IP Intelligence

Real-time IP threat scoring, geolocation, and network intelligence — built for security automation, abuse detection, and traffic enrichment.

What it is

IP Intelligence provides a unified API for understanding any IP address. Given an IP, it returns:

• Geolocation: country, city, region, coordinates, timezone
• Network identity: ASN, ISP, organization, connection type
• Threat assessment: score (0–100), threat level, attack categories, detection flags
• Detection flags: VPN, proxy, Tor, datacenter, botnet

Data is sourced from WAYSCloud's own threat intelligence engine, which processes millions of events daily from honeypots, abuse feeds, and community reporters.

Public portal vs production API

WAYSCloud offers two ways to access IP Intelligence:

Surface	URL	Purpose
Public portal	ip.wayscloud.services	Explore, look up IPs, view live threats. No auth required.
Production API	api.wayscloud.services/v1/ip/*	Stable integration endpoint. API key required. Rate-limited per tier.

The public portal is ideal for exploration and one-off lookups. For production integrations — automated blocking, log enrichment, login protection — use the canonical API.

When to use

Use IP Intelligence when you need to:

• Block malicious traffic at login or API gateway
• Enrich security logs with geo and threat context
• Detect VPN/proxy/Tor usage in fraud prevention
• Build SOC dashboards with live threat feeds
• Score IPs in real-time for risk-based access control
• Identify datacenter traffic vs residential users

When NOT to use:

• For DNS-level threat filtering — see DNS Shield
• For email threat analysis — see Threat Shield

How it works

Your app
  → GET api.wayscloud.services/v1/ip/1.2.3.4
  → WAYSCloud authenticates your API key
  → Checks your tier quota
  → Queries the intelligence engine (private network)
  → Returns normalized, stable response

All lookups return in under 200ms. The intelligence engine aggregates data from multiple sources and applies scoring models that weigh recency, volume, and category severity.

Key features

Threat scoring (0–100)

Every IP receives a numeric score:

Level	Score	Meaning
clean	0	No known reports
low	1–29	Minor or old activity
medium	30–59	Moderate recent activity
high	60–84	Significant threat signals
critical	85–100	Active attacker, immediate risk

Detection flags

Boolean flags for common classifications:

• vpn — commercial VPN endpoint
• proxy — open or anonymous proxy
• tor — Tor exit node
• datacenter — hosted in cloud/datacenter (not residential)
• botnet — associated with botnet command and control

Connection type (enum)

Classifies the network type:

residential | mobile | business | datacenter | hosting | education | government | unknown

Geolocation

Country (ISO 3166-1 alpha-2), city, region, coordinates, timezone. Reverse DNS hostname when available.

Tiers and pricing

Tier	Requests/day	Rate limit	Price
Free	1,000	20/min	Free
Professional	10,000	200/min	499 NOK/mo
Enterprise	Unlimited	1,000/min	2,999 NOK/mo

All tiers require an API key. Activate via the WAYSCloud dashboard.

Getting started

1. Log in to my.wayscloud.services
2. Navigate to IP Intelligence and click Activate
3. Copy your API key
4. Make your first request:

curl -H "X-API-Key: YOUR_KEY" \
  https://api.wayscloud.services/v1/ip/8.8.8.8

API endpoints

See the full API reference for all endpoints, schemas, and examples.

Endpoint	Description
GET /v1/ip/{ip}	Full summary
GET /v1/ip/{ip}/geo	Geolocation only
GET /v1/ip/{ip}/threat	Threat assessment only
GET /v1/ip/threats/live	Live threat feed
GET /v1/ip/countries/{code}	Country intelligence
GET /v1/ip/asn/{asn}	ASN intelligence

Related services

• DNS Shield — DNS-level threat filtering
• Verify — OTP and phone verification with IP risk scoring
• Threat Shield — Comprehensive email and network threat analysis
• Protect Login with IP Intelligence — build flow