Live Threat Intelligence — Updated Every Hour

Threat Intelligence API

Real-time threat signals for every IP address. VPN & proxy detection, Tor exit node identification, botnet C2 flagging, datacenter range mapping, and abuse risk scoring — all in a single API call.

View API Docs → Try Free — 50K req/mo

4.2B+

IPs Scored

180M+

Threat Signatures

Hourly

Updated Every

99.1%

Detection Accuracy

Detection Capabilities

Everything You Need to Know About an IP

Comprehensive threat signals combined into a single, fast API response.

Proxy & VPN Detection

Identify commercial VPNs, open proxies, SOCKS/HTTP proxies, and anonymizing services. 200+ VPN providers in our database.

Tor Exit Node Database

Hourly-refreshed list of active Tor exit nodes. Detect anonymized traffic from the Tor network in real time.

Botnet & Malware C2 IPs

Flag IPs known to host botnet command-and-control infrastructure or distribute malware. Cross-referenced with threat feeds.

Datacenter IP Ranges

Identify IPs belonging to cloud providers and datacenters. AWS, GCP, Azure, Hetzner, OVH and 300+ more providers mapped.

Residential Proxy Detection

Detect residential proxies that masquerade as real users. Identify IPs from proxy networks like Bright Data, Oxylabs, and others.

Abuse Score & Risk Level

A 0–100 composite risk score combining all threat signals. Custom risk thresholds let you block, challenge, or allow traffic programmatically.

How It Works

Integrate in Minutes

One endpoint returns all the threat data you need.

1. Get Your API Key

2. Make a Request

Send a GET request with any IP address. The API returns a full threat profile in under 50ms.

3. Act on the Data

Block, challenge, or log traffic based on risk scores and threat flags. Fully customizable thresholds.

API Response

Sample Threat Intelligence Response

Rich, structured data returned in milliseconds.

GET https://api.hostinfo.com/v2/threat/45.155.204.1 200 OK

{
  "ip": "45.155.204.1",
  "risk_score": 87,
  "risk_level": "high",
  "is_vpn": true,
  "is_proxy": false,
  "is_tor": false,
  "is_datacenter": true,
  "is_residential_proxy": false,
  "is_botnet": false,
  "threat_types": ["vpn", "datacenter", "anonymizer"],
  "vpn_provider": "Mullvad VPN",
  "abuse_reports_30d": 14,
  "last_abuse_report": "2026-04-12T08:21:00Z",
  "detection_confidence": 0.96,
  "asn": "AS60068",
  "org": "Datacamp Limited",
  "country": "NL",
  "updated_at": "2026-04-18T07:00:00Z"
}

Quick Integration

Add threat intelligence to your app in under 5 minutes.

Shell

curl "https://api.hostinfo.com/v2/threat/8.8.8.8" \
  -H "Authorization: Bearer YOUR_API_KEY"

Python

import requests

API_KEY = "YOUR_API_KEY"
ip = "8.8.8.8"

response = requests.get(
    f"https://api.hostinfo.com/v2/threat/{ip}",
    headers={"Authorization": f"Bearer {API_KEY}"}
)

data = response.json()
print(f"Risk score: {data['risk_score']}")
print(f"Is VPN: {data['is_vpn']}")
print(f"Threat types: {data['threat_types']}")

JavaScript (fetch)

const API_KEY = 'YOUR_API_KEY';
const ip = '8.8.8.8';

const res = await fetch(
  `https://api.hostinfo.com/v2/threat/${ip}`,
  { headers: { Authorization: `Bearer ${API_KEY}` } }
);
const data = await res.json();

if (data.risk_score > 70) {
  console.log('High-risk IP — block or challenge');
  console.log('Threats:', data.threat_types);
}

PHP

$apiKey = 'YOUR_API_KEY';
$ip = '8.8.8.8';

$ch = curl_init("https://api.hostinfo.com/v2/threat/{$ip}");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer {$apiKey}"
]);

$response = json_decode(curl_exec($ch), true);
curl_close($ch);

if ($response['risk_score'] > 70) {
    // Block or challenge this IP
    http_response_code(403);
    exit('Access denied');
}

Related Data Products

More intelligence to power your security stack.

Privacy Detection

VPN, proxy, Tor, and relay identification.

IP Reputation

Residential proxy and abuse reputation scoring.

View Pricing

Plans from free to enterprise.

Start Protecting Your App Today

Free tier includes 50,000 threat intelligence queries per month. No credit card required.

Get Free API Key → View Pricing Plans