How do I look up an IP address?

Send a GET request to https://api.ipctl.io/v1/ip/{ip}. The response includes geolocation, ASN, BGP routing data, RPKI validation status, and a threat score. No API key is required for single lookups.

An Autonomous System Number (ASN) identifies a network on the internet that controls a specific set of IP prefixes and participates in BGP routing. Use /v1/asn/{asn} to look up any ASN.

How does threat scoring work?

ipctl correlates signals across independent threat intelligence sources. The composite score (0–100) uses a diminishing-returns formula — independent confirmations increase the score, but redundant signals are weighted down to prevent inflation.

Yes. The free tier includes 1,000 requests per day with no API key required for basic lookups. Paid plans start at €19/month for higher rate limits and bulk endpoints.

What data does ipctl provide?

ipctl provides IP geolocation, ASN details, BGP routing data, RPKI validation, prefix information, and threat intelligence. Data is sourced from RIR registries and other authoritative Internet infrastructure sources, updated regularly.

API Documentation

RESTful JSON API for IP address, ASN, and network intelligence.

Quick Start

No API key required for basic lookups

curl https://api.ipctl.io/v1/ip/1.1.1.1

# Response:
{
  "data": {
    "ip": "1.1.1.1",
    "ip_version": 4,
    "reverse_dns": "one.one.one.one",
    "is_bogon": false,
    "asn": { "asn": 13335, "name": "CLOUDFLARENET", ... },
    "geo": { "country_code": "US", "country_name": "United States", ... },
    "threat_score": 0,
    "tags": []
  }
}

# Threat intelligence (separate endpoint, 1 credit):
curl https://api.ipctl.io/v1/intel/1.1.1.1

# Response:
{
  "data": {
    "score": 60,
    "intel": [
      { "tag": "tor-node", "severity": "medium" },
      { "tag": "c2", "severity": "critical" }
    ]
  }
}

With API key for higher rate limits

curl https://api.ipctl.io/v1/ip/1.1.1.1 \
  -H "X-API-Key: nq_your_key_here"

# Or via Bearer token:
curl https://api.ipctl.io/v1/ip/1.1.1.1 \
  -H "Authorization: Bearer nq_your_key_here"

Authentication

API keys start with nq_. Pass them via X-API-Key header or Authorization: Bearer nq_xxx.

Rate limit headers are returned on every response:

X-RateLimit-Limit: 30
X-RateLimit-Remaining: 29
X-RateLimit-Reset: <unix timestamp, 60s from now>
X-RateLimit-Limit-Day: 2000
X-RateLimit-Remaining-Day: 1999
X-RateLimit-Credits-Remaining: 49999
X-RateLimit-Credits-Reset: <start of next calendar month, ISO 8601>

Endpoints

GET/v1/ip/{ip}

1 credit

IP address lookup: geolocation, ASN, BGP routes, RPKI status, and an overall threat score.

curl https://api.ipctl.io/v1/ip/1.1.1.1

GET/v1/intel/{ip}

1 credit

Threat intelligence for an IP: overall score and an array of individual findings (tag, score, severity).

curl https://api.ipctl.io/v1/intel/1.1.1.1

GET/v1/asn/{asn}

1 credit

ASN information including allocated and announced prefixes, BGP routing data, and registry details. Announced prefixes are paginated (default 100, max 1000). Use ?announced_limit=&announced_offset= to page.

curl https://api.ipctl.io/v1/asn/13335

GET/v1/prefix/{cidr}

1 credit

Prefix information including more-specifics, BGP routes, RPKI/IRR status and RIR allocation data.

curl "https://api.ipctl.io/v1/prefix/1.1.1.0/24"

GET/v1/whois/{ip}

1 credit

WHOIS-style registration data for an IP: network allocation, RIR, ASN, organization, abuse contact, and geolocation.

curl https://api.ipctl.io/v1/whois/1.1.1.1

GET/v1/search

1 credit

Search across ASNs, prefixes and organizations by name or number. Pass ?q=cloudflare

curl "https://api.ipctl.io/v1/search?q=cloudflare"

GET/v1/me/ip

1 credit

Returns the full IP info for the caller's own IP address.

curl https://api.ipctl.io/v1/me/ip

POST/v1/bulk

Requires API Key 1 per IP credits

Bulk IP lookup for up to 1,000 IPs in a single request. Returns geolocation, ASN, and basic threat score per IP. Requires API key.

curl -X POST https://api.ipctl.io/v1/bulk \
  -H "X-API-Key: nq_xxx" \
  -H "Content-Type: application/json" \
  -d '{"ips":["1.1.1.1","8.8.8.8"]}'

API Reference

The full API is described in an OpenAPI 3.1 specification. Use it to generate client libraries, import into Postman, or browse the interactive reference.

Interactive API Reference

Browse all endpoints, schemas, and try requests directly in the browser.

Download OpenAPI Spec

OpenAPI 3.1 YAML - import into Postman, Insomnia, or use with code generators.

Threat Tags

The /v1/intel/{ip} endpoint returns an aggregated score (0–100) and an array of individual findings, each identified by a tag. The following tags are used:

Tag	Description	Category
`c2`	Command & control server	Threat
`malicious`	Known malicious activity	Threat
`botnet`	Part of a botnet	Threat
`phishing`	Phishing infrastructure	Threat
`spam`	Spam source	Threat
`brute-force`	Brute force attacks	Threat
`scanner`	Mass scanner / reconnaissance	Threat
`proxy`	Open proxy	Privacy
`tor-node`	Tor exit node	Privacy
`vpn`	Known VPN provider	Privacy
`hosting`	Hosting / datacenter range	Infrastructure
`cdn`	CDN infrastructure	Infrastructure
`crypto-node`	Cryptocurrency node (Bitcoin, Ethereum, etc.)	Infrastructure
`p2p-node`	BitTorrent DHT node	Infrastructure
`satellite`	Satellite internet provider	Infrastructure
`mobile`	Mobile / cellular network	Infrastructure

Pricing

All plans include full API access. Upgrade or downgrade anytime.

MonthlyYearlySave 15%

Free

1,000/day credits

req/min

1,000

req/day

All lookup endpoints
IP, ASN, prefix lookups
Basic threat score on /ip

Get Started

Starter

€19/month

100,000/month credits

req/min

10,000

req/day

Everything in Free
Bulk lookups (up to 100)
Email support

Get Started