---
updatedAt: 2025-11-11T22:56:54.000Z
agentTools:
  projectIndex: https://docs.ipdata.co/llms.txt
---

# Threat Intelligence

We publish 4M+ malicious IP addresses daily in our IP Threat Intelligence database. We also track Tor nodes and open proxies.

Example Request

```curl
curl "https://api.ipdata.co/27.126.160.0/threat?api-key=<<apiKey>>"
```
```shell ipdata CLI
ipdata 27.126.160.0 -f threat
```

Sample Response

```json
{
		"is_tor": false,
		"is_icloud_relay": false,
		"is_proxy": false,
		"is_datacenter": false,
		"is_anonymous": false,
		"is_known_attacker": true,
		"is_known_abuser": true,
		"is_threat": true,
		"is_bogon": false,
		"blocklists": [
			{
				"name": "Spamhaus",
				"site": "https://www.spamhaus.org",
				"type": "general"
			},
			{
				"name": "USTC.edu.cn",
				"site": "https://ustc.edu.cn",
				"type": "general"
			}
		]
	}
```

# Data Fields

| Field               | Description                                                                                                                             |
| :------------------ | :-------------------------------------------------------------------------------------------------------------------------------------- |
| is\_tor             | is true if the IP address is associated with a node on the Tor network                                                                  |
| is\_vpn             | true for VPN IP addresses. There are approx. 2.6M IP addresses updated daily.  This is available to Business and Enterprise users only. |
| is\_icloud\_relay   | true for IP addresses belonging to Apple's iCloud relay service                                                                         |
| is\_proxy           | is true if the IP address is a known proxy, includes HTTP/HTTPS/SSL/SOCKS/CONNECT and transparent proxies                               |
| is\_datacenter      | true for any IP addresses that belong to a datacenter including all cloud providers. Can be useful for detecting automated/bot traffic. |
| is\_anonymous       | is set true if either one of is\_tor or is\_proxy is true                                                                               |
| is\_known\_attacker | is true if an IP address is a known source of malicious activity, i.e. attacks, malware, botnet activity etc                            |
| is\_known\_abuser   | is true if the IP address is a known source of abuse i.e. spam, harvesters, registration bots and other nuisance bots etc               |
| is\_threat          | is true if either one of is\_known\_abuser or is\_known\_attacker is true                                                               |
| is\_bogon           | true for if an IP address is a <Glossary>bogon</Glossary>.                                                                              |
| blocklists          | An array of blocklists an IP address has been reported to. It includes the name, website and list type.                                 |
| scores              | A map of IP reputation scores.                                                                                                          |