Free
`GET /tools/ip-intelligence/infos`	Free
`GET /tools/ip-intelligence/costs`	Free
`POST /tools/ip-intelligence/geo`	Free
`POST /tools/ip-intelligence/network`	Free
`POST /tools/ip-intelligence/bgp`	Free
`POST /tools/ip-intelligence/whois`	Free
`POST /tools/ip-intelligence/rdns`	Free
`POST /tools/ip-intelligence/risk`	Free
`POST /tools/ip-intelligence/ports`	core_search(1)
`POST /tools/ip-intelligence/reputation`	core_search(1)
`POST /tools/ip-intelligence/hosted-domains`	core_search(1)
`POST /tools/ip-intelligence/all`	core_search(1)

Complete lookup

curl -X POST "$API_URL/tools/ip-intelligence/all" \
  -H "Authorization: Bearer $OSINTLY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip":"1.1.1.1","save":true}'

Responses use { tool, operation, query, data, meta }. /all returns geo, network, bgp, whois, rdns, ports, reputation, hostedDomains, merged hostnames, risk, collectedSections and partialErrors. save: true on /all saves the response and returns meta.savedResult.id. Read it with GET /tools/results/:id; no enrichment is re-executed on retrieval. Saving a partial lookup stores only the data collected in that request.

Progressive loading

Start with the account-independent location and network data:

{ "ip": "1.1.1.1", "sections": ["geo", "network"], "save": true }

sections is optional and accepted only by /all. Values: geo, network, bgp, whois, rdns, risk, ports, reputation, hosted-domains. Omission runs the complete lookup. Unrequested collectors are not called; their fields are null. Geo/network share a provider request. /all costs 1 regardless of selection; subsequent split requests retain their listed price.

Data coverage

The app provides an interactive map for available coordinates and clickable hostnames/IP addresses to start another saved lookup. Location is approximate network geolocation, not a person’s location. Map tiles load separately from the intelligence API. bgp.routing includes observation time, first/last observed routes, RIS visibility, origins, and more/less-specific prefixes. bgp.rpki gives the validity of the primary prefix/ASN pair; null means unavailable, not valid. Secondary routing failures preserve BGP results and populate bgp.partialErrors with generic messages. whois also exposes registry status, notices, remarks, links and IP version. reputation.otx.reports includes up to 20 available reports with dates, descriptions, tags and references. Reports mentioning an IP are investigative leads, not proof of malicious activity.

Location: country, region, city, postal code, coordinates and time zone. Coordinates describe an approximate network location, not a person’s location.
Network: ASN, ASN name, ISP, organization, reverse hostname and hosting/mobile/proxy indicators.
BGP: containing prefix, available announcing ASNs and allocation metadata. A routing fallback may not expose allocation or organization details.
Registration: address range, registry handle, dates, events and available registrant, abuse, technical, NOC and routing contacts.
Services: passively observed ports, hostnames, CPE software identifiers, tags and reported CVEs. This is not a live scan and does not confirm current exploitability.
Reputation: DNS blocklist observations, Tor signals and available threat reports. Missing sources are null, not a clean verdict.
Hosted domains: public reverse-IP observations; coverage is not exhaustive and does not prove common ownership.

The free /risk route summarizes network flags only. /all adds the available reputation and vulnerability observations when those sections are selected. A zero score is not a safety guarantee.

Response example

A POST /tools/ip-intelligence/all response for 1.1.1.1. Lists are shortened to one item; counts show the full size.

IP Intelligence /all response

{
  "data": {
    "partialErrors": [],
    "collectedSections": [
      "geo",
      "network",
      "bgp",
      "whois",
      "rdns",
      "risk",
      "ports",
      "reputation",
      "hosted-domains"
    ],
    "bgp": {
      "routing": {
        "observedAt": "2026-11-12T16:00:00",
        "firstSeen": {
          "prefix": "1.1.1.0/24",
          "origin": "19855",
          "time": "2001-11-14T00:00:00"
        },
        "lastSeen": {
          "prefix": "1.1.1.0/24",
          "origin": "13335",
          "time": "2026-11-12T16:00:00"
        },
        "visibility": {
          "v4": {
            "ris_peers_seeing": 234,
            "total_ris_peers": 235
          },
          "v6": {
            "ris_peers_seeing": 0,
            "total_ris_peers": 0
          }
        },
        "origins": [
          {
            "origin": 13335,
            "route_objects": [
              "APNIC"
            ]
          }
        ],
        "lessSpecifics": [],
        "moreSpecifics": []
      },
      "rpki": {
        "status": "valid",
        "prefix": "1.1.1.0/24",
        "asn": "13335"
      },
      "partialErrors": [],
      "prefixes": [
        {
          "prefix": "1.1.1.0/24",
          "ip": "1.1.1.1",
          "cidr": 24,
          "asn": {
            "asn": 13335,
            "country_code": "",
            "description": "",
            "name": ""
          }
        }
      ],
      "allocation": null,
      "prefix": {
        "asDescription": "",
        "asName": "",
        "asn": 13335,
        "cidr": 24,
        "countryCode": "",
        "prefix": "1.1.1.0/24"
      },
      "ptrRecord": null
    },
    "geo": {
      "city": "South Brisbane",
      "continent": "Oceania",
      "coordinates": {
        "latitude": -27.4766,
        "longitude": 153.0166
      },
      "country": "Australia",
      "countryCode": "AU",
      "region": "Queensland",
      "regionCode": "QLD",
      "timezone": "Australia/Brisbane",
      "zip": "4101"
    },
    "hostedDomains": {
      "domains": [
        "site-a.example.net"
      ],
      "total": 500
    },
    "hostnames": [
      "one.one.one.one",
      "host-a.example.com",
      "host-b.example.org"
    ],
    "network": {
      "asName": "CLOUDFLARENET",
      "asn": "AS13335 Cloudflare, Inc.",
      "isHosting": true,
      "isMobile": false,
      "isProxy": false,
      "isp": "Cloudflare, Inc",
      "organization": "APNIC and Cloudflare DNS Resolver project",
      "reverse": "one.one.one.one"
    },
    "ports": {
      "cpes": [
        "cpe:/a:cloudflare:cloudflare"
      ],
      "hostnames": [
        "one.one.one.one",
        "host-a.example.com",
        "host-b.example.org"
      ],
      "ports": [
        53
      ],
      "tags": [
        "pqc"
      ],
      "vulns": []
    },
    "reputation": {
      "dnsbl": {
        "checked": [
          "zen.spamhaus.org",
          "bl.spamcop.net",
          "dnsbl.sorbs.net",
          "psbl.surriel.com",
          "b.barracudacentral.org",
          "dnsbl-1.uceprotect.net",
          "ix.dnsbl.manitu.net",
          "all.s5h.net"
        ],
        "ip": "1.1.1.1",
        "isTor": false,
        "listedIn": []
      },
      "otx": {
        "isMalicious": false,
        "reports": [],
        "pulseCount": 0,
        "reputation": 0,
        "topPulses": []
      },
      "urlhaus": {
        "blacklists": [],
        "queryStatus": "no_results",
        "urlCount": 0
      }
    },
    "risk": {
      "labels": [
        "Hosting / Datacenter"
      ],
      "score": 0
    },
    "rdns": {
      "hostnames": [
        "one.one.one.one"
      ],
      "ptrName": "1.1.1.1.in-addr.arpa"
    },
    "whois": {
      "events": [
        {
          "eventAction": "registration",
          "eventDate": "2011-08-10T23:12:35Z"
        }
      ],
      "ipVersion": "v4",
      "status": [
        "active"
      ],
      "startAddress": "1.1.1.0",
      "endAddress": "1.1.1.255",
      "contacts": {
        "technical": {
          "name": "APNICRANDNET Infrastructure Contact",
          "phone": "+1.0000000000",
          "email": "[email protected]",
          "handle": "AIC3-AP"
        },
        "abuse": {
          "name": "IRT-APNICRANDNET-AU",
          "email": "[email protected]",
          "handle": "IRT-APNICRANDNET-AU"
        },
        "registrant": {
          "name": "APNIC Research and Development",
          "phone": "+1.0000000000",
          "email": "[email protected]",
          "handle": "ORG-ARAD1-AP"
        }
      },
      "country": "AU",
      "handle": "1.1.1.0 - 1.1.1.255",
      "name": "APNIC-LABS",
      "parentHandle": null,
      "range": "1.1.1.0 - 1.1.1.255",
      "rdapLink": "https://rdap.apnic.net/ip/1.1.1.0/24",
      "registeredAt": "2011-08-10",
      "type": "ASSIGNED PORTABLE",
      "updatedAt": "2023-04-26",
      "whoisServer": "whois.apnic.net"
    }
  },
  "meta": {
    "timestamp": "2026-11-13T10:00:00.000Z"
  },
  "operation": "all",
  "query": {
    "ip": "1.1.1.1"
  },
  "tool": "ip-intelligence"
}

Individual endpoints

Each endpoint returns the same envelope with its own operation and query. Examples are anonymized and lists are shortened to one item.

POST /tools/ip-intelligence/geo

{
  "data": {
    "city": "South Brisbane",
    "continent": "Oceania",
    "coordinates": {
      "latitude": -27.4766,
      "longitude": 153.0166
    },
    "country": "Australia",
    "countryCode": "AU",
    "region": "Queensland",
    "regionCode": "QLD",
    "timezone": "Australia/Brisbane",
    "zip": "4101"
  },
  "meta": {
    "timestamp": "2026-11-13T10:00:00.000Z"
  },
  "operation": "geo",
  "query": {
    "ip": "1.1.1.1"
  },
  "tool": "ip-intelligence"
}

POST /tools/ip-intelligence/network

{
  "data": {
    "asName": "CLOUDFLARENET",
    "asn": "AS13335 Cloudflare, Inc.",
    "isHosting": true,
    "isMobile": false,
    "isProxy": false,
    "isp": "Cloudflare, Inc",
    "organization": "APNIC and Cloudflare DNS Resolver project",
    "reverse": "one.one.one.one"
  },
  "meta": {
    "timestamp": "2026-11-13T10:00:00.000Z"
  },
  "operation": "network",
  "query": {
    "ip": "1.1.1.1"
  },
  "tool": "ip-intelligence"
}

POST /tools/ip-intelligence/bgp

{
  "data": {
    "routing": {
      "observedAt": "2026-11-12T16:00:00",
      "firstSeen": {
        "prefix": "1.1.1.0/24",
        "origin": "19855",
        "time": "2001-11-14T00:00:00"
      },
      "lastSeen": {
        "prefix": "1.1.1.0/24",
        "origin": "13335",
        "time": "2026-11-12T16:00:00"
      },
      "visibility": {
        "v4": {
          "ris_peers_seeing": 234,
          "total_ris_peers": 235
        },
        "v6": {
          "ris_peers_seeing": 0,
          "total_ris_peers": 0
        }
      },
      "origins": [
        {
          "origin": 13335,
          "route_objects": [
            "APNIC"
          ]
        }
      ],
      "lessSpecifics": [],
      "moreSpecifics": []
    },
    "rpki": {
      "status": "valid",
      "prefix": "1.1.1.0/24",
      "asn": "13335"
    },
    "partialErrors": [],
    "prefixes": [
      {
        "prefix": "1.1.1.0/24",
        "ip": "1.1.1.1",
        "cidr": 24,
        "asn": {
          "asn": 13335,
          "country_code": "",
          "description": "",
          "name": ""
        }
      }
    ],
    "allocation": null,
    "prefix": {
      "asDescription": "",
      "asName": "",
      "asn": 13335,
      "cidr": 24,
      "countryCode": "",
      "prefix": "1.1.1.0/24"
    },
    "ptrRecord": null
  },
  "meta": {
    "timestamp": "2026-11-13T10:00:00.000Z"
  },
  "operation": "bgp",
  "query": {
    "ip": "1.1.1.1"
  },
  "tool": "ip-intelligence"
}

POST /tools/ip-intelligence/whois

{
  "data": {
    "events": [
      {
        "eventAction": "registration",
        "eventDate": "2011-08-10T23:12:35Z"
      }
    ],
    "ipVersion": "v4",
    "status": [
      "active"
    ],
    "startAddress": "1.1.1.0",
    "endAddress": "1.1.1.255",
    "contacts": {
      "technical": {
        "name": "APNICRANDNET Infrastructure Contact",
        "phone": "+1.0000000000",
        "email": "[email protected]",
        "handle": "AIC3-AP"
      },
      "abuse": {
        "name": "IRT-APNICRANDNET-AU",
        "email": "[email protected]",
        "handle": "IRT-APNICRANDNET-AU"
      },
      "registrant": {
        "name": "APNIC Research and Development",
        "phone": "+1.0000000000",
        "email": "[email protected]",
        "handle": "ORG-ARAD1-AP"
      }
    },
    "country": "AU",
    "handle": "1.1.1.0 - 1.1.1.255",
    "name": "APNIC-LABS",
    "parentHandle": null,
    "range": "1.1.1.0 - 1.1.1.255",
    "rdapLink": "https://rdap.apnic.net/ip/1.1.1.0/24",
    "registeredAt": "2011-08-10",
    "type": "ASSIGNED PORTABLE",
    "updatedAt": "2023-04-26",
    "whoisServer": "whois.apnic.net"
  },
  "meta": {
    "timestamp": "2026-11-13T10:00:00.000Z"
  },
  "operation": "whois",
  "query": {
    "ip": "1.1.1.1"
  },
  "tool": "ip-intelligence"
}

POST /tools/ip-intelligence/rdns

{
  "data": {
    "hostnames": [
      "one.one.one.one"
    ],
    "ptrName": "1.1.1.1.in-addr.arpa"
  },
  "meta": {
    "timestamp": "2026-11-13T10:00:00.000Z"
  },
  "operation": "rdns",
  "query": {
    "ip": "1.1.1.1"
  },
  "tool": "ip-intelligence"
}

POST /tools/ip-intelligence/risk

{
  "data": {
    "labels": [
      "Hosting / Datacenter"
    ],
    "score": 0
  },
  "meta": {
    "timestamp": "2026-11-13T10:00:00.000Z"
  },
  "operation": "risk",
  "query": {
    "ip": "1.1.1.1"
  },
  "tool": "ip-intelligence"
}

POST /tools/ip-intelligence/ports

{
  "data": {
    "cpes": [
      "cpe:/a:cloudflare:cloudflare"
    ],
    "hostnames": [
      "one.one.one.one",
      "host-a.example.com",
      "host-b.example.org"
    ],
    "ports": [
      53
    ],
    "tags": [
      "pqc"
    ],
    "vulns": []
  },
  "meta": {
    "timestamp": "2026-11-13T10:00:00.000Z"
  },
  "operation": "ports",
  "query": {
    "ip": "1.1.1.1"
  },
  "tool": "ip-intelligence"
}

POST /tools/ip-intelligence/reputation

{
  "data": {
    "dnsbl": {
      "checked": [
        "zen.spamhaus.org",
        "bl.spamcop.net",
        "dnsbl.sorbs.net",
        "psbl.surriel.com",
        "b.barracudacentral.org",
        "dnsbl-1.uceprotect.net",
        "ix.dnsbl.manitu.net",
        "all.s5h.net"
      ],
      "ip": "1.1.1.1",
      "isTor": false,
      "listedIn": []
    },
    "otx": {
      "isMalicious": false,
      "reports": [],
      "pulseCount": 0,
      "reputation": 0,
      "topPulses": []
    },
    "urlhaus": {
      "blacklists": [],
      "queryStatus": "no_results",
      "urlCount": 0
    }
  },
  "meta": {
    "timestamp": "2026-11-13T10:00:00.000Z"
  },
  "operation": "reputation",
  "query": {
    "ip": "1.1.1.1"
  },
  "tool": "ip-intelligence"
}

POST /tools/ip-intelligence/hosted-domains

{
  "data": {
    "domains": [
      "site-a.example.net"
    ],
    "total": 500
  },
  "meta": {
    "timestamp": "2026-11-13T10:00:00.000Z"
  },
  "operation": "hosted-domains",
  "query": {
    "ip": "1.1.1.1"
  },
  "tool": "ip-intelligence"
}

Cache and errors

Collector cache: geo/network and reverse DNS 1h; BGP and hosted domains 12h; registration 24h; services 6h; reputation 30min. Cache hits do not alter pricing. Invalid input returns 400 VALIDATION_ERROR. Split provider failures return generic 502 PROVIDER_ERROR or 504 PROVIDER_TIMEOUT. /all preserves successful collectors and reports failed ones in partialErrors, without exposing provider error text. Some reputation details can be missing when their source is unavailable.

Overview

Tools Endpoints