An IP Reputation API That Answers in One GET
GET /v1/lookup/{ip} checks any IPv4 or IPv6 address for two things: is it a Tor exit, and does it sit in a cloud provider's published range (AWS, Google Cloud, Azure and six more, with the provider named)? You get a verdict and a 0–100 risk score, or an honest known: false when there's nothing on record. A bare IP does not get VPN or proxy verdicts; those come from a live visit via /v1/evaluate. Free plan: 100,000 IP lookups a month, no card.
Why raw IP data isn't a reputation check
A geo lookup tells you nothing about risk
Country, city and ASN are facts, not judgments. The address that just hit your login endpoint resolves to a Frankfurt network: is it a Tor exit, or a server in a cloud provider's range rather than a home connection? Those are the two questions this lookup answers, with a verdict and the provider named, and it says plainly when it has nothing on record instead of restating the question in JSON.
Downloaded lists go stale
New Tor exits appear and old ones drop out every day, and cloud providers add and retire address ranges as their networks change. A copy you synced last month is wrong in both directions: it flags addresses that have moved on and misses the new ones. Maskbreak reads the Tor Project's own exit list every four hours and the providers' published ranges every day, so you do not have to.
Building your own scoring is a second job
Stitching together nine providers' cloud ranges, the Tor exit list and ASN data means juggling refresh schedules and conflicting formats — then inventing a weighting scheme and defending it. That is a product, not a feature of yours.
Slow enrichment blocks the request path
An IP reputation check usually sits inline: before the login proceeds, before the order confirms, before the webhook is trusted. A lookup that takes half a second turns your fraud control into your latency problem.
What one lookup returns
- A verdict (allow / review / block) plus the 0–100
risk_scorebehind it - Five stable signal fields per IP:
vpn,proxied,tor,dch(datacenter),anon—toranddchfire from live feeds on bare IPs; VPN/proxy detection needs a live session via /v1/evaluate - Network attribution:
network.cloudnames the provider when the IP sits in published datacenter space, and Tor exits are identified by the Tor Project's own list - Quota monitoring via
GET /v1/usage— free to call, never consumes a request latency_msin every response, so you can measure the call from your own servers
One GET, wherever an IP shows up
No client snippet and no browser token — this endpoint is built for the places where all you have is an address: screening a login before the session issues, enriching your own logs, checking a webhook caller, scoring a signup queue. Works for IPv4 and IPv6. Same API key as the full /v1/evaluate endpoint; lookups have their own monthly allowance, ten times the plan's visitor checks.
// Reputation check for a bare IP — server-side, no client code needed const res = await fetch(`https://maskbreak.com/v1/lookup/${ip}`, { headers: { 'Authorization': 'Bearer ' + process.env.MASKBREAK_API_KEY } }); const rep = await res.json(); // rep.risk_score -> 0-100 rep.verdict -> 'allow' | 'review' | 'block' // rep.signals -> { vpn, proxied, tor, dch, anon } // rep.network -> { asn, org, country, city, cloud } if (rep.verdict === 'block') return deny(rep.signals); if (rep.risk_score >= 40) queueForReview(rep);
The response for an address in Google Cloud's published range (an excerpt: latency_ms, the server-side time for the call, is left out). country and city stay null on a bare lookup. asn and registration_country come from the public routing table (source: "asn_table"): the network the address is announced from and the country that network is registered in, for display only; they never change the verdict. A Tor exit returns verdict: "block" with risk_score: 90.
curl https://maskbreak.com/v1/lookup/8.34.208.1 \
-H "Authorization: Bearer sk_live_YOUR_API_KEY"
{
"ip": "8.34.208.1",
"known": true,
"verdict": "review",
"risk_score": 40,
"signals": { "vpn": false, "proxied": false, "tor": false, "dch": true, "anon": false },
"network": {
"asn": 396982, "org": "Google Cloud", "country": null, "city": null,
"cloud": "gcp", "registration_country": "US", "source": "asn_table"
}
}Watching your quota is one more GET. GET /v1/usage authenticates with the same key, consumes nothing, and is safe to poll from a dashboard or alerting job:
curl https://maskbreak.com/v1/usage -H "Authorization: Bearer sk_live_YOUR_API_KEY"
{
"key_type": "live",
"hourly_limit": 1000,
"used_this_hour": 412,
"remaining": 588,
"resets_at": "2026-07-19T15:04:11.000Z",
"total_evaluations": 52817
}Paste any address into the free IP lookup tool — it runs the same verdict pipeline as the API, no signup required. Or run your own connection through the live scanner on the homepage to see what a full evaluation adds.
How the reputation score is built
An additive score you can explain to an auditor. The risk_score is not a black-box probability: datacenter hosting contributes 40 points, an active VPN or proxy tunnel 60 each, anonymity infrastructure without a named tunnel 30, and a Tor exit floors the score at 90. The default thresholds — review at 40, block at 80 — produce the verdict field, but every input signal ships alongside it, so your policy can diverge from ours without another API call.
Attribution, not just detection. Every hit carries a network object. When the IP sits inside a cloud provider's own published address space, network.cloud names the provider (aws, gcp, azure, oracle, digitalocean, linode, vultr, cloudflare, fastly) and network.org carries its display name — useful when you want to treat AWS egress differently from an unknown hosting reseller. A Tor exit reads "Tor exit node". Fields such as asn, country and city are null when no source has them. The ranges are refreshed daily and the Tor list every four hours, and every feed is fail-open: an outage means slightly older data, not an invented verdict.
"No data" is an answer, not a guess. If there is no intelligence on record, the response says known: false with a zero score and null signals — we never fabricate a number for an address we know nothing about. Downstream, that honesty matters: a policy that treats "unknown" as "clean" behaves very differently from one that treats an invented 50 as "suspicious."
Fields that never move under you. The signal spellings (proxied, dch) are parsed by production systems today, so the API stability policy is additive-only: new fields may appear, existing ones are never renamed or removed. Your integration from this page will still parse a year from now. When a browser session is available, /v1/evaluate layers device-level signals on the same network intelligence — use the lookup where no client runs, the evaluation where one does.
Live visit or bare IP: what each check can see
A live visit is POST /v1/evaluate with the token the browser snippet creates. A bare IP is GET /v1/lookup/{ip}, or the free IP lookup tool.
| Signal | Live visit | Bare IP |
|---|---|---|
| Proxy exit (residential or datacenter) | Yes: block by default, service named when known | No: needs a live visit |
| VPN | Yes: flagged for review | No: needs a live visit |
| Tor exit | Yes | Yes, from the Tor Project's exit list |
| Cloud-server range | Yes | Yes, with the provider named |
| Automation, fake browser, VM | Yes, when the client snippet runs | No |
Common questions
verdict field applies our default thresholds (allow below 40, review from 40, block from 80), but the individual signals ship in every response so you can apply your own policy instead./v1/evaluate. Every feed is fail-open: an outage means slightly older data, not an invented verdict.known is false, risk_score is 0, and signals is null. We don't invent a score for an address we have no intelligence on — an honest "nothing on record" is more useful to your policy than a fabricated number.GET /v1/usage with the same Bearer key. It returns your hourly limit, usage this hour, remaining requests, and the reset time — and the call itself is free: it never consumes quota, so you can poll it from a dashboard or alerting job.Put a reputation check in front of every IP
Free plan: 100,000 IP lookups a month, no card. Paid plans from €29 a month. One GET returns the score, the signals, and the network behind the address.