Single JSON Endpoint

Fast request model: send ip, user_id, get a deterministic machine-readable response.

Realtime Responses

Live geolocation, ASN data and antifraud scoring optimized for auth, checkout and abuse prevention flows.

Behavior Correlation

user_id binds requests into antifraud history: country switching, ASN jumps and anomaly patterns.

Bearer Authentication

Production-safe auth model via Authorization: Bearer <API_KEY> with clear error codes and statuses.

What Is New In GeoIP.space API

Advanced Antifraud Insights

Antifraud response now includes profile consistency, ASN anomaly checks, impossible travel speed detection, stability score, and smart action hints.

Extended Country Metadata

Country enrichment includes calling code, TLD, language, currency metadata, and normalized location context for cleaner backend decisions.

Realtime FX Context

Country currency is enriched with rates to USD and crypto mappings (BTC/ETH/BNB/TON) powered by scheduled market sync.

Live Landing Preview

Landing page now shows expanded live response preview, CDN flags, IP lookup form, and map visualization based on resolved coordinates.

Faster Client Integration

New payload filters (fields + crypto) let clients receive only required data, reducing transfer size and speeding up backend parsing.

Operational Visibility For Teams

Dashboard export in CSV/JSON gives client teams clearer analytics, easier reporting for managers, and faster incident investigation.

Response Filters: fields + crypto

Use filter parameter fields to return only required JSON paths and crypto to limit currencies inside geo.country_enrichment.rates.crypto.

Request Example

curl -G "https://geoip.space/api" \
  --data-urlencode "ip=8.8.8.8" \
  --data-urlencode "user_id=qa_001" \
  --data-urlencode "fields=geo.country,geo.country_enrichment.tld,antifraud.risk_score" \
  --data-urlencode "crypto=BTC,ETH" \
  -H "Authorization: Bearer YOUR_API_KEY"

Filtered Response Example

{
  "status":"ok",
  "subscription_type":"geo",
  "geo":{"country":{"iso_code":"US","name":"United States"},"country_enrichment":{"tld":".us"}},
  "access":{"required_subscription":"antifraud","missing_fields":["antifraud.risk_score"]}
}

API Logs Export: CSV / JSON

Dashboard keeps request and response logs for analytics, troubleshooting and antifraud reviews. Export to structured file formats depending on downstream use.

CCSV for BI and spreadsheets JJSON for replay and incident analysis

How The API Pipeline Works

Simple service flow for backend teams integrating risk checks into signups, login, payments and moderation.

STEP 01

Client Request

Send ip + user_id with Bearer token.

STEP 02

Geo + ASN Enrichment

City, country, timezone, ASN, network profile and PTR details.

STEP 03

Antifraud Scoring

Risk score, proxy suspicion, confidence and behavior signals.

STEP 04

Policy Decision

Accept, challenge, verify, rate-limit or block in your application logic.

Interactive Geo Map

Map marker is built from live geolocation coordinates returned by the API for the current visitor.

If coordinates are not available, the map falls back to world view.

Developer Quick Start

Call the endpoint with ip and user_id query params, and send your key in Authorization: Bearer .... Use JSON fields to enforce fraud policy, risk routing, and adaptive verification.

API request and response logs are available for download from dashboard in CSV and JSON formats.

cURL sample

curl -G "https://geoip.space/api" \
  --data-urlencode "ip=8.8.8.8" \
  --data-urlencode "user_id=anon_7f3a2c9a1e44b2d0" \
  -H "Authorization: Bearer YOUR_API_KEY"

Tip: free plan is available with request rate limiting. Use this field to test output for any public IP.

Pricing Plans

Start free, then scale to higher throughput and richer antifraud controls.

Free

ACTIVE

$0 / month

Rate limit: 10 requests per minute
Rate limit: 10000 requests per month
Core geolocation fields
API testing and prototyping

Geo Full

POPULAR

$10.00 / month

GeoIP API full access
Monthly traffic limit: 500,000 requests
Dedicated server ressources
Production load endurance level
Priority request processing
Full level of support

Antifraud Full

PAID

$30.00 / month

GeoIP API + Antifraud API full access
Monthly traffic limit: 500,000 requests
Advanced antifraud answers
UX friendly confidence signals
Use for indentify risk trafic
Priority support

Enterprise Subscription

For large businesses with strict security and reliability requirements.

We provide local deployment, direct integration into your existing system, and architecture consulting for stronger antifraud protection.

Local installation in your infrastructure
Integration with your internal services and risk workflows
Consulting and architecture proposals for antifraud defense

B2B Use Cases And Commercial Impact

Fintech and Payments

Use risk score + proxy + ASN shifts before payment confirmation. Typical impact: fewer chargebacks and cleaner manual review queue.

SaaS and Account Security

Detect impossible travel and anomalous network changes on login and password reset. Reduce account takeovers without adding friction to safe users.

Marketplaces and E-commerce

Protect registration bonuses and checkout from multi-account abuse. Combine user_id timeline with GeoIP and ASN context for high-confidence actions.

For Product and Fraud Managers

Launch policy experiments quickly using stable JSON fields.
Tune allow/review/block thresholds by route and region.
Monitor conversion vs risk with measurable KPI impact.

For Owners and Executives

Lower fraud losses while preserving approval rates.
Reduce analyst cost through better decision precision.
Accelerate enterprise integrations with predictable API behavior.

IP Geolocation API

Country, city, subdivision, postal, timezone, latitude and longitude with structured JSON response for backend systems.

ASN Intelligence API

Autonomous system number, network organization, and network profile fields for risk segmentation and traffic quality checks.

Antifraud API

Risk score, confidence score, proxy suspected flags, and behavior signals for transaction screening and account defense.

VPN Proxy TOR Detection

Signals from reverse DNS, heuristics, tor exit context, and related detection logic to highlight anonymized traffic.

Behavior Analytics

user_id correlation detects country switching, ASN switching, and suspicious request patterns over time windows.

Production SaaS Architecture

Simple endpoint design, explicit HTTP statuses, numeric error codes, and dashboard docs for low-friction integration.

Live API JSON Output For Current Visitor

Transparent real-time response from the same endpoint your backend will consume.

Current JSON payload

{
    "status": "ok",
    "error_code": 0,
    "http_status": 200,
    "ip": "216.73.216.13",
    "ua": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])",
    "user_id": "guest:6daf699259588eed86d3162a0f91bc4a",
    "subscription_type": "antifraud",
    "geo": {
        "city": {
            "name": "Columbus",
            "geoname_id": 4509177
        },
        "country": {
            "iso_code": "US",
            "name": "United States",
            "geoname_id": 6252001
        },
        "subdivisions": [
            {
                "iso_code": "OH",
                "name": "Ohio",
                "geoname_id": 5165418
            }
        ],
        "location": {
            "latitude": 39.9625,
            "longitude": -83.0061,
            "accuracy_radius": 20
        },
        "timezone": "America/New_York",
        "postal": "43215",
        "raw": {
            "city": {
                "name": "Columbus",
                "names": {
                    "de": "Columbus",
                    "en": "Columbus",
                    "es": "Columbus",
                    "fr": "Columbus",
                    "ja": "\u30b3\u30ed\u30f3\u30d0\u30b9",
                    "pt-BR": "Columbus",
                    "ru": "\u041a\u043e\u043b\u0443\u043c\u0431\u0443\u0441",
                    "zh-CN": "\u54e5\u4f26\u5e03"
                },
                "confidence": null,
                "geonameId": 4509177
            },
            "country": {
                "name": "United States",
                "names": {
                    "de": "USA",
                    "en": "United States",
                    "es": "Estados Unidos",
                    "fr": "\u00c9tats Unis",
                    "ja": "\u30a2\u30e1\u30ea\u30ab",
                    "pt-BR": "EUA",
                    "ru": "\u0421\u0428\u0410",
                    "zh-CN": "\u7f8e\u56fd"
                },
                "confidence": null,
                "geonameId": 6252001,
                "isInEuropeanUnion": false,
                "isoCode": "US"
            },
            "location": {
                "averageIncome": null,
                "accuracyRadius": 20,
                "latitude": 39.9625,
                "longitude": -83.0061,
                "metroCode": 535,
                "populationDensity": null,
                "timeZone": "America/New_York"
            },
            "subdivisions": [
                {
                    "name": "Ohio",
                    "names": {
                        "de": "Ohio",
                        "en": "Ohio",
                        "es": "Ohio",
                        "fr": "Ohio",
                        "ja": "\u30aa\u30cf\u30a4\u30aa\u5dde",
                        "pt-BR": "Ohio",
                        "ru": "\u041e\u0433\u0430\u0439\u043e",
                        "zh-CN": "\u4fc4\u4ea5\u4fc4\u5dde"
                    },
                    "confidence": null,
                    "geonameId": 5165418,
                    "isoCode": "OH"
                }
            ],
            "postal": {
                "code": "43215",
                "confidence": null
            },
            "traits": null,
            "registered_country": null
        },
        "country_enrichment": {
            "iso2": "US",
            "iso3": "USA",
            "name": "United States",
            "geoname_id": 6252001,
            "flag_emoji": "\ud83c\uddfa\ud83c\uddf8",
            "flag_cdn_png_20": "https://flagcdn.com/w20/us.png",
            "flag_cdn_png_40": "https://flagcdn.com/w40/us.png",
            "flag_cdn_svg": "https://flagcdn.com/us.svg",
            "calling_code": "+1201",
            "calling_codes": [
                "+1201",
                "+1202",
                "+1203",
                "+1205",
                "+1206",
                "+1207",
                "+1208",
                "+1209",
                "+1210",
                "+1212",
                "+1213",
                "+1214",
                "+1215",
                "+1216",
                "+1217",
                "+1218",
                "+1219",
                "+1220",
                "+1224",
                "+1225",
                "+1227",
                "+1228",
                "+1229",
                "+1231",
                "+1234",
                "+1239",
                "+1240",
                "+1248",
                "+1251",
                "+1252",
                "+1253",
                "+1254",
                "+1256",
                "+1260",
                "+1262",
                "+1267",
                "+1269",
                "+1270",
                "+1272",
                "+1274",
                "+1276",
                "+1281",
                "+1283",
                "+1301",
                "+1302",
                "+1303",
                "+1304",
                "+1305",
                "+1307",
                "+1308",
                "+1309",
                "+1310",
                "+1312",
                "+1313",
                "+1314",
                "+1315",
                "+1316",
                "+1317",
                "+1318",
                "+1319",
                "+1320",
                "+1321",
                "+1323",
                "+1325",
                "+1327",
                "+1330",
                "+1331",
                "+1334",
                "+1336",
                "+1337",
                "+1339",
                "+1346",
                "+1347",
                "+1351",
                "+1352",
                "+1360",
                "+1361",
                "+1364",
                "+1380",
                "+1385",
                "+1386",
                "+1401",
                "+1402",
                "+1404",
                "+1405",
                "+1406",
                "+1407",
                "+1408",
                "+1409",
                "+1410",
                "+1412",
                "+1413",
                "+1414",
                "+1415",
                "+1417",
                "+1419",
                "+1423",
                "+1424",
                "+1425",
                "+1430",
                "+1432",
                "+1434",
                "+1435",
                "+1440",
                "+1442",
                "+1443",
                "+1447",
                "+1458",
                "+1463",
                "+1464",
                "+1469",
                "+1470",
                "+1475",
                "+1478",
                "+1479",
                "+1480",
                "+1484",
                "+1501",
                "+1502",
                "+1503",
                "+1504",
                "+1505",
                "+1507",
                "+1508",
                "+1509",
                "+1510",
                "+1512",
                "+1513",
                "+1515",
                "+1516",
                "+1517",
                "+1518",
                "+1520",
                "+1530",
                "+1531",
                "+1534",
                "+1539",
                "+1540",
                "+1541",
                "+1551",
                "+1559",
                "+1561",
                "+1562",
                "+1563",
                "+1564",
                "+1567",
                "+1570",
                "+1571",
                "+1573",
                "+1574",
                "+1575",
                "+1580",
                "+1585",
                "+1586",
                "+1601",
                "+1602",
                "+1603",
                "+1605",
                "+1606",
                "+1607",
                "+1608",
                "+1609",
                "+1610",
                "+1612",
                "+1614",
                "+1615",
                "+1616",
                "+1617",
                "+1618",
                "+1619",
                "+1620",
                "+1623",
                "+1626",
                "+1628",
                "+1629",
                "+1630",
                "+1631",
                "+1636",
                "+1641",
                "+1646",
                "+1650",
                "+1651",
                "+1657",
                "+1660",
                "+1661",
                "+1662",
                "+1667",
                "+1669",
                "+1678",
                "+1681",
                "+1682",
                "+1701",
                "+1702",
                "+1703",
                "+1704",
                "+1706",
                "+1707",
                "+1708",
                "+1712",
                "+1713",
                "+1714",
                "+1715",
                "+1716",
                "+1717",
                "+1718",
                "+1719",
                "+1720",
                "+1724",
                "+1725",
                "+1727",
                "+1730",
                "+1731",
                "+1732",
                "+1734",
                "+1737",
                "+1740",
                "+1743",
                "+1747",
                "+1754",
                "+1757",
                "+1760",
                "+1762",
                "+1763",
                "+1765",
                "+1769",
                "+1770",
                "+1772",
                "+1773",
                "+1774",
                "+1775",
                "+1779",
                "+1781",
                "+1785",
                "+1786",
                "+1801",
                "+1802",
                "+1803",
                "+1804",
                "+1805",
                "+1806",
                "+1808",
                "+1810",
                "+1812",
                "+1813",
                "+1814",
                "+1815",
                "+1816",
                "+1817",
                "+1818",
                "+1828",
                "+1830",
                "+1831",
                "+1832",
                "+1843",
                "+1845",
                "+1847",
                "+1848",
                "+1850",
                "+1854",
                "+1856",
                "+1857",
                "+1858",
                "+1859",
                "+1860",
                "+1862",
                "+1863",
                "+1864",
                "+1865",
                "+1870",
                "+1872",
                "+1878",
                "+1901",
                "+1903",
                "+1904",
                "+1906",
                "+1907",
                "+1908",
                "+1909",
                "+1910",
                "+1912",
                "+1913",
                "+1914",
                "+1915",
                "+1916",
                "+1917",
                "+1918",
                "+1919",
                "+1920",
                "+1925",
                "+1928",
                "+1929",
                "+1930",
                "+1931",
                "+1934",
                "+1936",
                "+1937",
                "+1938",
                "+1940",
                "+1941",
                "+1947",
                "+1949",
                "+1951",
                "+1952",
                "+1954",
                "+1956",
                "+1959",
                "+1970",
                "+1971",
                "+1972",
                "+1973",
                "+1975",
                "+1978",
                "+1979",
                "+1980",
                "+1984",
                "+1985",
                "+1989"
            ],
            "capital": "Washington, D.C.",
            "continent": "North America",
            "tld": ".us",
            "currency": {
                "code": "USD",
                "name": "United States dollar",
                "symbol": "$"
            },
            "currencies": [
                {
                    "code": "USD",
                    "name": "United States dollar",
                    "symbol": "$"
                }
            ],
            "rates": {
                "currency_code": "USD",
                "units_per_usd": 1,
                "usd_per_unit": 1,
                "crypto": {
                    "BNB": {
                        "units_per_coin": 628.37,
                        "coin_per_unit": 0.0015914190683832773,
                        "usd_per_coin": 628.37,
                        "coin_per_usd": 0.001591419068
                    },
                    "BTC": {
                        "units_per_coin": 69718,
                        "coin_per_unit": 1.4343498092314753e-5,
                        "usd_per_coin": 69718,
                        "coin_per_usd": 1.4343498e-5
                    },
                    "ETH": {
                        "units_per_coin": 2077.7,
                        "coin_per_unit": 0.00048130143909130293,
                        "usd_per_coin": 2077.7,
                        "coin_per_usd": 0.000481301439
                    },
                    "TON": {
                        "units_per_coin": 1.49,
                        "coin_per_unit": 0.6711409395973155,
                        "usd_per_coin": 1.49,
                        "coin_per_usd": 0.671140939597
                    }
                }
            },
            "languages": [
                {
                    "code": "eng",
                    "name": "English"
                }
            ],
            "is_in_european_union": false,
            "localized_names": {
                "de": "USA",
                "en": "United States",
                "es": "Estados Unidos",
                "fr": "\u00c9tats Unis",
                "ja": "\u30a2\u30e1\u30ea\u30ab",
                "pt-BR": "EUA",
                "ru": "\u0421\u0428\u0410",
                "zh-CN": "\u7f8e\u56fd"
            },
            "enrichment_source": "geoip.space country catalog v3"
        },
        "geo_intelligence": {
            "geo_point": "39.9625,-83.0061",
            "hemisphere": "NW",
            "geohash_8": "dphgr4uy",
            "distance_from_equator_km": 4448.63,
            "distance_from_prime_meridian_km": 7082.32,
            "map_urls": {
                "openstreetmap": "https://www.openstreetmap.org/?mlat=39.9625&mlon=-83.0061#map=10/39.9625/-83.0061",
                "google_maps": "https://maps.google.com/?q=39.9625,-83.0061"
            },
            "time": {
                "timezone": "America/New_York",
                "current_local_time": "2026-03-03T06:33:50-05:00",
                "utc_offset_seconds": -18000,
                "utc_offset_hours": -5,
                "is_dst": false
            }
        }
    },
    "asn": {
        "asn": 16509,
        "org": "Amazon.com, Inc.",
        "ip_network": "216.73.216.0/22",
        "network_type": "ISP"
    },
    "ptr": "216.73.216.13",
    "antifraud": {
        "risk_score": -5,
        "proxy_suspected": false,
        "confidence": 0,
        "signals": [],
        "behavior": [],
        "advanced_insights": {
            "distance_to_historical_user_centroid_km": null,
            "distance_to_historical_user_centroid_note": "insufficient_historical_coordinates",
            "location_stability_score": 37.5,
            "impossible_travel": {
                "is_detected": false,
                "distance_km": null,
                "elapsed_minutes": null,
                "speed_kmh": null,
                "note": null
            },
            "business_hours_mismatch": {
                "current_hour_utc": 11,
                "historical_avg_hour_utc": 11,
                "hour_delta": 0,
                "is_mismatch": false
            },
            "country_risk_profile": {
                "country_iso2": "US",
                "fraud_pressure_score": 6,
                "chargeback_risk_bucket": "low",
                "sanctions_flag": false
            },
            "asn_reputation": {
                "asn": 16509,
                "risk_score": null,
                "network_type": null,
                "reputation_tier": "unknown"
            },
            "network_change_anomaly": {
                "primary_asn": 16509,
                "current_asn": 16509,
                "is_anomaly": false,
                "asn_variants_recent": 1
            },
            "geo_consistency_with_profile": {
                "primary_country": "US",
                "current_country": "US",
                "match": true,
                "confidence": 1
            },
            "travel_context": {
                "status": "normal",
                "summary": "Current request aligns with recent mobility pattern"
            },
            "ip_quality_index": 100,
            "region_precision_level": "city_level",
            "smart_action_hint": "allow",
            "source_signals": []
        }
    }
}

Expand

Frequently Asked Questions

Integration, security, antifraud behavior logic, and production deployment notes.

What is this API used for in production?

IP intelligence and antifraud decisioning for signups, login hardening, payment pre-checks, abuse prevention, and traffic quality assessment.

How is authorization handled?

All requests use Bearer API keys via Authorization header. Query-string secrets are not recommended.

Why is user_id mandatory for antifraud?

It links requests to stable identity context and enables behavior analytics: country switch, ASN switch, and suspicious session movement detection.

Can I use this in real-time checkout?

Yes. Use risk score, confidence, proxy signals and country consistency checks to drive frictionless or stepped-up verification flows.

How to handle API errors?

Read explicit HTTP status and numeric error codes. Retry only transient errors; block or queue requests on auth/validation failures.

What do I get with dashboard plans?

Geo-only and antifraud plans with clear response shape. Antifraud plan unlocks richer behavioral and network-risk context fields.

How should I design retries to avoid duplicate decisions?

Use idempotent request flow in your backend: keep request context ID, cache decision for short TTL, and retry only transient errors (timeouts/5xx). Do not blindly retry validation/auth failures.

What is the best way to store and rotate API keys?

Keep keys server-side only (env/secrets manager), never in frontend code. Rotate keys on schedule, revoke compromised keys immediately, and monitor unusual request volume by key.

How do fields and crypto filters improve performance?

Use fields to return only needed paths and crypto to limit FX crypto sub-block. Smaller payloads reduce latency, CPU parsing time, and network transfer costs at scale.

Can this API be used for account takeover prevention?

Yes. Combine geo consistency, ASN change anomalies, impossible-travel checks, proxy signals, and risk score thresholds to trigger step-up auth or session restrictions.

How do I analyze historical incidents and false positives?

Export request/response logs in CSV/JSON, segment by outcome (approved/blocked/challenged), compare with chargeback or abuse labels, then tune thresholds by route and risk scenario.

What data should be masked in internal dashboards?

Mask user identifiers and sensitive customer data, keep only operational context needed for fraud decisions. Follow least-privilege access and audit who can view raw logs.

IP Geolocation API + Antifraud Intelligence Platform