Field reference · ipscope Docs

Both the REST API and the downloadable databases (.mmdb, .csv.gz, .parquet) use the same canonical field structure. Expand any nested intelligence block below to inspect its fields.

Complete response

{
  "ip": "198.51.100.7",
  "ip_version": 4,
  "matched_network": "198.51.100.0/24",
  "geo": {
    "country_code": "US",
    "declared_country_code": "US",
    "physical_country_code": "US",
    "is_virtual_location": false,
    "location_type": "physical",
    "confidence": 0.94,
    "subdivision": "Virginia",
    "city": "Ashburn",
    "postal_code": "20147",
    "latitude": 39.0438,
    "longitude": -77.4874,
    "accuracy_radius_km": 10,
    "timezone": "America/New_York"
  },
  "network": {
    "asn": 64501,
    "organization": "Example Cloud LLC"
  },
  "connection": {
    "connection_type": "hosting",
    "is_hosting": true,
    "is_residential": false,
    "is_mobile": false,
    "is_business": false
  },
  "security": {
    "is_vpn": true,
    "is_hosting": true,
    "is_tor_exit": false,
    "is_proxy": false,
    "anonymizer_type": "vpn",
    "confidence": 0.96,
    "reason_codes": [
      "vpn_handshake_confirmed",
      "datacenter_asn_range"
    ]
  },
  "security_extensions": {
    "abuse_velocity_score": 18,
    "is_known_scanner": false,
    "observation_recency_hours": 12,
    "anonymizer_reason": "vpn_handshake_confirmed",
    "threat_level": "medium",
    "abuse_velocity": "low",
    "confidence": 0.96
  },
  "dataset_version": "2026-10-27T00:00:00Z.crawl-1793088000000",
  "updated_at": "2026-10-27T00:00:00Z"
}

Top-level & intelligence blocks

ipstringrequired
Canonical representation of the queried IPv4 or IPv6 address.
ip_version4 | 6required
IP protocol version (4 for IPv4, 6 for IPv6).
matched_networkstringrequired
Longest-matching routed CIDR prefix in the IPScope routing tree (e.g. "198.51.100.0/24").
bogonboolean
Present and true only on reserved, private (RFC 1918), loopback, or unrouted addresses.
geoobject
Country and city geolocation (geo_country and geo_city families).
13 fields
- country_codestring | null
  Effective ISO 3166-1 alpha-2 country code ("US", "DE", "TR").
- declared_country_codestring | null
  Country code registered in RIR WHOIS/RDAP allocation records.
- physical_country_codestring | null
  Country code where the prefix is physically routed and serving traffic.
- is_virtual_locationboolean
  true when declared_country_code differs from physical_country_code (geofeed-relocated or cross-border announced prefix).
- location_type'physical' | 'geofeed_declared' | 'anycast' | 'unknown'
  How the effective location was resolved.
- confidencenumber
  Calibrated geolocation confidence score in [0.0, 1.0].
- subdivisionstring | null
  First-level administrative region or state ("Virginia", "California", "Hesse"). Included with geo_city.
- citystring | null
  English city name ("Ashburn", "Frankfurt am Main"). Included with geo_city.
- postal_codestring | null
  Postal or ZIP code nearest the prefix centroid. Included with geo_city.
- latitudenumber | null
  WGS 84 latitude of the resolved area centroid. Included with geo_city.
- longitudenumber | null
  WGS 84 longitude of the resolved area centroid. Included with geo_city.
- accuracy_radius_kmnumber | null
  Estimated radius in kilometres around (latitude, longitude) covering the prefix’s endpoints.
- timezonestring | null
  IANA time zone identifier ("America/New_York", "Europe/Berlin").
networkobject
BGP origin autonomous system (network family).
2 fields
- asnnumber | null
  Origin Autonomous System Number without the AS prefix (64501, 13335).
- organizationstring | null
  Registered organization or network operator name ("Cloudflare, Inc.").
connectionobject
Access network classification (connection family).
5 fields
- connection_type'residential' | 'mobile' | 'business' | 'hosting' | 'unknown'
  Primary access network classification.
- is_hostingboolean
  true for cloud providers, colocation facilities, and dedicated server networks.
- is_residentialboolean
  true for consumer fixed-line broadband (FTTH, cable, DSL) ISPs.
- is_mobileboolean
  true for cellular carrier gateways (4G/5G CGNAT pools).
- is_businessboolean
  true for enterprise leased lines and corporate autonomous systems.
securityobject
VPN, proxy, Tor, and hosting detection (anonymity family).
6 fields
- is_vpnboolean
  true when the address is an active commercial or self-hosted VPN exit node.
- is_hostingboolean
  true when routed by a datacenter, cloud, or hosting ASN.
- is_tor_exitboolean
  true when listed in the active Tor Project exit consensus.
- is_proxyboolean
  true for open HTTP/SOCKS proxies and residential proxy relays.
- anonymizer_type'none' | 'vpn' | 'tor' | 'proxy' | 'relay' | 'hosting'
  Primary anonymizer classification.
- confidencenumber
  Calibrated anonymity confidence score in [0.0, 1.0].
security_extensionsobject
Explainable reason codes and abuse telemetry (security_extensions family).
4 fields
- anonymizer_reasonstring | null
  Deterministic evidence code ("vpn_handshake_confirmed", "tor_consensus_exit", "datacenter_asn_range", "clean_access_network").
- threat_level'low' | 'medium' | 'high'
  Composite risk tier derived from anonymizer state and abuse velocity.
- abuse_velocity'none' | 'low' | 'medium' | 'high'
  Recent scanner and brute-force telemetry activity observed from this prefix.
- confidencenumber
  Confidence score in [0.0, 1.0] for the extended threat assessment.
dataset_versionstringrequired
Identifier of the compiled IPScope dataset snapshot that answered the lookup.
updated_atstringrequired
ISO 8601 UTC timestamp when the snapshot was published.