Response fields

Types, meanings and missing-value behavior for the JSON response.

Address

Field definitionExample from 1.1.1.1

ipType: string: The address looked up. The own-IP endpoint uses the connecting client’s public address.; Example value"1.1.1.1"

Network identity

isp

The ASN organization and internet service provider are separate fields. Source names can be empty.

Field definitionExample from 1.1.1.1

isp.asnType: string: Autonomous system number with the AS prefix, such as AS13335.; Example value"AS13335"
isp.orgType: string: Organization associated with the autonomous system.; Example value"Cloudflare, Inc."
isp.ispType: string: Internet service provider name in the record.; Example value"Cloudflare, Inc."

Location

location

Geolocation is approximate. Strings can be empty; a numeric zero alone does not establish a location assignment.

Field definitionExample from 1.1.1.1

location.countryType: string: Country name associated with the network location estimate.; Example value"Australia"
location.country_codeType: string: Two-letter country code in the location record.; Example value"AU"
location.cityType: string: City associated with the network estimate. May be empty.; Example value"Brisbane"
location.stateType: string: Region or state associated with the estimate. May be empty.; Example value"Queensland"
location.zipcodeType: string: Postal code when the source supplies one. May be empty.; Example value""
location.latitudeType: number: Approximate latitude of the network location.; Example value-27.474848400186662
location.longitudeType: number: Approximate longitude of the network location.; Example value153.00996200912815
location.timezoneType: string: Timezone identifier associated with the location.; Example value"Australia/Brisbane"
location.localtimeType: string: Local time formatted using the location timezone at lookup time.; Example value"2026-11-02T19:06:21"

Network indicators

risk

Each flag reports its own classification. False is a non-match, not a safety verdict.

Field definitionExample from 1.1.1.1

risk.is_mobileType: boolean: Mobile or Cellular classification in the Enterprise fields.; Example valuefalse
risk.is_vpnType: boolean: Address matches a listed VPN range or a reviewed VPN-operated ASN.; Example valuefalse
risk.is_proxyType: boolean: Address matches a listed proxy IP, a reviewed proxy-provider network or a privacy relay exit range.; Example valuefalse
risk.is_torType: boolean: Enterprise Tor classification or the retained legacy Tor list matches the address.; Example valuefalse
risk.is_datacenterType: boolean: Hosting classification or a retained datacenter override matches the address.; Example valuetrue
risk.risk_scoreType: integer: Weighted sum: proxy 50, Tor 50, VPN 30, hosting 20. This is not a probability.; Example value20

API fields and website tags

Anycast and operator type are website tags from the CSV. They are not fields in the public API response.

View the data reference

Actual response

1.1.1.1

Live single-IP response

{
  "ip": "1.1.1.1",
  "isp": {
    "asn": "AS13335",
    "org": "Cloudflare, Inc.",
    "isp": "Cloudflare, Inc."
  },
  "location": {
    "country": "Australia",
    "country_code": "AU",
    "city": "Brisbane",
    "state": "Queensland",
    "zipcode": "",
    "latitude": -27.474848400186662,
    "longitude": 153.00996200912815,
    "timezone": "Australia/Brisbane",
    "localtime": "2026-11-02T19:06:21"
  },
  "risk": {
    "is_mobile": false,
    "is_vpn": false,
    "is_tor": false,
    "is_proxy": false,
    "is_datacenter": true,
    "risk_score": 20
  }
}