IP Lookup

curl --request POST \
  --url https://encrata.com/api/agent/ip \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "ip": "<string>"
}
'

{
  "ip_address": "<string>",
  "reverse_dns": "<string>",
  "security": {
    "is_vpn": true,
    "is_proxy": true,
    "is_tor": true,
    "is_hosting": true,
    "is_relay": true,
    "is_mobile": true,
    "is_abuse": true,
    "is_static": true,
    "connection_type": "<string>",
    "provider_name": "<string>",
    "provider_type": "<string>"
  },
  "asn": {
    "asn": 123,
    "name": "<string>",
    "domain": "<string>",
    "type": "<string>"
  },
  "company": {
    "name": "<string>",
    "domain": "<string>",
    "type": "<string>"
  },
  "location": {
    "city": "<string>",
    "region": "<string>",
    "country": "<string>",
    "country_code": "<string>",
    "postal_code": "<string>",
    "continent": "<string>",
    "longitude": 123,
    "latitude": 123
  },
  "timezone": {
    "name": "<string>",
    "abbreviation": "<string>",
    "utc_offset": 123
  },
  "threat": {
    "abuse_score": 123,
    "total_reports": 123,
    "last_reported_at": "<string>",
    "usage_type": "<string>",
    "is_tor": true,
    "is_whitelisted": true,
    "distinct_users": 123,
    "is_scanner": true,
    "is_known_service": true,
    "classification": "<string>",
    "scanner_name": "<string>",
    "last_seen": "<string>"
  },
  "malware": {
    "malicious_count": 123,
    "suspicious_count": 123,
    "harmless_count": 123,
    "undetected_count": 123,
    "reputation": 123,
    "network": "<string>"
  },
  "network": {
    "cidr": "<string>",
    "range_start": "<string>",
    "range_end": "<string>",
    "name": "<string>",
    "rir": "<string>",
    "registrant_org": "<string>",
    "abuse_email": "<string>",
    "abuse_phone": "<string>",
    "allocated_at": "<string>",
    "country": "<string>"
  },
  "ports": {
    "ports": [
      123
    ],
    "services": [
      {}
    ],
    "software": [
      "<string>"
    ],
    "vulns": [
      "<string>"
    ],
    "tags": [
      "<string>"
    ],
    "hostnames": [
      "<string>"
    ]
  },
  "blocklist": {
    "listed": true,
    "lists": [
      "<string>"
    ],
    "checked": 123
  },
  "cloud": {
    "is_cloud": true,
    "provider": "<string>"
  },
  "bgp": {
    "prefix": "<string>",
    "announced": true,
    "upstreams": [
      "<string>"
    ],
    "peers": [
      "<string>"
    ]
  },
  "passive_dns": {
    "records": [
      {}
    ],
    "total_count": 123
  },
  "reputation_history": {
    "snapshots": [
      {}
    ],
    "trend": "<string>"
  },
  "routing_history": {
    "entries": [
      {}
    ],
    "origin_changes": 123,
    "possible_hijack": true
  },
  "tls": {
    "probed": true,
    "has_tls": true,
    "jarm": "<string>",
    "ja3s": "<string>",
    "tls_version": "<string>",
    "cipher_suite": "<string>",
    "certificate": {}
  },
  "c2": {
    "is_c2": true,
    "malware": "<string>",
    "botnet": "<string>",
    "first_seen": "<string>",
    "last_seen": "<string>",
    "confidence": "<string>",
    "source": "<string>"
  },
  "honeypot": {
    "is_honeypot": true,
    "confidence": "<string>",
    "reason": "<string>"
  },
  "certificates": {
    "total": 123,
    "domains": [
      "<string>"
    ],
    "recent": [
      {}
    ]
  },
  "peering": {
    "asn": 123,
    "org_name": "<string>",
    "network_name": "<string>",
    "info_type": "<string>",
    "traffic": "<string>",
    "website": "<string>",
    "ixps": [
      "<string>"
    ],
    "ix_count": 123
  },
  "fraud": {
    "scores": [
      {}
    ]
  },
  "threat_feeds": {
    "feeds": [
      {}
    ]
  }
}

Lookups

IP Lookup

Look up intelligence about an IP address — geolocation, VPN/proxy/Tor detection (with named provider), ASN, company, timezone, abuse reports, malware analysis, scanner classification, open ports & CVEs (Shodan InternetDB + Censys), crt.sh certificate transparency, PeeringDB operator/IXP context, proxy/fraud second opinions, extra threat-intel feeds, passive DNS history, reputation over time, routing/allocation history, TLS/JARM fingerprints, honeypot and C2 detection.

POST

api

agent

IP Lookup

curl --request POST \
  --url https://encrata.com/api/agent/ip \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "ip": "<string>"
}
'

{
  "ip_address": "<string>",
  "reverse_dns": "<string>",
  "security": {
    "is_vpn": true,
    "is_proxy": true,
    "is_tor": true,
    "is_hosting": true,
    "is_relay": true,
    "is_mobile": true,
    "is_abuse": true,
    "is_static": true,
    "connection_type": "<string>",
    "provider_name": "<string>",
    "provider_type": "<string>"
  },
  "asn": {
    "asn": 123,
    "name": "<string>",
    "domain": "<string>",
    "type": "<string>"
  },
  "company": {
    "name": "<string>",
    "domain": "<string>",
    "type": "<string>"
  },
  "location": {
    "city": "<string>",
    "region": "<string>",
    "country": "<string>",
    "country_code": "<string>",
    "postal_code": "<string>",
    "continent": "<string>",
    "longitude": 123,
    "latitude": 123
  },
  "timezone": {
    "name": "<string>",
    "abbreviation": "<string>",
    "utc_offset": 123
  },
  "threat": {
    "abuse_score": 123,
    "total_reports": 123,
    "last_reported_at": "<string>",
    "usage_type": "<string>",
    "is_tor": true,
    "is_whitelisted": true,
    "distinct_users": 123,
    "is_scanner": true,
    "is_known_service": true,
    "classification": "<string>",
    "scanner_name": "<string>",
    "last_seen": "<string>"
  },
  "malware": {
    "malicious_count": 123,
    "suspicious_count": 123,
    "harmless_count": 123,
    "undetected_count": 123,
    "reputation": 123,
    "network": "<string>"
  },
  "network": {
    "cidr": "<string>",
    "range_start": "<string>",
    "range_end": "<string>",
    "name": "<string>",
    "rir": "<string>",
    "registrant_org": "<string>",
    "abuse_email": "<string>",
    "abuse_phone": "<string>",
    "allocated_at": "<string>",
    "country": "<string>"
  },
  "ports": {
    "ports": [
      123
    ],
    "services": [
      {}
    ],
    "software": [
      "<string>"
    ],
    "vulns": [
      "<string>"
    ],
    "tags": [
      "<string>"
    ],
    "hostnames": [
      "<string>"
    ]
  },
  "blocklist": {
    "listed": true,
    "lists": [
      "<string>"
    ],
    "checked": 123
  },
  "cloud": {
    "is_cloud": true,
    "provider": "<string>"
  },
  "bgp": {
    "prefix": "<string>",
    "announced": true,
    "upstreams": [
      "<string>"
    ],
    "peers": [
      "<string>"
    ]
  },
  "passive_dns": {
    "records": [
      {}
    ],
    "total_count": 123
  },
  "reputation_history": {
    "snapshots": [
      {}
    ],
    "trend": "<string>"
  },
  "routing_history": {
    "entries": [
      {}
    ],
    "origin_changes": 123,
    "possible_hijack": true
  },
  "tls": {
    "probed": true,
    "has_tls": true,
    "jarm": "<string>",
    "ja3s": "<string>",
    "tls_version": "<string>",
    "cipher_suite": "<string>",
    "certificate": {}
  },
  "c2": {
    "is_c2": true,
    "malware": "<string>",
    "botnet": "<string>",
    "first_seen": "<string>",
    "last_seen": "<string>",
    "confidence": "<string>",
    "source": "<string>"
  },
  "honeypot": {
    "is_honeypot": true,
    "confidence": "<string>",
    "reason": "<string>"
  },
  "certificates": {
    "total": 123,
    "domains": [
      "<string>"
    ],
    "recent": [
      {}
    ]
  },
  "peering": {
    "asn": 123,
    "org_name": "<string>",
    "network_name": "<string>",
    "info_type": "<string>",
    "traffic": "<string>",
    "website": "<string>",
    "ixps": [
      "<string>"
    ],
    "ix_count": 123
  },
  "fraud": {
    "scores": [
      {}
    ]
  },
  "threat_feeds": {
    "feeds": [
      {}
    ]
  }
}

Authentication

Requires an API key in the Authorization header.

Authorization: Bearer YOUR_API_KEY

Request

string

required

The IP address to look up (IPv4 or IPv6).

Example request

curl -X POST "https://encrata.com/api/agent/ip" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip": "8.8.8.8"}'

Response

ip_address

string

The IP address that was looked up.

reverse_dns

string

The PTR (reverse DNS) record for the IP, if one exists.

security

object

Security/threat detection flags.

Show security fields

is_vpn

boolean

Whether the IP is a known VPN exit node.

is_proxy

boolean

Whether the IP is a known proxy server.

is_tor

boolean

Whether the IP is a Tor exit node.

is_hosting

boolean

Whether the IP belongs to a hosting/data center provider.

is_relay

boolean

Whether the IP is a known relay (e.g. iCloud Private Relay).

is_mobile

boolean

Whether the IP is from a mobile carrier.

is_abuse

boolean

Whether the IP has been flagged for abuse.

is_static

boolean

Whether the IP appears to be statically assigned (inferred from reverse DNS).

connection_type

string

Inferred connection type — "hosting", "mobile", "residential", or "business".

provider_name

string

Named VPN/proxy/Tor operator when one can be identified (e.g. "NordVPN", "Mullvad", "Bright Data").

provider_type

string

Provider category — "vpn", "residential_proxy", "datacenter_proxy", or "tor".

asn

object

Autonomous System Number details.

Show asn fields

asn

number

The AS number (e.g. 15169).

name

string

ASN organization name (e.g. "GOOGLE").

domain

string

Domain associated with the ASN.

type

string

ASN type — "isp", "hosting", "business", or "education".

company

object

Company or organization that owns the IP range.

Show company fields

name

string

Company name (e.g. "Google LLC").

domain

string

Company domain.

type

string

Company type — "isp", "hosting", "business", or "education".

location

object

Geolocation data.

Show location fields

city

string

City name.

region

string

Region/state name.

country

string

Full country name.

country_code

string

ISO 3166-1 alpha-2 country code.

postal_code

string

Postal/ZIP code.

continent

string

Continent name.

longitude

number

Longitude coordinate.

latitude

number

Latitude coordinate.

timezone

object

Timezone information.

Show timezone fields

name

string

IANA timezone name (e.g. "America/Los_Angeles").

abbreviation

string

Timezone abbreviation (e.g. "PDT").

utc_offset

number

UTC offset in hours (e.g. -7).

threat

object

Threat intelligence data.

Show threat fields

abuse_score

number

Abuse confidence score (0–100).

total_reports

number

Total abuse reports filed.

last_reported_at

string

ISO 8601 timestamp of last report.

usage_type

string

IP usage classification.

is_tor

boolean

Known Tor exit node.

is_whitelisted

boolean

Whitelisted as a known safe address.

distinct_users

number

Distinct reporters.

is_scanner

boolean

Observed scanning the internet.

is_known_service

boolean

Known benign service (e.g. search engine crawler, CDN).

classification

string

"malicious", "benign", or "unknown".

scanner_name

string

Identified scanner/service name.

last_seen

string

Last seen date (YYYY-MM-DD).

malware

object

Malware analysis results.

Show malware fields

malicious_count

number

Vendors flagging as malicious.

suspicious_count

number

Vendors flagging as suspicious.

harmless_count

number

Vendors classifying as harmless.

undetected_count

number

Vendors with no opinion.

reputation

number

Community reputation score.

network

string

CIDR network range.

network

object

Network allocation / WHOIS data from RDAP (free, no API key).

Show network fields

cidr

string

Allocated CIDR block (e.g. "8.8.8.0/24").

range_start

string

First IP in the allocated range.

range_end

string

Last IP in the allocated range.

name

string

Network/allocation name.

rir

string

Regional Internet Registry — "ARIN", "RIPE", "APNIC", "LACNIC", or "AFRINIC".

registrant_org

string

Organization the range is registered to.

abuse_email

string

Abuse contact email.

abuse_phone

string

Abuse contact phone number.

allocated_at

string

Allocation/registration date.

country

string

Registered country code.

ports

object

Open ports and exposed services from Shodan InternetDB and Censys (Censys requires a key).

Show ports fields

ports

number[]

List of open TCP ports (union of Shodan + Censys).

services

object[]

Per-port service labels — { port, service, banner } (e.g. { "port": 443, "service": "HTTPS" }).

software

string[]

Detected software (CPE identifiers).

vulns

string[]

Known CVE identifiers affecting the host.

Example response

200 OK

{
  "ip_address": "8.8.8.8",
  "reverse_dns": "dns.google",
  "security": {
    "is_vpn": false,
    "is_proxy": false,
    "is_tor": false,
    "is_hosting": true,
    "is_relay": false,
    "is_mobile": false,
    "is_abuse": false,
    "is_static": true,
    "connection_type": "hosting"
  },
  "asn": {
    "asn": 15169,
    "name": "GOOGLE",
    "domain": "google.com",
    "type": "hosting"
  },
  "company": {
    "name": "Google LLC",
    "domain": "google.com",
    "type": "hosting"
  },
  "location": {
    "city": "Mountain View",
    "region": "California",
    "country": "United States",
    "country_code": "US",
    "postal_code": "94043",
    "continent": "North America",
    "longitude": -122.0775,
    "latitude": 37.4056
  },
  "timezone": {
    "name": "America/Los_Angeles",
    "abbreviation": "PDT",
    "utc_offset": -7
  },
  "threat": {
    "abuse_score": 0,
    "total_reports": 87,
    "last_reported_at": "2026-05-10T14:22:00+00:00",
    "usage_type": "Data Center/Web Hosting/Transit",
    "is_tor": false,
    "is_whitelisted": true,
    "distinct_users": 42,
    "is_scanner": false,
    "is_known_service": true,
    "classification": "benign",
    "scanner_name": "Google DNS",
    "last_seen": "2026-05-11"
  },
  "malware": {
    "malicious_count": 0,
    "suspicious_count": 0,
    "harmless_count": 74,
    "undetected_count": 12,
    "reputation": 30,
    "network": "8.8.8.0/24"
  },
  "network": {
    "cidr": "8.8.8.0/24",
    "range_start": "8.8.8.0",
    "range_end": "8.8.8.255",
    "name": "GOGL",
    "rir": "ARIN",
    "registrant_org": "Google LLC",
    "abuse_email": "network-abuse@google.com",
    "allocated_at": "2014-03-14",
    "country": "US"
  },
  "ports": {
    "ports": [53, 443],
    "software": ["cpe:/a:google:dns"],
    "vulns": [],
    "tags": ["cdn"],
    "hostnames": ["dns.google"]
  },
  "blocklist": {
    "listed": false,
    "lists": [],
    "checked": 5
  },
  "cloud": {
    "is_cloud": true,
    "provider": "Google Cloud"
  },
  "bgp": {
    "prefix": "8.8.8.0/24",
    "announced": true,
    "upstreams": ["15169"],
    "peers": ["1299", "3356"]
  },
  "passive_dns": {
    "records": [
      { "domain": "dns.google", "record_type": "A", "first_seen": "2018-04-02", "last_seen": "2026-06-24", "source": "pdns" }
    ],
    "total_count": 1
  },
  "reputation_history": {
    "snapshots": [
      { "date": "2026-06-20", "abuse_score": 0, "malicious_count": 0, "listed": false, "is_c2": false, "classification": "benign", "threat_level": "clean" }
    ],
    "trend": "stable"
  },
  "routing_history": {
    "entries": [
      { "asn": 15169, "holder": "GOOGLE", "prefix": "8.8.8.0/24", "start_time": "2014-03-14", "end_time": "" }
    ],
    "origin_changes": 0,
    "possible_hijack": false
  },
  "tls": {
    "probed": true,
    "has_tls": true,
    "jarm": "27d40d40d29d40d1dc42d43d00041d4689ee210389f4f6b4b5b1b93f92252d",
    "tls_version": "TLS 1.3",
    "cipher_suite": "TLS_AES_256_GCM_SHA384",
    "certificate": {
      "subject_cn": "dns.google",
      "issuer_cn": "WR2",
      "sans": ["dns.google", "*.dns.google.com"],
      "not_after": "2026-08-18",
      "sha256": "a1b2c3...",
      "self_signed": false,
      "expired": false
    }
  },
  "c2": { "is_c2": false },
  "honeypot": { "is_honeypot": false },
  "certificates": {
    "total": 3,
    "domains": ["dns.google", "*.dns.google.com"],
    "recent": [
      { "common_name": "dns.google", "issuer": "WR2", "not_before": "2026-05-20", "not_after": "2026-08-18" }
    ]
  },
  "peering": {
    "asn": 15169,
    "org_name": "Google LLC",
    "network_name": "Google",
    "info_type": "Content",
    "traffic": "100+ Tbps",
    "website": "https://about.google",
    "ixps": ["DE-CIX Frankfurt", "AMS-IX", "LINX LON1"],
    "ix_count": 3
  },
  "fraud": {
    "scores": [
      { "source": "proxycheck.io", "score": 0, "risk": "low", "is_proxy": false, "is_vpn": false, "is_tor": false, "type": "Business" }
    ]
  },
  "threat_feeds": {
    "feeds": [
      { "source": "alienvault_otx", "malicious": false, "risk": "none", "pulses": 0 }
    ]
  }
}

Notes

This endpoint is free — no credits are deducted.
Supports both IPv4 and IPv6 addresses.
Results are cached — repeat lookups within the cache window are instant.
If a provider is unavailable, the response still includes data from the remaining providers.
Several sources are free / no API key (Shodan InternetDB, crt.sh, PeeringDB, GreyNoise community, proxycheck.io free tier). Others are enriched only when their API key is configured server-side (Censys, IPQualityScore, Spur, Scamalytics, IPHub, AlienVault OTX, Pulsedive) — fields like fraud, threat_feeds, certificates, and peering are omitted when no provider returns data.
Rate limited to 60 requests per minute.

Check Breaches Phone Lookup

​Authentication

​Request

​Example request

​Response

​Example response

​Notes

Authentication

Request

Example request

Response

Example response

Notes