Ipinfo.io

@ipinfo look up 8.8.8.8 and tell me what organization owns it and where it's located

The IP address 8.8.8.8 is owned by Google LLC (AS15169). It's geolocated to Mountain View, California, United States. The network is classified as a hosting/cloud service provider. This is one of Google's public DNS servers, so the geolocation reflects Google's data center presence rather than an end-user location.

This example shows the core IP lookup capability — geolocation, ASN, and organization data in one call. Note that IP geolocation accuracy varies by provider and IP type; cloud/hosting IPs often resolve to data center locations, not user locations. Requires a valid API key.

@ipinfo check if 203.0.113.45 is coming from a VPN, proxy, or Tor exit node

The IP 203.0.113.45 shows the following privacy flags: VPN detected (yes), proxy detected (no), Tor exit node (no), relay (no), hosting provider (yes). This suggests the traffic is likely routed through a commercial VPN service hosted on cloud infrastructure. The hosting flag indicates the IP belongs to a data center range rather than a residential ISP.

This demonstrates the privacy detection tool, useful for fraud prevention and security workflows. Detection accuracy depends on Ipinfo's threat intelligence feeds, which update regularly but may lag behind newly provisioned VPN/proxy infrastructure. Side-effect: none, this is a read-only lookup.

@ipinfo I have a list of 50 IPs from our access logs — batch look them up and summarize which countries they're coming from

Batch lookup complete for 50 IPs. Geographic distribution: 28 IPs from United States (56%), 9 from Germany (18%), 6 from United Kingdom (12%), 4 from Canada (8%), 3 from France (6%). Notable: 12 IPs (24%) are flagged as hosting/cloud providers, suggesting potential bot or automated traffic. All lookups returned successfully with full geolocation data.

This showcases the batch lookup tool, which accepts up to 1,000 IPs per request — far more efficient than individual calls. The AI synthesizes the batch response into a summary. Be aware of rate limits on your API tier; batch requests count against your monthly quota based on the number of IPs queried, not the number of API calls.

When Ipinfo wins for real-time payment risk scoring

A 6-person e-commerce team sees 200 orders a day and wants to flag suspicious checkouts before fulfillment. Ipinfo's privacy detection tool catches VPN and proxy traffic in under 200ms, feeding a simple risk score that blocks 80% of chargebacks without manual review. The batch lookup handles nightly audits of the previous day's orders in one call. This works cleanly until you hit 2,000+ orders daily—at that scale, you need a dedicated fraud vendor with behavioral signals, not just IP flags. If your fraud rate is under 3% and you're staffing support part-time, Ipinfo gives you the 80/20 win without building a data pipeline.

When geolocation routing beats manual assignment

A 12-person SaaS support team routes inbound tickets to regional specialists (EMEA, APAC, Americas) based on customer location. Ipinfo's geolocation tool pulls city and country from the requester's IP at ticket creation, auto-tagging the ticket before it hits the queue. The company info lookup adds context when enterprise accounts open tickets from office IPs versus home networks. This setup collapses routing time from 4 minutes to 8 seconds and cuts misdirected tickets by 60%. The trade-off: if 30% of your users are on corporate VPNs that terminate in a different region, you'll need fallback logic that checks account metadata. For SMB customers on residential IPs, this is a one-call solve.

When carrier and ASN data expose bot traffic

A 3-person dev team runs a freemium API and sees 40% of requests coming from a handful of ASNs that look like cloud hosting providers, not end users. Ipinfo's carrier and ASN lookup tools identify these patterns in real time, letting the team rate-limit hosting IPs without blocking legitimate mobile or residential traffic. The abuse contact tool surfaces the upstream provider when a single actor hammers the endpoint. This catches scripted abuse at 500 requests per second before it costs real money. If your API serves mobile apps where users bounce between carrier and Wi-Fi, you'll need to tune the hosting flag threshold—residential IPs occasionally resolve as hosting when users tether. For server-to-server APIs, this is the fastest path to blocking bad actors.