Geo API

country_code/country_name, is_eu, continent/continent_code, region/region_code, city, postal_code, latitude, longitude. timezone as an IANA zone plus a time_zone object with id, utc_offset (e.g. +02:00), utc_offset_seconds, is_dst (daylight-saving flag) and current_time (current local time as ISO 8601). If the city level returns no zone but the country has only one, timezone is filled with the primary country zone; multi-time-zone countries (US, Russia, …) deliberately stay null instead of inventing a blanket zone.

Per detected country calling_code (phone calling code as an integer, e.g. 49), currency as an object of code and symbol (e.g. EUR / €) and languages as an array of official and widely spoken languages in ISO 639-1 format. These fields derive from the country code and save you a second lookup table.

network is the matched network range as an IPv4 CIDR (e.g. 8.8.8.0/24), rir the responsible Regional Internet Registry (RIPE, ARIN, APNIC, LACNIC, AFRINIC). asn, isp and isp_domain name the network operator. From the RIR registry additionally org_id (org handle to group all networks of one company), org_type (e.g. LIR or end-user), registry_country (operator country per the registry), allocation_date (first registration of the ASN — a very young network can be a risk signal) and abuse_contact (operator abuse email for abuse reports).

Per IP, flags for hosting (is_hosting), datacenter (is_datacenter), VPN (is_vpn), Tor (is_tor), satellite (is_satellite), anycast/resolver (is_anycast), iCloud Private Relay (is_relay) and bogon (is_bogon), plus cloud_provider (detects known cloud ASNs such as AWS, Google Cloud, Azure; otherwise null) and a derived connection_type (hosting, satellite, relay or isp). From these a 0–100 abuse_score is computed — Tor (+40), VPN (+30), hosting (+20) and anycast without a known public resolver (+10) add up; a hit in the Spamhaus DROP list raises the score to at least 90. risk groups the score coarsely: niedrig (below 20), erhöht (below 50), hoch (50 and above). The risk label is always returned in German regardless of lang. If the reputation datasets cannot be read, the API returns abuse_score and risk as null instead of a top grade. All flags and the score are estimates based on known IP ranges — not a guaranteed verdict.

Instead of faking pinpoint accuracy, every response returns accuracy_radius_km (estimated radius in km around the coordinates) and confidence per field (country, region, city as 0–100). The radius reflects the granularity reached: city-precise from an operator/geofeed source about 25 km (iCloud relay locations coarser, about 80 km), from the city DB about 50 km, region-only 150 km, country-only 600 km. Both are open estimates — not guaranteed precision. If the open location database only knows a placeholder for an address range (such as the operator's head office, where connections from across the country pile up), city and region stay empty and the radius is 600 km — no answer rather than a wrong one. If the operator publishes the location itself via geofeed, its value applies.