# ipfastcheck.com

> Free IP risk API — no signup; no key needed within a fair-use limit, a free personal key for more.
> Returns proxy/VPN/Tor detection, a risk score 0–100, a fraud score, blacklist status, geolocation and ASN in a single JSON call.
> CORS-enabled: call directly from browser JavaScript.
> Useful for LLM agents that need to qualify incoming IPs, enrich context, or flag suspicious traffic.

## Why use this API

- **Zero friction**: plain GET, no OAuth, no account.
- **Single round-trip**: geo + proxy detection + risk and fraud scores in one response.
- **Machine-friendly verdict**: `data.verdict.cls` is `safe`, `warn` or `risk`.
- **Cached**: an address is answered from cache and refreshed in the background, so repeated calls are instant.
- **IPv4 and IPv6** supported (public addresses only).

## Quick Start

Check any IP:

```
GET https://ipfastcheck.com/short/{ip}
```

Check the caller's own IP:

```
GET https://ipfastcheck.com/check
```

Response shape (abridged):

```json
{
  "ok": true,
  "data": {
    "ip": "8.8.8.8",
    "version": "IPv4",
    "geo": {"country": "United States", "country_code": "US", "region": "California", "city": "Mountain View", "zip": "", "lat": 37.4, "lon": -122.1, "flag": "🇺🇸"},
    "net": {"isp": "Google LLC", "org": "AS15169 Google LLC", "asn": "AS15169", "type": "datacenter"},
    "time": {"timezone": "America/Los_Angeles", "utc_offset": "-07:00"},
    "flags": {"fraud": false, "scam": false, "proxy": false, "vpn": false, "tor": false, "hosting": true, "abuse": false, "mobile": false},
    "extra": {"fraud_score": 42, "scam_score": null, "scam_risk": null, "abuse_score": null, "blocklist": false},
    "risk": 42,
    "verdict": {"cls": "risk", "text": "High risk"},
    "usage": {"key": "datacenter", "label": "Datacenter", "level": "risk"},
    "check_count": 1523,
    "first_seen": 1781900000,
    "last_check": 1790150000,
    "cached": true
  }
}
```

Key fields:

| Field               | Type    | Description                                                          |
|---------------------|---------|----------------------------------------------------------------------|
| `ok`                | bool    | `true` = success, `false` = error (see `error`)                      |
| `data.ip`           | string  | Checked IP address (canonical form)                                  |
| `data.geo.country_code` | string | ISO 3166-1 alpha-2                                                |
| `data.flags.*`      | bool    | proxy, vpn, tor, hosting (datacenter), fraud, scam, abuse, mobile    |
| `data.extra.fraud_score` | integer | Fraud score 0–100                                              |
| `data.extra.blocklist` | bool | Listed on a curated blacklist                                        |
| `data.risk`         | integer | Risk score 0–100                                                     |
| `data.verdict.cls`  | string  | `safe` / `warn` / `risk` — see below                                 |

Verdict:

| `verdict.cls` | `verdict.text` | Rule                                                                     |
|---------------|----------------|--------------------------------------------------------------------------|
| `risk`        | High risk      | any of proxy, VPN, Tor, datacenter, fraud, abuse, blacklist — or risk ≥ 70 |
| `warn`        | Caution        | scam flag, or risk 35–69                                                 |
| `safe`        | Clean          | otherwise                                                                |

## Limits and keys

- Without a key: 60 requests/minute and 1000/day per client IP (per /64 for IPv6).
- New addresses (not yet cached) are additionally limited to 20/minute and 300/day per client IP.
- With a free personal key: 300/minute and 10 000/day. Get one from the Telegram bot @ipfastcheckbot with `/apikey`, then send it as the `X-API-Key` header or `?key=` parameter.
- Over a limit: HTTP 429 with `Retry-After`; responses carry `X-RateLimit-Limit`, `X-RateLimit-Remaining` and `X-RateLimit-Reset` (unix time).
- Errors: 400 = not a public IP address, 401 = invalid API key, 429 = rate limit, 502 = lookup failed.

## Plain Text (legacy / curl-friendly)

```
curl https://ipfastcheck.com/            # own IP, plain text
curl https://ipfastcheck.com/ip          # own IP, plain text
curl https://ipfastcheck.com/country     # own country code, plain text
curl https://ipfastcheck.com/short/1.1.1.1   # full JSON for an address
```

## Optional

- IP detail page: https://ipfastcheck.com/ip/8.8.8.8 — human-readable HTML report for any IP, useful for linking users to a full breakdown.
- Telegram bot: @ipfastcheckbot — interactive IP checks, price alerts and personal API keys.
- Full API documentation: https://ipfastcheck.com/api