Create free account Dashboard

An IP reputation API that answers in one GET

GET /v1/lookup/{ip} checks an IPv4 or IPv6 address against the Tor Project’s exit list and nine cloud providers’ published ranges, and answers with a verdict and a 0–100 risk score, or known: false when there’s nothing on record.

Create free account Try the free IP lookup
  • Free plan: 100,000 IP lookups a month
  • No card
  • Paid plans from €29 a month
Example lookupAn address in Google Cloud
Reviewrisk_score 40
IP address
8.34.208.1
Cloud server
Google Cloud
Tor exit
Not detected
Network
AS396982
Registered in
United States
"verdict": "review""signals": { …, "dch": true, … }
The answer to GET /v1/lookup/8.34.208.1, shown in full further down this page.

What a lookup checks

A lookup answers two questions about an address: is it a Tor exit, or a server in a cloud provider's range? Maskbreak reads the Tor Project's own exit list every four hours and the providers' published ranges every day, so you do not have to.

A Tor exit
signals.tor is true and network.org reads Tor exit node. Verdict block, risk_score 90.
A cloud server
signals.dch is true and network.cloud names the provider: nine providers' cloud ranges, from AWS, Google Cloud and Microsoft Azure to Cloudflare and Fastly. Verdict review, risk_score 40.
Nothing on record
known: false, risk_score 0 and signals: null. That means unknown, not safe.
The network
asn and registration_country come from the public routing table, for display; they never change the verdict.

Call it from your server

Send the address with your API key: there is no script to add and no browser token. Lookups have their own monthly allowance, ten times the plan’s visitor checks, and GET /v1/usage shows what is left without using any. The answer for an address in Google Cloud’s range (latency_ms, the time the call took on our server, is left out):

Terminal
curl https://maskbreak.com/v1/lookup/8.34.208.1 \
  -H "Authorization: Bearer sk_live_YOUR_API_KEY"

{
  "ip": "8.34.208.1",
  "known": true,
  "verdict": "review",
  "risk_score": 40,
  "signals": { "vpn": false, "proxied": false, "tor": false, "dch": true, "anon": false },
  "network": {
    "asn": 396982, "org": "Google Cloud", "country": null, "city": null,
    "cloud": "gcp", "registration_country": "US", "source": "asn_table"
  }
}

What it can’t see

VPNs and proxies
A bare IP does not get VPN or proxy verdicts; those come from a live visit, through the script on your page and /v1/evaluate (see VPN detection).
Where the visitor is
country and city stay null. The registration country is where the network is registered, not where the person is.
Changes since the last read
A new Tor exit or a newly published range shows up at the next read. If a list can’t be fetched, the last copy is used, never an invented verdict.

Common questions

What does the risk_score mean?

On a bare IP it is 90 for a Tor exit (block), 40 for a cloud server (review) and 0 when the address is on neither list (allow). The signals come with it, so your policy can differ from ours.

Can I try a lookup without an account?

Yes: paste an IPv4 or IPv6 address into the free IP lookup tool, with no key and no signup. For volume, the Free plan includes 100,000 IP lookups a month with no card.

How do I watch my quota?

Call GET /v1/usage with the same key. It returns your plan, this month’s allowances and use, and when the month resets, and it never counts against your quota.

Look up your first address

Lookups have their own allowance, so they never use up your visitor checks.

Create free account Read the docs