{"uid":"cap_o01vM_Hy7NSErwUnd-T0m","slug":"ipintel-real-time-ip-scoring-api-0956d4fe","name":"IPIntel Real-Time IP Scoring API","description":"Pay-per-call IP lookup and risk intelligence API. Send an IPv4 or IPv6 address and receive JSON with risk score, risk label, ASN, ISP, organization, geolocation, reverse DNS, hosting/proxy/VPN/Tor signals, verified bot detection, scanner/honeypot indicators, and AI-powered subnet behavior analysis via x402 v2 on Base.","url":"https://api.ipintel.ai/x402v2?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"IPv4 or IPv6 address to analyze, passed as a query parameter"}},"additionalProperties":false}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"ip":{"type":"string","description":"Queried IPv4 or IPv6 address"},"asn":{"type":"string","description":"Autonomous system number"},"isp":{"type":"string","description":"Internet service provider"},"org":{"type":"string","description":"Organization name"},"city":{"type":"string","description":"City, when available"},"is_tor":{"type":"boolean","description":"Whether the IP appears to be a Tor exit node"},"country":{"type":"string","description":"Country code or country name"},"is_proxy":{"type":"boolean","description":"Whether the IP appears to be a proxy"},"confidence":{"type":"number","description":"Confidence percentage from 0 to 100"},"is_hosting":{"type":"boolean","description":"Whether the IP appears to belong to hosting/cloud infrastructure"},"risk_label":{"type":"string","description":"Human-readable risk label"},"risk_score":{"type":"number","description":"Risk score from 0 to 100"},"reverse_dns":{"type":"string","description":"Reverse DNS hostname, when available"},"threat_summary":{"type":"string","description":"Short natural-language threat assessment"},"is_verified_bot":{"type":"boolean","description":"Whether the IP appears to be a verified known bot"}},"additionalProperties":true}}}}},"responseSchema":{"type":"json","example":{"ip":"8.8.8.8","asn":"AS15169","isp":"Google LLC","org":"Google Public DNS","city":"Ashburn","is_tor":false,"country":"US","is_proxy":false,"confidence":100,"is_hosting":true,"risk_label":"Safe","risk_score":15,"reverse_dns":"dns.google","threat_summary":"This IP is considered safe and does not pose a threat. Only minimal and non-threatening activity has been observed.","is_verified_bot":false}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_P6TNbu24Paglq0FoPBpQu","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes an IPv4 or IPv6 address and returns a risk score, proxy/hosting/Tor detection, ISP, ASN, country, and a human-readable safety summary.","exampleAgentPrompt":"Can you check whether the IP address 203.0.113.47 looks safe or suspicious — is it a proxy, Tor exit node, or hosted on a data center, and what's its risk score?","exampleUseCases":null,"resultDescription":"Returns a JSON object containing the analyzed IP address, a numeric risk score (0–100), a status string (e.g. 'safe'), boolean flags for proxy, hosting, and Tor exit node, the ISP name, ASN, country, a plain-language summary, and x402 payment metadata confirming the paid request.","failureModes":["Missing or malformed IP parameter returns an error response","Invalid IP string format (non-IP text) may return an error or low-confidence result","IP not found in database returns partial data with nulls","Payment not completed or x402 handshake failure returns 402 Payment Required","Rate limit exceeded returns 429 Too Many Requests","IPv6 addresses in unusual notation may not be recognized"],"whenToPreferThis":"Choose this endpoint when you need a real-time, per-IP risk assessment with proxy, hosting, and Tor detection in a single call. It is ideal for fraud prevention, account security checks, and traffic filtering where you need a fast numeric risk score plus structured flags. Prefer it over generic geolocation APIs when threat intelligence (proxy/VPN/Tor/hosting detection) is required alongside location data.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T12:36:52.776Z","isFirstParty":false,"canonicalSlug":"ipintel-real-time-ip-scoring-api-0956d4fe"}