Best IP Reputation APIs 2026:
Free Tier vs $5K+/Year Plans

An IP reputation API answers one question in real time: can I trust the network this request came from? The right provider depends on what you actually need — raw geolocation, ISP metadata, or security signals like VPN, proxy, Tor, and datacenter detection. Vendors differ enormously on detection coverage, latency, and free-tier limits, and the wrong pick either misses fraud or blows your latency budget on a hot path.

Below we compare the leading options — MaxMind, IPinfo, IPQualityScore, AbuseIPDB, and IPASIS — on the signals that matter for fraud and bot detection, with real request/response examples and honest "best for" guidance.

What makes a good IP reputation API?

Before the comparison, the four things worth measuring:

• Detection coverage — does it flag VPNs, residential/datacenter proxies, Tor exit nodes, hosting/ASN origin, and abuse history? Geolocation alone is not reputation.
• Latency — if you call it inline on login or checkout, anything over ~50ms is a tax on every request. Edge-cached lookups matter.
• Free tier & pricing model — per-query metering vs. flat monthly changes cost predictability dramatically at scale.
• Scoring vs. raw data — do you get a ready-to-use risk score, or raw fields you must turn into a decision yourself?

1. MaxMind

Best for: Offline GeoIP databases and self-hosted lookups.

Detection: GeoIP2 is the industry standard for geolocation and ASN. Anonymous-IP and fraud signals (minFraud) are separate, paid add-ons. Latency: near-zero when you host the .mmdb file locally; the minFraud API adds network round-trips. Free tier: GeoLite2 databases are free with attribution; minFraud scoring is not. Verdict: unbeatable if you want a local database and don't need real-time proxy/VPN risk scoring — but you assemble the risk logic yourself.

2. IPinfo

Best for: Clean ISP / company / ASN metadata.

Detection: excellent for "who owns this IP?" — company, carrier, hosting flag, ASN. Privacy-detection (VPN/proxy/Tor) is a higher-tier plan. Latency: fast hosted API, plus downloadable datasets. Free tier: generous for geolocation (tens of thousands of requests/month), but security signals require a paid tier. Verdict: a great enrichment source; less of a turnkey "is this a bot?" risk engine than the security-first vendors.

3. IPQualityScore (IPQS)

Best for: Broad fraud scoring with lots of signals.

Detection: VPN, proxy, Tor, bot, recent-abuse, plus a fraud-score. Very feature-rich. Latency: hosted API; acceptable but not edge-tier. Free tier: a few thousand lookups/month, then per-query pricing that climbs quickly at volume. Verdict: a strong all-rounder — but per-query billing gets expensive, which is exactly why teams look for a flat-rate IPQS alternative.

4. AbuseIPDB

Best for: Community-sourced abuse history.

Detection: a crowd-reported "abuse confidence" score based on user submissions (spam, brute-force, scanning). Latency: hosted API. Free tier: ~1,000 checks/day for non-commercial use. Verdict: a useful supplementary signal, but reporting is uneven and it does not classify VPN/proxy/datacenter origin the way a dedicated engine does.

5. IPASIS

Best for: Real-time security & fraud prevention with a predictable bill.

IPASIS is built specifically for security teams that call the API inline on login, signup, and checkout.

• Detection: VPN, proxy, Tor exit node, datacenter, and high-risk ASN origin, combined into a single Interaction Trust Score (0–100) — higher = higher risk. Add email intelligence (disposable, gibberish, newborn domain) in the same call.
• Latency: <20ms globally, edge-cached — safe to call on a hot path.
• Free tier: 3,000 requests/month, no credit card.
• Pricing: flat monthly plans — no per-query metering surprises.

What the response actually looks like

A single request returns the origin classification and a ready-to-use score, so you decide with one call rather than stitching together three datasets:

# Query the reputation of an IP
curl "https://api.ipasis.com/v1/ip/45.84.107.200" \
  -H "Authorization: Bearer $IPASIS_API_KEY"

{
  "ip": "45.84.107.200",
  "trust_score": 88,          // 0-100, higher = higher risk
  "is_vpn": false,
  "is_proxy": true,
  "is_tor": false,
  "is_datacenter": true,
  "asn": "AS200651",
  "organization": "Flokinet",
  "recommendation": "block"
}

Turning that into a gate is a couple of lines:

import requests

def is_risky(ip: str, threshold: int = 75) -> bool:
    r = requests.get(
        f"https://api.ipasis.com/v1/ip/{ip}",
        headers={"Authorization": f"Bearer {API_KEY}"},
        timeout=1.0,
    )
    data = r.json()
    # Block obvious anonymizers outright, or gate on the score
    return data["is_tor"] or data["trust_score"] >= threshold

Side-by-side comparison

Which should you choose?

• You need a local GeoIP database → MaxMind.
• You need clean ISP/company metadata → IPinfo.
• You want turnkey, low-latency VPN/proxy/Tor detection with a predictable bill → IPASIS.
• You want crowd-sourced abuse history as a secondary signal → AbuseIPDB, layered on top of a primary engine.

For most fraud and bot-detection use cases, the decision comes down to security coverage plus latency plus predictable cost. You can verify any IP right now with our free IP reputation lookup tool, or browse the datacenter IP ranges and high-risk ASN directory to see the kind of data these APIs surface.

Frequently asked questions