iplogs.com

Client code for every language

The iplogs.com API is plain HTTP with JSON, so there is nothing to install: no package, no key, no sign-up. Copy the function for your language, call check(ip) and decide what to do with the answer. Each one sets a timeout, retries once on a 429 and fails loudly on anything else.

curl iplogs.com

That checks the machine you run it on. curl iplogs.com/8.8.8.8 checks another address.

Pick a language

#!/bin/sh
# check.sh 8.8.8.8
# curl retries once on 429 and waits for Retry-After; needs jq for the decision.
ip=${1:?usage: check.sh IP}

v=$(curl -sS --fail --max-time 35 --retry 1 "https://iplogs.com/v1/check/$ip") || exit 2

echo "$v" | jq -r '"\(.verdict) \(.score)"'
if echo "$v" | jq -e '.is_vpn or .is_proxy or .is_tor' >/dev/null; then
  echo block
else
  echo allow
fi

# wget (no retry on 429, no jq): wget -qO- --timeout=35 "https://iplogs.com/v1/summary/$ip"

# Up to 100 addresses in one call:
# curl -sS --fail --max-time 95 https://iplogs.com/v1/bulk-check \
#   -H 'content-type: application/json' -d '{"ips":["8.8.8.8","1.1.1.1"]}'

check.shcurl and jq; wget works too

What the code does

Every example sends the address to POST /v1/check and reads the same fields: verdict (clean, suspicious, vpn_likely or vpn_detected), score, is_vpn, is_proxy, is_tor, is_relay, is_hosting and ip_info.vpn_provider. The decision is one line: block when is_vpn, is_proxy or is_tor is true. Keep is_relay out of it if you want to let iCloud Private Relay and WARP users through.

A full check probes the address live and takes about 3 seconds, so the clients wait up to 35 seconds. Bulk calls take up to 100 addresses; the helpers split longer lists for you.

Limits per client address: 60 requests a minute on check; bulk allows 3 calls in a burst, then one every 5 seconds. A 429 carries Retry-After in seconds, which the code waits out once. Past 2,000 full checks a day the API still answers 200, from the fast path, with "mode": "fast". The X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset headers show where you stand.

Fast mode for login and checkout

Add "mode": "fast" to the request body and the answer comes from memory in microseconds, with no live probing. Use it where a request must not wait three seconds: sign-in, checkout, lead forms. Use the full check for review queues, account creation and anything you can do after the page has loaded.

curl https://iplogs.com/v1/check \
  -H 'content-type: application/json' \
  -d '{"ip":"8.8.8.8","mode":"fast"}'

In the code above, add "mode": "fast" to the object you send and lower the timeout to 2 seconds. Fast answers are not cached and leave out the active probes, so a server only a probe would catch can read clean until a full check sees it.

Framework guides and the full reference

The API reference lists every request field, response field and signal type. For a framework, these guides show where the check goes:

This is example code to paste into your project, not a published package. Nothing here needs updating when the API adds fields: read the ones you use and ignore the rest.