Can it tell which state an applicant connects from?

Yes, on a paid plan: location.region and region_code name the state or province, with the city and an accuracy radius. Unlimited answers the country.

Will customers banking on their phones be flagged?

No. A mobile carrier's address answers as ordinary traffic, and is_carrier marks it on every plan. Only an address that's also resold as a proxy answers is_mobproxy, on a paid plan.

How do we explain a decision later?

Store the answer with the account or the payment. Each paid flag's object names who runs the address and the last day it was seen as that, so the reason for a hold stays on record.

Can a wrongly flagged address be corrected?

Yes. Send it to us with what you know about it, and a correction lands in the next build, so the same customer isn't held twice.

Screen sign-ups and log-ins by where they connect.

A KYC check reads the documents, not the connection. One lookup adds the country and region, whose network the address is on and whether it hides behind a VPN, a proxy or Tor, so your rules can ask for more before an account opens.

Get a free API key See pricing →

Unlimited lookups, no key needed · Sign up to try every field, no card

Onboarding queue

Example

New account
203.0.113.24
VPNProton VPNExtra checks
Wire request
198.51.100.7
Tehran, IranRefused
Log-in
192.0.2.140
HostingSecond factor
Card payment
203.0.113.91
CarrierVodafone UKApproved

The risks one lookup flags before money moves.

KYC and onboarding
An applicant's documents name one country and the connection comes from another. Ask for more when the country, or a VPN, disagrees with the application.
Answered bylocation.countryis_vpn
Sanctioned regions
Your rules bar customers in sanctioned countries and regions. Refuse them by country, and on a paid plan by state or province.
Answered bylocation.countrylocation.region_code
Account takeover
A log-in comes from a hosting server or a residential proxy the account has never used. Ask for a second factor before the session starts.
Answered byis_hostingis_resproxy
Mule and bot accounts
A run of new accounts opens from one network or from datacenter proxies. Hold the batch for review by the network behind it.
Answered byasnis_dcproxy

One answer covers place, network and anonymity.

Tor, relays, the country, the network and the company answer with no key and no daily or monthly cap. VPN, proxy and hosting flags and the region come with every paid plan, and Pricing lists every field by plan.

location.country
The country, to check against the application or the card.Unlimited
location.region_code
The ISO 3166-2 region code, such as a state, for rules finer than a country.Paid plans
asn, company
The network announcing the address and the organization using it.Unlimited
is_tor, is_relay
Tor nodes, and privacy relays such as iCloud Private Relay.Unlimited
is_vpn
A commercial VPN's exit, with the service named.Paid plans
is_resproxy, is_dcproxy
Residential and datacenter proxy exits, with the last day each was seen.Paid plans
is_hosting
A hosting or cloud server rather than a home or mobile line.Paid plans

Check the address where the risk starts.

01
At onboarding
Look up the applicant's address beside the KYC check. A country that disagrees with the documents, or a VPN, sends the application to review rather than refusing it.
02
At log-in
Compare the address with the account's usual country and network. A hosting server or a proxy asks for a second factor before the session starts.
03
Before money moves
Check the address again on a transfer or a payout. A sanctioned country or region stops it, and storing the answer with the payment keeps the reason on record.

Start free, then add every field.

The same code runs with no key and with one: without a key it answers the free fields, and an upgrade adds the rest with no change to the code.

1
Call it with no key
Unlimited
Run the code on this page as it is, with no account.
2
Sign up for a key
No card
Your account's first 100 lookups each day answer every field, so you can try the VPN, proxy and hosting checks on real applications.
3
Upgrade for every lookup
From $39 a month
Every paid plan answers every field on every lookup, and takes up to 1,000 lookups in one request.

Get a free API key See pricing →

import { InternetData } from "@internetdata/internetdata";
 
// No key needed. With one, every field answers.
const client = new InternetData({ apiKey: process.env.INTERNETDATA_API_KEY });
 
export async function screenApplicant(req, application) {
    const r = await client.lookup(req.ip);
    if (SANCTIONED.has(r.location.country)) {
        return refuse(application);
    }
    // VPNs, proxies and hosting answer on a paid plan.
    if (r.isTor || r.isVpn || r.isResproxy || (r.isHosting && !r.isRelay)
        || r.location.country !== application.country) {
        return askForMore(application);
    }
    return approve(application);
}

onboard.mjsnpm install @internetdata/internetdata

Also available for Web, .NET, Ruby, Rust, Swift, Erlang, Perl and Zig. See all on GitHub →

Or start fromProgramming SDKs Framework middlewares IP lookup reference

Common questions

Read the docs →API reference →Email support →

On this page

Does it replace a KYC provider?

No. It adds the connection to a KYC check: where the address is, whose network it's on and whether it hides behind a VPN, a proxy or Tor. Document and identity checks stay with your KYC provider.

Other industries

All industries →

00 · Unlimited

Unlimited lookups, no sign-up.

Paste it into a terminal. Any address answers with its country, network, company and hostname, with no key and no daily or monthly cap. ASes and domains answer too.

curl https://api.internetdata.io/8.8.8.8

{
"ip": "8.8.8.8",
"is_bogon": false,
"is_tor": false,
"is_relay": false,
"is_anycast": true,
"is_carrier": false,
"is_satellite": false,
"is_ssh": false,
"is_smtp": false,
"is_web": true,
"is_dns_resolver": true,
"is_bittorrent": false,
"hostname": "dns.google",
"location": {
"continent": "NA",
"continent_name": "North America",
"country": "US",
"country_name": "United States",
"timezone": "America/Los_Angeles",
"currency_code": "USD",
"currency_name": "Dollar",
"currency_symbol": "$",
"flag_emoji": "🇺🇸",
"flag_unicode": "U+1F1FA U+1F1F8"
},
"asn": {
"asn": 15169,
"name": "Google LLC",
"domain": "google.com",
"type": "hosting",
"prefix": "8.8.8.0/24"
},
"company": {
"name": "Google LLC",
"domain": "google.com"
},
"tor": {},
"relay": {},
"abuse": {
"email": "network-abuse@google.com"
}
}

01 · Every field

All of the data on a paid plan.

VPN, proxy, hosting and CDN flags, each naming the operator.

Location to the city, with coordinates and an accuracy radius.

WHOIS records, the whole abuse contact and the services an address runs.

Up to 1,000 addresses, ASes and domains in one request.

A free API key answers every field for its first 100 lookups each day, with no card.

See pricing Get a free API key

Screen sign-ups and log-ins by where they connect.

The risks one lookup flags before money moves.

KYC and onboarding

Sanctioned regions

Account takeover

Mule and bot accounts

One answer covers place, network and anonymity.

Check the address where the risk starts.

At onboarding

At log-in

Before money moves