IP Intelligence API
Query any IP address for geolocation, network identity, and threat intelligence.
Base URL: https://api.wayscloud.services
Authentication
All endpoints require a WAYSCloud API key in the X-API-Key header.
curl -H "X-API-Key: wayscloud_ip_YOUR_KEY" \
https://api.wayscloud.services/v1/ip/8.8.8.8Activate your key via the WAYSCloud dashboard under IP Intelligence.
Rate limits
Rate limits are enforced per API key based on your tier:
| Tier | Requests/day | Burst (per minute) |
|---|---|---|
| Free | 1,000 | 20 |
| Professional | 10,000 | 200 |
| Enterprise | Unlimited | 1,000 |
When quota is exceeded, the API returns 429 Too Many Requests with details about your limit and reset time.
Endpoints
| Method | Path | Description |
|---|---|---|
GET | /v1/ip/{ip} | IP summary |
GET | /v1/ip/{ip}/geo | Geolocation |
GET | /v1/ip/{ip}/threat | Threat assessment |
GET | /v1/ip/threats/live | Live threat feed |
GET | /v1/ip/countries/{code} | Country intelligence |
GET | /v1/ip/asn/{asn} | ASN intelligence |
GET /v1/ip/
IP summary — returns geolocation, network, threat assessment, and detection flags in a single call.
curl -H "X-API-Key: YOUR_KEY" \
https://api.wayscloud.services/v1/ip/8.8.8.8Response:
{
"ip": "8.8.8.8",
"ip_version": 4,
"hostname": "dns.google",
"geo": {
"country": "US",
"country_name": "United States",
"city": "Mountain View",
"region": "California",
"latitude": 37.386,
"longitude": -122.084,
"timezone": "America/Los_Angeles"
},
"network": {
"asn": 15169,
"isp": "Google LLC",
"org": "Google LLC",
"connection_type": "datacenter"
},
"threat": {
"score": 0,
"level": "clean",
"is_clean": true
},
"flags": {
"vpn": false,
"proxy": false,
"tor": false,
"datacenter": true,
"botnet": false
}
}Response fields
| Field | Type | Description |
|---|---|---|
ip | string | Queried IP address |
ip_version | integer | 4 or 6 |
hostname | string | null | Reverse DNS hostname. Null if no rDNS exists. |
geo.country | string | null | ISO 3166-1 alpha-2 country code |
geo.country_name | string | null | Human-readable country name |
geo.city | string | null | City name |
geo.region | string | null | Region or state |
geo.latitude | number | null | Latitude coordinate |
geo.longitude | number | null | Longitude coordinate |
geo.timezone | string | null | IANA timezone identifier |
network.asn | integer | null | Autonomous System Number |
network.isp | string | null | Internet Service Provider |
network.org | string | null | Organization name |
network.connection_type | string | Enum: residential, mobile, business, datacenter, hosting, education, government, unknown |
threat.score | number | Threat score, 0–100 |
threat.level | string | Enum: clean, low, medium, high, critical |
threat.is_clean | boolean | true if no threat reports exist |
flags.vpn | boolean | VPN endpoint detected |
flags.proxy | boolean | Proxy detected |
flags.tor | boolean | Tor exit node detected |
flags.datacenter | boolean | Hosted in datacenter/cloud |
flags.botnet | boolean | Botnet association detected |
GET /v1/ip/{ip}/geo
Geolocation — returns location, network identity, and reverse DNS.
curl -H "X-API-Key: YOUR_KEY" \
https://api.wayscloud.services/v1/ip/8.8.8.8/geoResponse:
{
"ip": "8.8.8.8",
"ip_version": 4,
"hostname": "dns.google",
"country": "US",
"country_name": "United States",
"city": "Mountain View",
"region": "California",
"latitude": 37.386,
"longitude": -122.084,
"timezone": "America/Los_Angeles",
"asn": 15169,
"isp": "Google LLC",
"org": "Google LLC",
"connection_type": "datacenter"
}GET /v1/ip/{ip}/threat
Threat assessment — returns threat score, categories, and detection flags.
curl -H "X-API-Key: YOUR_KEY" \
https://api.wayscloud.services/v1/ip/1.2.3.4/threatResponse:
{
"ip": "1.2.3.4",
"score": 85,
"level": "critical",
"is_clean": false,
"total_reports": 42,
"categories": ["brute-force", "scanner"],
"first_seen": "2025-11-03T14:22:00Z",
"last_seen": "2026-03-29T08:15:00Z",
"flags": {
"vpn": false,
"proxy": true,
"tor": false,
"datacenter": true
}
}| Field | Type | Description |
|---|---|---|
score | number | Threat score, 0–100 |
level | string | clean, low, medium, high, critical |
is_clean | boolean | No threat reports exist |
total_reports | integer | Number of threat reports |
categories | string[] | null | Attack categories (null if clean) |
first_seen | string | null | ISO 8601 timestamp of first report |
last_seen | string | null | ISO 8601 timestamp of most recent report |
flags | object | Detection flags (vpn, proxy, tor, datacenter) |
GET /v1/ip/threats/live
Live threat feed — returns the most recently reported threat IPs.
curl -H "X-API-Key: YOUR_KEY" \
"https://api.wayscloud.services/v1/ip/threats/live?limit=10"Parameters:
| Parameter | Type | Default | Description |
|---|---|---|---|
limit | integer | 25 | Number of entries (1–100) |
Response:
{
"updated_at": "2026-03-29T16:00:00Z",
"count": 10,
"threats": [
{
"ip": "1.2.3.4",
"score": 92,
"level": "critical",
"categories": ["brute-force"],
"country": "CN",
"last_seen": "2026-03-29T15:58:00Z"
}
]
}GET /v1/ip/countries/
Country intelligence — threat summary for a country.
curl -H "X-API-Key: YOUR_KEY" \
https://api.wayscloud.services/v1/ip/countries/CNPath parameter code is an ISO 3166-1 alpha-2 country code (e.g. US, CN, RU, NO).
GET /v1/ip/asn/
ASN intelligence — threat summary for an Autonomous System.
curl -H "X-API-Key: YOUR_KEY" \
https://api.wayscloud.services/v1/ip/asn/15169Path parameter asn is a numeric ASN (1–4294967295).
Error responses
All errors follow a consistent format:
{
"detail": {
"error": "error_code",
"message": "Human-readable description"
}
}| Status | Error code | Description |
|---|---|---|
| 400 | invalid_ip | Invalid IP address format |
| 400 | invalid_country_code | Invalid ISO country code |
| 400 | invalid_asn | ASN out of valid range |
| 401 | — | Missing or invalid API key |
| 403 | no_subscription | No active IP Intelligence subscription |
| 429 | quota_exceeded | Daily request limit reached |
| 404 | not_found | No data for requested resource |
Enums
threat.level
| Value | Score range |
|---|---|
clean | 0 |
low | 1–29 |
medium | 30–59 |
high | 60–84 |
critical | 85–100 |
connection_type
residential | mobile | business | datacenter | hosting | education | government | unknown