IPQualityScore

Detect fraud with IPQualityScore (IPQS): score how risky an IP address, email address, phone number, link, file or whole transaction is, spot proxies, VPNs, bots, disposable emails, VOIP numbers, phishing and malware, and check for credentials leaked on the dark web. Manage your allowlist and blocklist, report fraud, record conversions, run bulk validations and Fraud Flows, and read your lookup history and credit usage. Needs an IPQualityScore account; the free plan includes 1,000 lookups a month.

Actions

Action	What it does
Add to allowlist	Allowlist an IP address or range, an ISP, a device, an email address, a domain or a phone number, so IPQS always scores it 0 and never flags it, for trusted customers or partners.
Add to blocklist	Blocklist an IP address or range, an ISP, a device, an email address, a domain or a phone number, so IPQS always scores it 100 and flags it as risky, for known fraudsters.
Check for leaked data	Check the dark web and known data breaches for an email address, a username or a password, or an email or username together with its password: whether it was exposed, in which breaches, and since when.
Check IP address	Check how risky an IP address is with IPQS's Proxy and VPN Detection: a fraud score from 0 to 100, whether it is a proxy, a VPN, Tor, a bot or a crawler, any recent abuse, its connection type, ISP and location.
Download bulk validation results	Download a finished bulk validation's results as a CSV file, every record or only the clean, bad or pristine ones, for a later step to save, send or read.
Get average fraud score	Get the average fraud score of your past IP checks, or of one device tracker's fingerprints, for a country, a date range, a conversion status or a custom variable such as a user or a campaign.
Get bulk validation	Check how far a bulk validation has got, whether it is finished, and which result files it has to download.
Get credit usage	Get the account's available credits and how many this billing period's lookups have used, API by API.
Get device fingerprint result	Get a device fingerprint result from the server side, by the request ID your site or app received, or the latest one for a user by custom variables.
Get file scan result	Check on a malware scan that was still pending, by its request ID, and get its verdict once it has one.
Get fraud flow results	Check how far a user got through a Fraud Flow sent with Send fraud flow, and what each step found: their form answers and the IP, email, phone, device and ID checks.
Get IP abuse feed	Get the IP addresses IPQS has recently seen in bot attacks, credential stuffing, brute forcing, proxies and other abuse, from its IP Address Abuse Feed, for a time range, to block them at your firewall.
Get login history	List the logins and login attempts to your IPQS account, with where each came from and its fraud score, to audit access.
Get past lookup	Get a past IP, email or device fingerprint lookup again, by its request ID, or the latest one made with given custom variables, with everything IPQS answered at the time.
List allowlist	List everything on the account's allowlist.
List blocklist	List everything on the account's blocklist.
List bulk validations	List the account's bulk validations, newest first, 50 a page, with each one's status.
List countries	List the two-letter country codes IPQS uses, with each country's name, to turn a code from a lookup into a name.
List device risk reasons	List the reason codes a device fingerprint result can carry, such as FR_BOT, with what each means.
List past lookups	List your past lookups of one kind (IP checks, email or phone checks, URL or file scans, device fingerprints or leak checks) from a date range, newest first, up to 250 a page.
List transaction risk reasons	List the reason codes transaction scoring can give, such as TR_SUSPECT_EMAIL, with what each means.
Remove from allowlist	Take a value off the account's allowlist.
Remove from blocklist	Take a value off the account's blocklist.
Report fraud	Report an IP address, email address, phone number or past lookup as fraudulent, so IPQS trains your account's scoring on it, such as after a chargeback or a fake sign up.
Scan file for malware	Scan a file for viruses, ransomware, trojans, spyware and other malware with IPQS's scanning engines, in a live sandbox, and wait for the verdict: malicious, clean, pending or unknown, with each engine's finding.
Scan URL	Scan a link or a domain for phishing, malware, spam, parked domains and adult content, with a risk score from 0 to 100, where it redirects to, the site's category, server, domain age and DNS records.
Score transaction	Score how risky a payment, order or new user is from whatever details you have: billing and shipping names, addresses, emails and phones, the card's BIN and last four, the order amount, the username and password.
Send fraud flow	Start one of your IPQS Fraud Flows for a user: a link to a hosted verification (their email, phone, IP, device or ID), returned for you to send, or emailed or texted by IPQS.
Start bulk validation	Send a whole list of email addresses, phone numbers, IP addresses or URLs for IPQS to check in bulk: as values from an earlier step, or as a CSV file.
Update past lookup	Update a past IP, email or device fingerprint lookup: mark it converted or not (say, when a sign up turns into a paying customer) with the date, or correct its click date, user agent, language or custom variables, so IPQS can learn and rescore.
Validate email address	Check whether an email address is real and safe to accept: whether it is valid and deliverable, disposable, a spam trap or honeypot, a catch-all, recently abusive or leaked, with a fraud score, its domain's age and trust, and a suggested domain for typos like gmai.com.
Validate phone number	Check whether a phone number is real and safe to accept: whether it is valid and active, its line type (mobile, landline, VOIP, toll free), carrier and location, whether it is prepaid, risky, a spammer or recently abusive, with a fraud score.

Add to allowlist

Allowlist an IP address or range, an ISP, a device, an email address, a domain or a phone number, so IPQS always scores it 0 and never flags it, for trusted customers or partners.

Inputs

Applies tolookup_typetextRequired: Which lookups the entry applies to.One of: proxy (IP address checks), email (Email address checks), phone (Phone number checks), url (URL scans), devicetracker (Device fingerprints (website)), mobiletracker (Device fingerprints (mobile app)).
ValuevaluetextRequired: The value: an IP address, a CIDR range like 203.0.113.0/24, an ISP name, a device ID, an email address, a domain or a phone number, to suit what it applies to.
Value typevalue_typetext: What kind of value it is. Leave it empty to work it out: an IP address or range, and for IP checks anything else as an ISP name. Choose it for a device ID.One of: ip (IP address), cidr (IP range (CIDR)), isp (ISP name), deviceid (Device ID), email (Email address), domain, phone (Phone number).
Reasonreasontext: Why the value is on the list, for your own records.

Outputs

lookup_typetext: Which lookups the entry applies to: proxy (IP addresses), email, phone, url, devicetracker or mobiletracker.
messagetext: IPQS's confirmation, in its words.
reasontext: The reason given, when one was.
request_idtext: IPQS's ID for this change.
valuetext: The value, as it was sent.
value_typetext: What kind of value it is: ip, cidr, isp, deviceid, vendorid, email, domain or phone.

Example output

{
  "lookup_type": "proxy",
  "message": "Successfully inserted Allow List entry.",
  "reason": "Office network",
  "request_id": "CXSWDmbNcw",
  "value": "1.1.1.1",
  "value_type": "ip"
}

Add to blocklist

Blocklist an IP address or range, an ISP, a device, an email address, a domain or a phone number, so IPQS always scores it 100 and flags it as risky, for known fraudsters.

Inputs

Applies tolookup_typetextRequired: Which lookups the entry applies to.One of: proxy (IP address checks), email (Email address checks), phone (Phone number checks), url (URL scans), devicetracker (Device fingerprints (website)), mobiletracker (Device fingerprints (mobile app)).
ValuevaluetextRequired: The value: an IP address, a CIDR range like 203.0.113.0/24, an ISP name, a device ID, an email address, a domain or a phone number, to suit what it applies to.
Value typevalue_typetext: What kind of value it is. Leave it empty to work it out: an IP address or range, and for IP checks anything else as an ISP name. Choose it for a device ID or a mobile app's vendor ID.One of: ip (IP address), cidr (IP range (CIDR)), isp (ISP name), deviceid (Device ID), email (Email address), domain, phone (Phone number), vendorid (Mobile app vendor device ID).
Reasonreasontext: Why the value is on the list, for your own records.

Outputs

lookup_typetext: Which lookups the entry applies to: proxy (IP addresses), email, phone, url, devicetracker or mobiletracker.
messagetext: IPQS's confirmation, in its words.
reasontext: The reason given, when one was.
request_idtext: IPQS's ID for this change.
valuetext: The value, as it was sent.
value_typetext: What kind of value it is: ip, cidr, isp, deviceid, vendorid, email, domain or phone.

Example output

{
  "lookup_type": "email",
  "message": "Successfully inserted Block List entry.",
  "reason": "Chargeback",
  "request_id": "CXSWDmbNcw",
  "value": "fraud.signup@example.com",
  "value_type": "email"
}

Check for leaked data

Check the dark web and known data breaches for an email address, a username or a password, or an email or username together with its password: whether it was exposed, in which breaches, and since when. A password is hashed before it leaves Lodol. Use it to stop account takeovers or to warn users with compromised credentials.

Inputs

Email addressemailtext: An email address to look for in leaks. With a password, the two are checked as a pair.
Usernameusernametext: A username to look for in leaks, instead of an email address. With a password, the two are checked as a pair.
Passwordpasswordtext: A password to look for in leaks. It is hashed with SHA-256 before it leaves Lodol; an MD5, SHA-1 or SHA-256 hash is sent as it is.

Outputs

checkedtext: What was checked: email, username, password, emailpass (an email address and password together) or userpass (a username and password together).
exposedtrue/false: Whether it was found in a data breach or leak.
first_seenobject: When IPQS first saw it in a leak. Its fields are null when unknown.
plain_text_passwordtrue/false: Whether a password was found leaked in plain text.
request_idtext: IPQS's ID for this lookup. Pass it to Report fraud to report the lookup as fraudulent, or to Get past lookup to read it again.
sourceslist: The breached websites or databases it was found in, e.g. Exploit Antipublic.

Example output

{
  "checked": "email",
  "exposed": true,
  "first_seen": {
    "human": "1 year ago",
    "iso": "2023-04-10T10:37:29-04:00",
    "timestamp": 1681137449
  },
  "plain_text_password": true,
  "request_id": "DXdRw3mvSm",
  "sources": [
    "example.com",
    "example.com"
  ]
}

Check IP address

Check how risky an IP address is with IPQS's Proxy and VPN Detection: a fraud score from 0 to 100, whether it is a proxy, a VPN, Tor, a bot or a crawler, any recent abuse, its connection type, ISP and location. Pass the visitor's user agent too for bot and device checks. A score of 90 or more is the usual point to block a sign up, login or payment.

Inputs

IP addressip_addresstextRequired: The public IPv4 or IPv6 address to check, such as the one a visitor signed up, logged in or paid from.
Strictnessstrictnessnumber: How deep the check goes, 0 to 3. IPQS recommends starting at 0 and moving to 1 if fraud gets through: 2 and 3 are very strict and flag honest users too.From 0 to 3. Default: 0.
User agentuser_agenttext: The visitor's browser user agent. With it IPQS also checks for bots and fills in the device, browser and operating system.
User languageuser_languagetext: The visitor's browser language header, e.g. en-US,en;q=0.9, which IPQS weighs into the score.
Allow public access pointsallow_public_access_pointstrue/false: Go easier on schools, universities, offices and public hotspots, whose shared addresses would otherwise score as risky. IPQS recommends it, so it is on unless turned off.Default: true.
Lighter penaltieslighter_penaltiestrue/false: Score addresses of mixed quality lower, if honest users are being flagged.Default: false.
Mobile devicemobiletrue/false: Score the lookup as a mobile device. Use it for mobile visitors when there is no user agent; it gives odd results for other devices.Default: false.
Fastfasttrue/false: Skip some slower forensic checks for a quicker answer, at a small cost in accuracy.Default: false.
Custom variablescustom_variablesobject: Your own tracking variables to record with the lookup, such as userID or transactionID, so you can find it again in your history and IPQS can spot patterns per user. Each must first be set up in your IPQS account settings.

Outputs

abuse_eventslist: Enterprise data point: the kinds of abuse IPQS has recently seen from the address, and when each was last seen. Empty when there are none, or when the plan does not include them.
abuse_velocitytext: How often the address takes part in abuse across IPQS's network: high, medium, low or none.
active_tortrue/false: Whether the address is an active Tor exit.
active_vpntrue/false: Whether the address is an active VPN connection of a popular VPN service or a private VPN server.
asnnumber: The autonomous system number, when known.
bot_statustrue/false: Whether bots or other non-human traffic have recently used the address for automated fraud.
browsertext: The browser and its version, e.g. Chrome 80.0. Read from the user agent, so null without one.
citytext: The city the address is in, when known.
connection_typetext: What kind of connection the address is: Residential, Corporate, Education, Mobile or Data Center.
country_codetext: Two-letter code of the country the address is in, e.g. US.
device_brandtext: The device's brand, e.g. Apple. Read from the user agent, so null without one.
device_modeltext: The device's model, e.g. iPad. Read from the user agent, so null without one.
dynamic_connectiontrue/false: Enterprise data point: whether the provider assigns addresses dynamically, so its user will likely have a different address soon. Null when the plan does not include it.
fraud_scorenumber: IPQS's fraud score for the address, 0 to 100. 75 and above is suspicious, often a proxy or VPN user rather than a fraudster; 85 and above is high risk; 90 and above has shown recent or frequent abuse, and is the usual point to block.
frequent_abusertrue/false: Enterprise data point: whether the address has a consistent history of abuse over six months or more. Null when the plan does not include it.
high_risk_attackstrue/false: Enterprise data point: whether the address has taken part in attacks such as phishing, brute forcing, DDoS, credential stuffing, scraping or form spam. Null when the plan does not include it.
hosttext: The address's host name, when it has one.
ip_addresstext: The IP address that was checked.
is_crawlertrue/false: Whether the address is a confirmed crawler of a search engine or service, such as Google, Bing, Baidu, Yandex, DuckDuckGo, Facebook, UptimeRobot or AppleBot.
isptext: The internet service provider, when known.
latitudenumber: The address's latitude, when known.
longitudenumber: The address's longitude, when known.
mobiletrue/false: Whether the user agent is a mobile browser. Always false when no user agent was given.
operating_systemtext: The device's operating system and version, e.g. Mac 10.6. Read from the user agent, so null without one.
organizationtext: The organization using the address, when known: the ISP itself, its parent company or one of its customers.
proxytrue/false: Whether the address is suspected to be a proxy of any kind: SOCKS, elite, anonymous, VPN or Tor.
recent_abusetrue/false: Whether IPQS has verified abuse from the address in the past few days: a chargeback, account takeover, compromised device, fake sign up, bot attack and the like.
recent_data_matcheslist: How often IPQS has seen the values sent in this lookup over the last 7 days, one entry per value. Empty when it has none to report.
recent_unique_user_valueslist: For your own tracking variables sent with the lookup (such as a user ID), how many different values of each kind IPQS has seen with them recently. Empty when none were sent.
regiontext: The region or state the address is in, when known.
request_idtext: IPQS's ID for this lookup. Pass it to Report fraud to report the lookup as fraudulent, or to Get past lookup to read it again.
security_scannertrue/false: Enterprise data point: whether the address is a verified security scanner of a trusted vendor, such as Tenable or Qualys. Null when the plan does not include it.
shared_connectiontrue/false: Enterprise data point: whether the address likely has many users at once, such as a mobile network, an office, a library, a hotel or a company VPN. Null when the plan does not include it.
timezonetext: The address's time zone, e.g. America/New_York, when known.
tortrue/false: Whether the address is suspected to be a Tor connection, including past Tor nodes and exits. proxy is always true when this is.
trusted_networktrue/false: Enterprise data point: whether the address is on a company network with low abuse rates and strong security. Null when the plan does not include it.
vpntrue/false: Whether the address is suspected to be a VPN connection, including data center ranges that can become VPNs at any time. proxy is always true when this is.
zip_codetext: The address's postal code, when known. One address can span several postal codes in a city.

Example output

{
  "abuse_events": [],
  "abuse_velocity": "medium",
  "active_tor": false,
  "active_vpn": false,
  "asn": 30036,
  "bot_status": false,
  "browser": "Chrome 122.0",
  "city": "Houston",
  "connection_type": "Residential",
  "country_code": "US",
  "device_brand": "Apple",
  "device_model": "iPad",
  "dynamic_connection": false,
  "fraud_score": 25,
  "frequent_abuser": false,
  "high_risk_attacks": false,
  "host": "192-0-2-110.client.mchsi.com",
  "ip_address": "8.8.8.8",
  "is_crawler": false,
  "isp": "Mediacom Cable",
  "latitude": 29.7079,
  "longitude": -95.401,
  "mobile": false,
  "operating_system": "Mac 10.6",
  "organization": "Mediacom Cable",
  "proxy": false,
  "recent_abuse": true,
  "recent_data_matches": [],
  "recent_unique_user_values": [],
  "region": "Texas",
  "request_id": "0w8WYS",
  "security_scanner": false,
  "shared_connection": true,
  "timezone": "America Matamoros",
  "tor": false,
  "trusted_network": false,
  "vpn": false,
  "zip_code": "77001"
}

Download bulk validation results

Download a finished bulk validation's results as a CSV file, every record or only the clean, bad or pristine ones, for a later step to save, send or read.

Inputs

Bulk validation IDbulk_validation_idnumberRequired: The id Start bulk validation returned.At least 1.
Resultsresultstext: Which records to download.One of: all (Every record), clean (Only the clean records), bad (Only the bad, invalid or unclean records), pristine (Only the extremely clean records). Default: all.

Outputs

bulk_validationobject: The bulk validation the results are from.
byte_sizenumber: The file's size in bytes.
content_typetext: The file's type, text/csv.
document_reftext: The stored file's reference, for a later step.
documentslist: The results file, ready to attach to a later step.
filenametext: The file's name.
urltext: A link that serves the stored file.

Example output

{
  "bulk_validation": {
    "aborted": false,
    "file_name": "test.csv",
    "finished": true,
    "id": 827750,
    "invalid_records": 0,
    "list_type": "proxy",
    "request_id": "HE1BDCGjmf",
    "status": "FINISHED",
    "strictness": 0
  },
  "byte_size": 131,
  "content_type": "text/csv",
  "document_ref": "doc_5c0e2b7a9d4f4e1b8a6c3d2e1f0a9b8c",
  "documents": [
    {
      "content_type": "text/csv",
      "document_ref": "doc_5c0e2b7a9d4f4e1b8a6c3d2e1f0a9b8c",
      "filename": "example.csv",
      "size_bytes": 131,
      "url": "/actions/core/serve-document/doc_5c0e2b7a9d4f4e1b8a6c3d2e1f0a9b8c?teamId=6876e08ad6296a1d681d3c7c"
    }
  ],
  "filename": "example.csv",
  "url": "/actions/core/serve-document/doc_5c0e2b7a9d4f4e1b8a6c3d2e1f0a9b8c?teamId=6876e08ad6296a1d681d3c7c"
}

Get average fraud score

Get the average fraud score of your past IP checks, or of one device tracker's fingerprints, for a country, a date range, a conversion status or a custom variable such as a user or a campaign. Use it to compare the quality of traffic sources.

Inputs

Tracker IDtracker_idnumber: A device tracker's number, to average its fingerprints instead of IP checks.At least 1.
Countrycountrytext: Only lookups from this country, e.g. US.
Start datestart_datedate: Only from this day on.
End dateend_datedate: Only up to this day.
Conversion statusconversion_statustext: Only lookups with this conversion status.One of: true (Converted), false (Denied), not_marked (Not marked).
Custom variablesfind_byobject: Only lookups made with these custom variables, such as a userID or campaignID.

Outputs

foundtrue/false: Whether any lookups matched.
fraud_averagenumber: The average fraud score of the matching lookups, 0 to 100. Null when there are none.
oftext: What was averaged: ip_checks, or tracker for one device tracker.
statisticsobject: Any other figures IPQS answered with, such as totals of devices and page views, in its own names.

Example output

{
  "found": true,
  "fraud_average": 23.5,
  "of": "ip_checks",
  "statistics": {}
}

Get bulk validation

Check how far a bulk validation has got, whether it is finished, and which result files it has to download.

Inputs

Bulk validation IDbulk_validation_idnumberRequired: The id Start bulk validation returned.At least 1.

Outputs

abortedtrue/false: Whether processing was cancelled before it finished.
file_nametext: The list's file name.
finishedtrue/false: Whether processing is finished, so the results can be downloaded.
idnumber: The bulk validation's ID. Pass it to Get bulk validation and to Download bulk validation results.
invalid_recordsnumber: How many records in the list were invalid, so far.
list_typetext: What the list holds: email, phone, proxy (IP addresses) or url.
request_idtext: IPQS's ID for this request.
results_availablelist: The result files that can be downloaded: all, clean, bad or pristine. Empty until it is finished.
statustext: Where processing is: NEW, PROCESSING, UNIQUE_RESULTS (removing repeats), FINALIZING or FINISHED.
strictnessnumber: The strictness the list is checked at, 0 to 3; 0 is IPQS's default.

Example output

{
  "aborted": false,
  "file_name": "test.csv",
  "finished": true,
  "id": 827750,
  "invalid_records": 0,
  "list_type": "proxy",
  "request_id": "HE1BDCGjmf",
  "results_available": [
    "all"
  ],
  "status": "FINISHED",
  "strictness": 0
}

Get credit usage

Get the account's available credits and how many this billing period's lookups have used, API by API. Costs no credits; good for a scheduled low-credit alert.

Inputs

None.

Outputs

creditsnumber: The account's available credits for this billing period.
email_usagenumber: Credits used on email address checks.
fingerprint_usagenumber: Credits used on device fingerprints from websites.
mobile_sdk_usagenumber: Credits used on device fingerprints from mobile apps.
phone_usagenumber: Credits used on phone number checks.
proxy_usagenumber: Credits used on IP address checks.
request_idtext: IPQS's ID for this lookup. Pass it to Report fraud to report the lookup as fraudulent, or to Get past lookup to read it again.
url_usagenumber: Credits used on URL scans.
usagenumber: Credits used this billing period, as IPQS totals them. IPQS's own examples count only IP and email checks in it, so add the figures below for every API.

Example output

{
  "credits": 3004522,
  "email_usage": 472,
  "fingerprint_usage": 0,
  "mobile_sdk_usage": 22,
  "phone_usage": 1231,
  "proxy_usage": 6,
  "request_id": "3ift1XN",
  "url_usage": 211,
  "usage": 478
}

Get device fingerprint result

Get a device fingerprint result from the server side, by the request ID your site or app received, or the latest one for a user by custom variables. It is the trusted way to act on a fingerprint, and the only way to see the reasons behind its fraud chance. The fingerprint itself is taken by IPQS's tracker on your site or in your app. Costs no credits.

Inputs

Request IDrequest_idtext: The lookup's request_id, as an earlier step returned it. Leave it empty to find the lookup by its custom variables instead.
Find by custom variablesfind_byobject: Instead of a request ID, the custom variables the lookup was made with, such as userID, to find the latest lookup that has them.
Device sourcedevice_sourcetext: Where the fingerprint was taken, when finding it by custom variables.One of: devicetracker (A website (the JavaScript tracker)), mobiletracker (A mobile app (the mobile SDK)). Default: devicetracker.
Tracker IDtracker_idnumber: The device tracker's number, from IPQS's tracker settings, to search that tracker only.At least 1.

Outputs

active_tortrue/false: Premium: whether it is an active Tor exit.
active_vpntrue/false: Premium: whether the VPN is an active one.
adblocktrue/false: Premium: whether an ad blocker is in use.
bot_statustrue/false: Whether the device is a bot, a spoofed device or otherwise not human.
brandtext: The device's brand.
browsertext: The browser and version.
browser_fingerprinttext: Premium: a hash of the browser and its settings.
canvas_hashtext: A hash of the device's canvas profile.
citytext: The city, when known.
click_datetext: Premium: when this request was made, as IPQS writes it.
connection_typetext: The connection: Residential, Corporate, Education, Mobile or Data Center.
cookiestrue/false: Premium: whether cookies are enabled.
countrytext: Two-letter code of the IP address's country.
cpu_coresnumber: Premium: the number of CPU cores.
device_idtext: The device's ID, a hash of its hardware and settings, for spotting the same device on several accounts.
device_timezonetext: Premium: the time zone the device itself reports.
first_seentext: Premium: when IPQS first saw the device, as IPQS writes it.
fraud_chancenumber: How likely the device is to commit fraud, 0 to 100; 25 is the median. 85 and above is suspicious and 90 and above is the usual point to block.
graphics_cardtext: Premium: the graphics card.
guidtext: A hardware ID that devices with the same hardware can share; see guid_confidence.
guid_confidencenumber: How sure IPQS is that the guid matches other users, 0 to 100.
high_risk_devicetrue/false: Premium: whether the device is very likely fraudulent, such as an emulator, a virtual device or one spoofing its location.
hostnametext: Premium: the device's host name.
iframe_detectedtrue/false: Premium: whether the page was loaded in a frame, a sign of clickjacking.
ip_addresstext: The device's IP address.
is_crawlertrue/false: Whether the device is a confirmed search engine crawler.
isptext: The internet service provider.
languagetext: Premium: the device's language, e.g. en-US.
last_seentext: Premium: when IPQS last saw the device, as IPQS writes it.
latitudenumber: Premium: the latitude, when known.
longitudenumber: Premium: the longitude, when known.
memorynumber: Premium: the memory the device reports, in GB.
mobiletrue/false: Whether it is a mobile device.
modeltext: The device's model.
operating_systemtext: The operating system and version.
organizationtext: Premium: the organization behind the IP.
proxytrue/false: Whether the device is on a proxy, VPN or Tor.
reasonslist: Premium: codes explaining the fraud chance, such as FR_BOT or FR_LOCATION_SPOOF. List device risk reasons describes each.
recent_abusetrue/false: Whether the device has been tied to verified abuse in the past few days.
recent_data_matcheslist: How often IPQS has seen the values sent in this lookup over the last 7 days, one entry per value. Empty when it has none to report.
recent_unique_user_valueslist: For your own tracking variables sent with the lookup (such as a user ID), how many different values of each kind IPQS has seen with them recently. Empty when none were sent.
regiontext: The region or state, when known.
request_idtext: IPQS's ID for this lookup. Pass it to Report fraud to report the lookup as fraudulent, or to Get past lookup to read it again.
ssl_fingerprinttext: Premium: a hash of the TLS ciphers the device supports.
timezonetext: The IP address's time zone, when known.
tortrue/false: Whether the device is on Tor.
true_ostext: Premium: the operating system the device really runs, e.g. Windows.
uniquetrue/false: False when the device ID has been seen on several IP addresses.
user_agenttext: Premium: the device's user agent.
vpntrue/false: Whether the device is on a VPN.
webgl_hashtext: A hash of the device's WebGL profile.

Example output

{
  "active_tor": false,
  "active_vpn": false,
  "adblock": null,
  "bot_status": false,
  "brand": "Apple",
  "browser": "Chrome 128.0",
  "browser_fingerprint": null,
  "canvas_hash": "757a7b7455a2e163c9ca5a8bed646d87017d24a65e3531ef6910b7638d354fc6",
  "city": "Houston",
  "click_date": null,
  "connection_type": "Residential",
  "cookies": null,
  "country": "US",
  "cpu_cores": null,
  "device_id": "97bf540d96b26c3afc612df213ced691510ad714a4563a2201b65442dfa610e5",
  "device_timezone": "America/New_York",
  "first_seen": null,
  "fraud_chance": 71,
  "graphics_card": null,
  "guid": "7c02c9cb41624a34d4b1d0fddaa34198899865464f7d3a9e997486f311860a4e",
  "guid_confidence": 100,
  "high_risk_device": false,
  "hostname": null,
  "iframe_detected": null,
  "ip_address": "8.8.8.8",
  "is_crawler": false,
  "isp": "Mediacom Cable",
  "language": null,
  "last_seen": null,
  "latitude": 43.45,
  "longitude": -283.15,
  "memory": null,
  "mobile": false,
  "model": "iPad",
  "operating_system": "Mac 10.6",
  "organization": "ISP-Provider USA",
  "proxy": false,
  "reasons": [],
  "recent_abuse": false,
  "recent_data_matches": [],
  "recent_unique_user_values": [],
  "region": "Texas",
  "request_id": "0v1Vbz",
  "ssl_fingerprint": "l7koJkPziVVkZThY75b3OXIhT4qpzlcfs696wiQhsdQx1o2Sbqkr9l4t2cdrYpUh",
  "timezone": "America Matamoros",
  "tor": false,
  "true_os": null,
  "unique": false,
  "user_agent": null,
  "vpn": false,
  "webgl_hash": "034c532c2df0b5aedc169801075f56d36d15e872cc36d8b6df9b14bc0bf024ce"
}

Get file scan result

Check on a malware scan that was still pending, by its request ID, and get its verdict once it has one. Costs no credits.

Inputs

Scan request IDrequest_idtextRequired: The request_id Scan file for malware returned.

Outputs

detectedtrue/false: Whether any engine found a virus, ransomware, trojan, spyware or other malware.
detected_scansnumber: How many engines found a threat.
engineslist: Each of IPQS's scanning engines and what it found.
file_hashtext: The file's SHA-256 hash.
file_nametext: The file's name.
file_sizenumber: The file's size in bytes.
file_typetext: The file's type, e.g. application/pdf.
flagged_bylist: The names of the engines that found a threat.
md5text: The file's MD5 hash.
request_idtext: IPQS's ID for the scan. Pass it to Get file scan result to check on a pending scan.
scan_typetext: scan for a full scan, lookup for a check of recent scans.
sha1text: The file's SHA-1 hash.
statustext: The scan's status, as IPQS gives it: completed, cached (a recent scan of the same file) or pending.
total_scansnumber: How many engines scanned the file.
verdicttext: What the scan concluded: malicious (an engine found a threat), clean (engines scanned it and none did), pending (still scanning; ask again with Get file scan result) or unknown (no engine has scanned it, as when a recent-scans lookup finds none).

Example output

{
  "detected": true,
  "detected_scans": 1,
  "engines": [
    {
      "detected": false,
      "error": false,
      "name": "IPQS Threat Defender"
    },
    {
      "detected": true,
      "error": false,
      "name": "IPQS Emerging Threats"
    },
    {
      "detected": false,
      "error": false,
      "name": "IPQS Foreign Entity Checker"
    },
    {
      "detected": false,
      "error": false,
      "name": "IPQS Byte Checks"
    },
    {
      "detected": false,
      "error": false,
      "name": "IPQS Malicous Network Activity"
    },
    {
      "detected": false,
      "error": false,
      "name": "IPQS Internet Security Suite"
    },
    {
      "detected": false,
      "error": false,
      "name": "IPQS Malicious Code Scanner"
    }
  ],
  "file_hash": "e53c379d95e95706c5a2c4d6cd609857368a3bf14f28d7e67f6e3f8dfce6d486",
  "file_name": null,
  "file_size": null,
  "file_type": null,
  "flagged_by": [
    "IPQS Emerging Threats"
  ],
  "md5": null,
  "request_id": "H7snPYbZrb",
  "scan_type": "scan",
  "sha1": null,
  "status": "completed",
  "total_scans": 7,
  "verdict": "malicious"
}

Get fraud flow results

Check how far a user got through a Fraud Flow sent with Send fraud flow, and what each step found: their form answers and the IP, email, phone, device and ID checks.

Inputs

Link request IDlink_request_idtextRequired: The link_request_id Send fraud flow returned.

Outputs

completedtrue/false: Whether the user has completed the flow.
flow_idtext: The flow's ID.
flow_nametext: The flow's name.
link_request_idtext: The link's ID.
sessionslist: Each session started from the link, oldest first.
statetext: Where the user is: NOT_STARTED (the link is not opened yet), IN_PROGRESS, COMPLETED or EXPIRED, for the latest session.

Example output

{
  "completed": true,
  "flow_id": "ABCDE12345",
  "flow_name": "Example Flow",
  "link_request_id": "BCDEF23456",
  "sessions": [
    {
      "results": [
        {
          "details": {},
          "form_data": {
            "field1": "value1",
            "field2": "value2"
          },
          "request_date": "2026-01-01 12:00:00",
          "request_id": "CDEFG34567",
          "request_type": "CUSTOM_FORM",
          "success": true
        },
        {
          "details": {},
          "form_data": {},
          "request_date": "2026-01-01 12:00:00",
          "request_id": "DEFGH45678",
          "request_type": "PROXY_VPN",
          "success": true
        },
        {
          "details": {},
          "form_data": {
            "field3": "value1"
          },
          "request_date": "2026-01-01 12:00:00",
          "request_id": "EFGHI56789",
          "request_type": "CUSTOM_FORM",
          "success": true
        }
      ],
      "state": "COMPLETED"
    }
  ],
  "state": "COMPLETED"
}

Get IP abuse feed

Get the IP addresses IPQS has recently seen in bot attacks, credential stuffing, brute forcing, proxies and other abuse, from its IP Address Abuse Feed, for a time range, to block them at your firewall. The New range gets only what is new since you last asked. The feed is a separate IPQS product: ask IPQS for access.

Inputs

Time rangetime_rangetext: Which entries to get.One of: latest (The newest entry), new (Everything new since this key last asked for new entries), hour (Since the start of the current hour), last24hours (The last 24 hours), today (Today, from midnight UTC), yesterday (Yesterday, midnight to midnight UTC), week (This week, from Sunday midnight UTC), month (This month, from the 1st at midnight UTC), custom (Between two dates). Default: latest.
Start datestart_datedate: For a custom range, its first day.
End dateend_datedate: For a custom range, its last day.
Maximum entrieslimitnumber: The most entries to return, up to 10,000.From 1 to 10000. Default: 1000.

Outputs

countnumber: How many came back.
entrieslist: The abusive IP addresses, up to the maximum asked for.
time_rangetext: The time range asked for.
totalnumber: How many entries the feed had for the range.
truncatedtrue/false: Whether there were more entries than the maximum, so some were left out.

Example output

{
  "count": 2,
  "entries": [
    {
      "abuse_events": [
        {
          "last_seen": "2026-10-02T04:40:34-04:00",
          "name": "Brute Force Attacks"
        },
        {
          "last_seen": "2026-10-01T22:10:02-04:00",
          "name": "VPN Networks"
        }
      ],
      "abuse_velocity": "high",
      "active_tor": false,
      "active_vpn": true,
      "asn": 64500,
      "city": "Ashburn",
      "connection_type": "Data Center",
      "country_code": "US",
      "dynamic_ip": false,
      "fraud_score": 100,
      "frequent_abuser": true,
      "hostname": "host-23.example.net",
      "ip_address": "198.51.100.23",
      "is_bot": true,
      "is_crawler": false,
      "is_proxy": true,
      "is_tor": false,
      "is_vpn": true,
      "isp": "Example Hosting",
      "latitude": 39.04,
      "longitude": -77.49,
      "organization": "Example Hosting",
      "public_access_point": false,
      "recent_abuse": true,
      "region": "Virginia",
      "shared_ip": false,
      "timezone": "America/New_York",
      "zip_code": null
    },
    {
      "abuse_events": [
        {
          "last_seen": "2026-10-02T03:00:00-04:00",
          "name": "Bot Attacks"
        }
      ],
      "abuse_velocity": "medium",
      "active_tor": false,
      "active_vpn": false,
      "asn": null,
      "city": "Berlin",
      "connection_type": "Residential",
      "country_code": "DE",
      "dynamic_ip": true,
      "fraud_score": 88,
      "frequent_abuser": false,
      "hostname": null,
      "ip_address": "203.0.113.77",
      "is_bot": false,
      "is_crawler": false,
      "is_proxy": true,
      "is_tor": false,
      "is_vpn": false,
      "isp": "Example Telecom",
      "latitude": 52.52,
      "longitude": 13.4,
      "organization": null,
      "public_access_point": false,
      "recent_abuse": true,
      "region": "Berlin",
      "shared_ip": false,
      "timezone": "Europe/Berlin",
      "zip_code": "10115"
    }
  ],
  "time_range": "last24hours",
  "total": 2,
  "truncated": false
}

List the logins and login attempts to your IPQS account, with where each came from and its fraud score, to audit access. IPQS enables this API on request: ask its support to turn it on.

Inputs

None.

Outputs

countnumber: How many came back.
loginslist: Each login and login attempt.
request_idtext: IPQS's ID for this lookup. Pass it to Report fraud to report the lookup as fraudulent, or to Get past lookup to read it again.
totalnumber: How many logins IPQS has on record.

Example output

{
  "count": 1,
  "logins": [
    {
      "attempts": 0,
      "browser": "Mozilla/5.0",
      "country_code": "US",
      "deleted": false,
      "email": "user@gmail.com",
      "fraud_score": 7.0,
      "hostname": "syn-096-041-136-092.res.spectrum.com",
      "id": "31656582",
      "ip_address": "192.0.2.55",
      "isp": "Spectrum",
      "logged_in_at": "2025-05-30T04:05:34Z",
      "successful": true,
      "user_id": "123456",
      "validated": true
    }
  ],
  "request_id": "aNjZAE7P8g",
  "total": 1
}

Get past lookup

Get a past IP, email or device fingerprint lookup again, by its request ID, or the latest one made with given custom variables, with everything IPQS answered at the time. Costs no credits.

Inputs

Request IDrequest_idtext: The lookup's request_id, as an earlier step returned it. Leave it empty to find the lookup by its custom variables instead.
Lookup typelookup_typetext: Which lookups to search when finding one by its custom variables.One of: proxy (IP address checks), email (Email address checks), devicetracker (Device fingerprints (website)), mobiletracker (Device fingerprints (mobile app)).
Find by custom variablesfind_byobject: Instead of a request ID, the custom variables the lookup was made with, such as userID, to find the latest lookup that has them.

Outputs

lookupobject: The past lookup, with the fields its API answered with at the time: fraud_score, country_code, ISP and the rest for an IP check, valid and deliverability for an email check, and so on, in IPQS's own names.
request_idtext: The lookup's request ID.

Example output

{
  "lookup": {
    "ASN": 30036,
    "IP": "192.0.2.110",
    "ISP": "Mediacom Cable",
    "abuse_velocity": "medium",
    "active_tor": false,
    "active_vpn": false,
    "bot_status": false,
    "city": "Houston",
    "connection_type": "Residential",
    "country_code": "US",
    "fraud_score": 25,
    "host": "192-0-2-110.client.mchsi.com",
    "is_crawler": false,
    "latitude": 29.7079,
    "longitude": -95.401,
    "mobile": false,
    "organization": "Mediacom Cable",
    "proxy": false,
    "recent_abuse": true,
    "region": "Texas",
    "request_id": "0w8WYS",
    "timezone": "America Matamoros",
    "tor": false,
    "vpn": false,
    "zip_code": "77001"
  },
  "request_id": "0w8WYS"
}

List allowlist

List everything on the account's allowlist.

Inputs

Applies tolookup_typetext: Only the entries for these lookups. Leave empty for all.One of: proxy (IP address checks), email (Email address checks), phone (Phone number checks), url (URL scans), devicetracker (Device fingerprints (website)), mobiletracker (Device fingerprints (mobile app)).

Outputs

countnumber: How many came back.
entrieslist: The entries on the list.
request_idtext: IPQS's ID for this listing.

Example output

{
  "count": 1,
  "entries": [
    {
      "lookup_type": "proxy",
      "reason": null,
      "value": "1.1.1.1",
      "value_type": "ip"
    }
  ],
  "request_id": "CXSSHXFZr5"
}

List blocklist

List everything on the account's blocklist.

Inputs

Applies tolookup_typetext: Only the entries for these lookups. Leave empty for all.One of: proxy (IP address checks), email (Email address checks), phone (Phone number checks), url (URL scans), devicetracker (Device fingerprints (website)), mobiletracker (Device fingerprints (mobile app)).

Outputs

countnumber: How many came back.
entrieslist: The entries on the list.
request_idtext: IPQS's ID for this listing.

Example output

{
  "count": 1,
  "entries": [
    {
      "lookup_type": "proxy",
      "reason": null,
      "value": "1.1.1.1",
      "value_type": "ip"
    }
  ],
  "request_id": "CXSSHXFZr5"
}

List bulk validations

List the account's bulk validations, newest first, 50 a page, with each one's status.

Inputs

List typelist_typetext: Only lists of this kind. Leave empty for all.One of: email (Email addresses), phone (Phone numbers), proxy (IP addresses), url (URLs).
Pagepagenumber: Which page. Page 1 is the newest.At least 1. Default: 1.

Outputs

bulk_validationslist: The bulk validations on this page, newest first.
countnumber: How many came back.
has_moretrue/false: Whether there is a later page.
pagenumber: This page's number.
request_idtext: IPQS's ID for this request.
totalnumber: How many there are in all.
total_pagesnumber: How many pages there are in all.

Example output

{
  "bulk_validations": [
    {
      "aborted": false,
      "file_name": "example_email.csv",
      "finished": false,
      "id": 827748,
      "invalid_records": 0,
      "list_type": "email",
      "status": "NEW",
      "strictness": 0
    }
  ],
  "count": 1,
  "has_more": false,
  "page": 1,
  "request_id": "HDzXqjnJZ9",
  "total": 1,
  "total_pages": 1
}

List countries

List the two-letter country codes IPQS uses, with each country's name, to turn a code from a lookup into a name. Free, and needs no credits.

Inputs

None.

Outputs

countnumber: How many came back.
countrieslist: Every country IPQS knows.

Example output

{
  "count": 5,
  "countries": [
    {
      "code": "US",
      "name": "United States"
    },
    {
      "code": "CA",
      "name": "Canada"
    },
    {
      "code": "GB",
      "name": "United Kingdom"
    },
    {
      "code": "AF",
      "name": "Afghanistan"
    },
    {
      "code": "AX",
      "name": "Aland Islands"
    }
  ]
}

List device risk reasons

List the reason codes a device fingerprint result can carry, such as FR_BOT, with what each means. Free, and needs no credits.

Inputs

None.

Outputs

countnumber: How many came back.
reasonslist: Every reason code and what it means.

Example output

{
  "count": 5,
  "reasons": [
    {
      "code": "FR_RECENT_ABUSE",
      "description": "User has engaged in recent abuse"
    },
    {
      "code": "FR_DEVICE_ABUSE",
      "description": "This device has engaged in recent abuse across the IPQS network"
    },
    {
      "code": "FR_MALICIOUS",
      "description": "Malicious browser settings detected"
    },
    {
      "code": "FR_BROWSER_SETTINGS",
      "description": "Abnormal browser settings detected"
    },
    {
      "code": "FR_SUSPECT_BROWSER",
      "description": "Suspicious browser configuration"
    }
  ]
}

List past lookups

List your past lookups of one kind (IP checks, email or phone checks, URL or file scans, device fingerprints or leak checks) from a date range, newest first, up to 250 a page. Narrow them by IP address, device, fraud score or custom variables, to review a user's history or export results.

Inputs

Lookup typelookup_typetextRequired: Which lookups to list.One of: proxy (IP address checks), email (Email address checks), phone (Phone number checks), url (URL scans), devicetracker (Device fingerprints (website)), mobiletracker (Device fingerprints (mobile app)), malware_scan (File scans), leaked_email (Email leak checks), leaked_username (Username leak checks), leaked_password (Password leak checks).
Start datestart_datedate: Only from this day on. A week ago by default.
End dateend_datedate: Only up to this day.
IP addressip_addresstext: Only lookups of this IP address (IP checks and device fingerprints only).
Device IDdevice_idtext: Only device fingerprints of this device.
Tracker IDtracker_idnumber: The device tracker's number, from IPQS's tracker settings, to search that tracker only.At least 1.
Minimum fraud scoremin_fraud_scorenumber: Only lookups scoring at least this, 0 to 100.From 0 to 100.
Maximum fraud scoremax_fraud_scorenumber: Only lookups scoring at most this, 0 to 100.From 0 to 100.
Custom variablesfind_byobject: Only lookups made with these custom variables, such as a userID.
Pagepagenumber: Which page of lookups. Page 1 is the newest.At least 1. Default: 1.
Lookups per pagelimitnumber: How many lookups a page holds, up to 250.From 1 to 250. Default: 25.

Outputs

countnumber: How many came back.
has_moretrue/false: Whether there is a later page.
lookupslist: The past lookups on this page, each with the fields its API answered with, in IPQS's own names, request_id among them.
pagenumber: This page's number.
per_pagenumber: How many lookups a page holds.
request_idtext: IPQS's ID for this listing.
totalnumber: How many lookups match in all.
total_pagesnumber: How many pages there are in all.

Example output

{
  "count": 1,
  "has_more": false,
  "lookups": [
    {
      "ASN": "15169",
      "ISP": "Google",
      "bot_status": true,
      "city": "Mountain View",
      "country_code": "US",
      "fraud_score": 100,
      "host": "dns.google",
      "is_crawler": false,
      "latitude": 37.41,
      "longitude": -122.08,
      "mobile": false,
      "organization": "Google",
      "proxy": true,
      "recent_abuse": true,
      "region": "California",
      "request_id": "4JAer3sX6rH3Xl",
      "timezone": "America/Chicago",
      "tor": false,
      "transaction_details": [],
      "vpn": true
    }
  ],
  "page": 1,
  "per_page": 25,
  "request_id": "4JAer3sX6rH3bk",
  "total": 1,
  "total_pages": 1
}

List transaction risk reasons

List the reason codes transaction scoring can give, such as TR_SUSPECT_EMAIL, with what each means. Free, and needs no credits.

Inputs

None.

Outputs

countnumber: How many came back.
reasonslist: Every reason code and what it means.

Example output

{
  "count": 5,
  "reasons": [
    {
      "code": "TR_SUSPECT_IP",
      "description": "IP address recently engaged in suspicious behavior."
    },
    {
      "code": "TR_ABUSIVE_IP",
      "description": "IP address is frequently associated with abusive behavior."
    },
    {
      "code": "TR_SKIPPED_IP",
      "description": "IP address was previously associated with suspicious activity."
    },
    {
      "code": "TR_EMAIL_SWAP",
      "description": "User is switching their email address."
    },
    {
      "code": "TR_BILLING_SWAP",
      "description": "User is switching their billing details."
    }
  ]
}

Remove from allowlist

Take a value off the account's allowlist.

Inputs

Applies tolookup_typetextRequired: Which lookups the entry applies to.One of: proxy (IP address checks), email (Email address checks), phone (Phone number checks), url (URL scans), devicetracker (Device fingerprints (website)), mobiletracker (Device fingerprints (mobile app)).
ValuevaluetextRequired: The value: an IP address, a CIDR range like 203.0.113.0/24, an ISP name, a device ID, an email address, a domain or a phone number, to suit what it applies to.
Value typevalue_typetext: What kind of value it is. Leave it empty to work it out: an IP address or range, and for IP checks anything else as an ISP name. Choose it for a device ID.One of: ip (IP address), cidr (IP range (CIDR)), isp (ISP name), deviceid (Device ID), email (Email address), domain, phone (Phone number).

Outputs

lookup_typetext: Which lookups the entry applies to: proxy (IP addresses), email, phone, url, devicetracker or mobiletracker.
messagetext: IPQS's confirmation, in its words.
reasontext: The reason given, when one was.
request_idtext: IPQS's ID for this change.
valuetext: The value, as it was sent.
value_typetext: What kind of value it is: ip, cidr, isp, deviceid, vendorid, email, domain or phone.

Example output

{
  "lookup_type": "proxy",
  "message": "Successfully deleted Allow List entry.",
  "reason": null,
  "request_id": "CXScW08shC",
  "value": "1.1.1.1",
  "value_type": "ip"
}

Remove from blocklist

Take a value off the account's blocklist.

Inputs

Applies tolookup_typetextRequired: Which lookups the entry applies to.One of: proxy (IP address checks), email (Email address checks), phone (Phone number checks), url (URL scans), devicetracker (Device fingerprints (website)), mobiletracker (Device fingerprints (mobile app)).
ValuevaluetextRequired: The value: an IP address, a CIDR range like 203.0.113.0/24, an ISP name, a device ID, an email address, a domain or a phone number, to suit what it applies to.
Value typevalue_typetext: What kind of value it is. Leave it empty to work it out: an IP address or range, and for IP checks anything else as an ISP name. Choose it for a device ID or a mobile app's vendor ID.One of: ip (IP address), cidr (IP range (CIDR)), isp (ISP name), deviceid (Device ID), email (Email address), domain, phone (Phone number), vendorid (Mobile app vendor device ID).

Outputs

lookup_typetext: Which lookups the entry applies to: proxy (IP addresses), email, phone, url, devicetracker or mobiletracker.
messagetext: IPQS's confirmation, in its words.
reasontext: The reason given, when one was.
request_idtext: IPQS's ID for this change.
valuetext: The value, as it was sent.
value_typetext: What kind of value it is: ip, cidr, isp, deviceid, vendorid, email, domain or phone.

Example output

{
  "lookup_type": "email",
  "message": "Successfully deleted Block List entry.",
  "reason": null,
  "request_id": "CXScW08shC",
  "value": "fraud.signup@example.com",
  "value_type": "email"
}

Report fraud

Report an IP address, email address, phone number or past lookup as fraudulent, so IPQS trains your account's scoring on it, such as after a chargeback or a fake sign up. Give one or more; each is reported on its own. Something already reported comes back as already reported, not as an error. Only report data that is very likely abusive.

Inputs

IP addressip_addresstext: An IP address to report.
Email addressemailtext: An email address to report.
Phone numberphone_numbertext: A phone number to report, with Country below.
Countrycountrytext: The phone number's country, as a two-letter code like US. Required with a phone number.
Request IDrequest_idtext: A past lookup's request_id, to report the lookup.

Outputs

already_reported_countnumber: How many it already had.
reported_countnumber: How many reports IPQS took.
reportslist: One report for each value given.

Example output

{
  "already_reported_count": 0,
  "reported_count": 1,
  "reports": [
    {
      "already_reported": false,
      "reported": true,
      "reported_as": "email",
      "request_id": "3ift1wF",
      "value": "fraud.signup@example.com"
    }
  ]
}

Scan file for malware

Scan a file for viruses, ransomware, trojans, spyware and other malware with IPQS's scanning engines, in a live sandbox, and wait for the verdict: malicious, clean, pending or unknown, with each engine's finding. Each scan costs 10 credits. Good for checking email attachments and uploads before anyone opens them.

Inputs

FilefiletextRequired: The file to scan: upload one, pick a file from an earlier step, or give a link to one for IPQS to fetch. Files up to 100 MB.
Recent scans onlyrecent_scans_onlytrue/false: Only look for a scan of the same file in the last 24 hours, for an instant answer, instead of scanning it now. The verdict is unknown when there is none.Default: false.
Wait for the verdictwait_secondsnumber: How many seconds to wait for a full scan's verdict, checking every 15 seconds, up to 600. A full scan usually takes a few minutes. A scan still running when the wait ends comes back pending, with its request ID for Get file scan result.From 0 to 600. Default: 120.

Outputs

detectedtrue/false: Whether any engine found a virus, ransomware, trojan, spyware or other malware.
detected_scansnumber: How many engines found a threat.
engineslist: Each of IPQS's scanning engines and what it found.
file_hashtext: The file's SHA-256 hash.
file_nametext: The file's name.
file_sizenumber: The file's size in bytes.
file_typetext: The file's type, e.g. application/pdf.
flagged_bylist: The names of the engines that found a threat.
md5text: The file's MD5 hash.
request_idtext: IPQS's ID for the scan. Pass it to Get file scan result to check on a pending scan.
scan_typetext: scan for a full scan, lookup for a check of recent scans.
sha1text: The file's SHA-1 hash.
statustext: The scan's status, as IPQS gives it: completed, cached (a recent scan of the same file) or pending.
total_scansnumber: How many engines scanned the file.
verdicttext: What the scan concluded: malicious (an engine found a threat), clean (engines scanned it and none did), pending (still scanning; ask again with Get file scan result) or unknown (no engine has scanned it, as when a recent-scans lookup finds none).

Example output

{
  "detected": true,
  "detected_scans": 1,
  "engines": [
    {
      "detected": false,
      "error": false,
      "name": "IPQS Threat Defender"
    },
    {
      "detected": true,
      "error": false,
      "name": "IPQS Emerging Threats"
    },
    {
      "detected": false,
      "error": false,
      "name": "IPQS Foreign Entity Checker"
    },
    {
      "detected": false,
      "error": false,
      "name": "IPQS Byte Checks"
    },
    {
      "detected": false,
      "error": false,
      "name": "IPQS Malicous Network Activity"
    },
    {
      "detected": false,
      "error": false,
      "name": "IPQS Internet Security Suite"
    },
    {
      "detected": false,
      "error": false,
      "name": "IPQS Malicious Code Scanner"
    }
  ],
  "file_hash": "e53c379d95e95706c5a2c4d6cd609857368a3bf14f28d7e67f6e3f8dfce6d486",
  "file_name": "invoice.pdf",
  "file_size": null,
  "file_type": null,
  "flagged_by": [
    "IPQS Emerging Threats"
  ],
  "md5": null,
  "request_id": "H7snPYbZrb",
  "scan_type": "scan",
  "sha1": null,
  "status": "completed",
  "total_scans": 7,
  "verdict": "malicious"
}

Scan URL

Scan a link or a domain for phishing, malware, spam, parked domains and adult content, with a risk score from 0 to 100, where it redirects to, the site's category, server, domain age and DNS records. IPQS loads the page itself, so nothing is opened from Lodol. A risk score of 100 is confirmed abuse.

Inputs

URLurltextRequired: The link or domain to scan, e.g. https://example.com/login or example.com.
Strictnessstrictnessnumber: How strict the check is, 0 to 2. IPQS recommends starting at 0; stricter checks flag more, honest ones included.From 0 to 2. Default: 0.
Timeouttimeoutnumber: How many seconds to spend loading the page and following its redirects, 1 to 10; 2 by default. IPQS suggests 5 when the answer is not needed at once.From 1 to 10. Default: 2.
Fastfasttrue/false: Use lighter checks for a quicker answer.Default: false.
Custom variablescustom_variablesobject: Your own tracking variables to record with the lookup, such as userID or transactionID, so you can find it again in your history and IPQS can spot patterns per user. Each must first be set up in your IPQS account settings.

Outputs

a_recordslist: The domain's A (address) records.
adulttrue/false: Whether the site hosts dating or adult content.
categorytext: What the site is about, one of over 70 categories such as Video Streaming, Gaming, Advertising, Hacking, Malicious or Phishing. Null when unknown.
content_typetext: The page's MIME type, e.g. text/html; charset=UTF-8. Null when unknown.
country_codetext: Two-letter code of the country the server is in.
dmarc_recordtrue/false: Whether the domain has a proper DMARC record.
dns_validtrue/false: Whether the domain has valid DNS records.
domaintext: The domain of the final address, with any subdomain.
domain_ageobject: When the domain was registered. Its fields are null when unknown.
domain_ranknumber: The site's estimated popularity rank worldwide, 0 when unranked or little visited.
domain_trusttext: How trustworthy the domain is from its history: trusted, positive, neutral, suspicious, malicious or not rated.
final_urltext: Where the address led after every redirect.
hosted_contenttrue/false: Whether the page is on a free hosting service such as Weebly or Blogspot, which abusers favor.
ip_addresstext: The IP address of the site's server.
language_codetext: Two-letter code of the language the page is written in.
malwaretrue/false: Whether the address is tied to malware or viruses.
mx_recordslist: The domain's MX (mail server) records.
ns_recordslist: The domain's NS (name server) records.
page_sizenumber: The size of the page in bytes, 0 when it could not be reached.
page_titletext: The page's title.
parkingtrue/false: Whether the domain is parked with a for sale notice.
phishingtrue/false: Whether the address is tied to phishing.
redirectedtrue/false: Whether the address redirects to another domain in a browser.
request_idtext: IPQS's ID for this lookup. Pass it to Report fraud to report the lookup as fraudulent, or to Get past lookup to read it again.
risk_scorenumber: IPQS's risk score for the address, 0 to 100. 85 and above is high risk, and 100 is confirmed phishing, malware or similar abuse.
risky_tldtrue/false: Whether the domain ends in a top-level domain often used for malware, scams or phishing.
root_domaintext: The domain of the final address without its subdomains.
scanned_urltext: The address that was scanned, before any redirects.
servertext: The server's banner, e.g. nginx/1.16.0. Null when unknown.
short_link_redirecttrue/false: Whether the address uses a link shortener, or its path redirected.
spammingtrue/false: Whether the domain is tied to email spam or abusive email addresses.
spf_recordtrue/false: Whether the domain has a proper SPF record.
status_codenumber: The HTTP status the page answered with: 200 for a working page, 0 when it could not be reached.
suspicioustrue/false: Whether the address is suspected of phishing or other abuse.
technologieslist: Technologies found on the page, such as WordPress, Shopify, Cloudflare or Google Analytics.
unsafetrue/false: Whether the site is suspected to be unsafe: phishing, malware, spam or other abuse. risk_score says how confident IPQS is.

Example output

{
  "a_records": [
    "172.67.151.40",
    "104.21.72.140"
  ],
  "adult": false,
  "category": "Search Engine",
  "content_type": "text/html; charset=UTF-8",
  "country_code": "US",
  "dmarc_record": true,
  "dns_valid": true,
  "domain": "google.com",
  "domain_age": {
    "human": "26 years ago",
    "iso": "1997-09-15T00:00:00-04:00",
    "timestamp": 874296000
  },
  "domain_rank": 1,
  "domain_trust": "trusted",
  "final_url": "http://google.com",
  "hosted_content": false,
  "ip_address": "172.217.7.206",
  "language_code": "EN",
  "malware": false,
  "mx_records": [
    "us-smtp-inbound-1.mimecast.com",
    "aspmx.l.google.com"
  ],
  "ns_records": [
    "finley.ns.cloudflare.com",
    "melinda.ns.cloudflare.com"
  ],
  "page_size": 68553,
  "page_title": "Google",
  "parking": false,
  "phishing": false,
  "redirected": false,
  "request_id": "4ZGSfWu9RDf3oH",
  "risk_score": 0,
  "risky_tld": false,
  "root_domain": "google.com",
  "scanned_url": "http://google.com",
  "server": "nginx",
  "short_link_redirect": false,
  "spamming": false,
  "spf_record": true,
  "status_code": 200,
  "suspicious": false,
  "technologies": [
    "Google Tag Manager",
    "Google Ads",
    "WordPress",
    "Shopify",
    "Cloudflare"
  ],
  "unsafe": false
}

Score transaction

Score how risky a payment, order or new user is from whatever details you have: billing and shipping names, addresses, emails and phones, the card's BIN and last four, the order amount, the username and password. Returns a risk score, a recommended action (approve, review, 3ds or deny), the reasons, and checks of each detail. IPQS scores the transaction beside a check of the customer's IP address, email address or phone number, so give at least one of those (only some plans can do without); every other field is optional, and the more you give the better.

Inputs

IP addressip_addresstext: The customer's IP address. With it IPQS scores the address too, and measures how far it is from the billing and shipping addresses.
Billing first namebilling_first_nametext: The customer's first name, as billed.
Billing last namebilling_last_nametext: The customer's last name, as billed.
Billing companybilling_companytext: The billing company, if any.
Billing emailbilling_emailtext: The customer's email address. Only lightly checked here.
Billing phonebilling_phonetext: The customer's phone number, with its country code, e.g. 18007132618.
Billing address line 1billing_address_1text: The first line of the billing street address.
Billing address line 2billing_address_2text: The second line of the billing street address.
Billing citybilling_citytext: The billing city.
Billing regionbilling_regiontext: The billing state or region, e.g. FL.
Billing postal codebilling_postcodetext: The billing ZIP or postal code.
Billing countrybilling_countrytext: The billing country, as a name or a two-letter code like US.
Shipping first nameshipping_first_nametext: The first name the order ships to.
Shipping last nameshipping_last_nametext: The last name the order ships to.
Shipping companyshipping_companytext: The company the order ships to, if any.
Shipping emailshipping_emailtext: The email address for the shipment.
Shipping phoneshipping_phonetext: The phone number for the shipment, with its country code.
Shipping address line 1shipping_address_1text: The first line of the shipping street address.
Shipping address line 2shipping_address_2text: The second line of the shipping street address.
Shipping cityshipping_citytext: The shipping city.
Shipping regionshipping_regiontext: The shipping state or region, e.g. FL.
Shipping postal codeshipping_postcodetext: The shipping ZIP or postal code.
Shipping countryshipping_countrytext: The shipping country, as a name or a two-letter code like US.
Usernameusernametext: The customer's username on your site.
Passwordpasswordtext: The customer's password, to check against leaked credentials. It is hashed with SHA-256 before it leaves Lodol, and a SHA-256 hash is sent as it is.
Order amountorder_amounttext: The order's total, without a currency symbol, e.g. 49.99.
Order quantityorder_quantitynumber: How many items the order has.At least 0.
Payment methodtransaction_typetext: How the customer is paying.One of: credit_card (Credit or debit card), paypal, stripe, google (Google Pay), apple (Apple Pay), cash_app (Cash App), venmo, zelle, square, shopify, and 14 more.
Card BINcredit_card_bintext: The first 6 or 8 digits of the card number. Never the whole number.
Card last fourcredit_card_last_fourtext: The card number's last 4 digits.
Card expiry monthcredit_card_expiration_monthnumber: The card's expiry month, 1 to 12.From 1 to 12.
Card expiry yearcredit_card_expiration_yearnumber: The card's expiry year, e.g. 2030 or 30.From 0 to 2099.
AVS codeavs_codetext: The one-letter address verification code from the card's bank, or pass or fail.
CVV result codecvv_codetext: The one-letter CVV verification code from the card's bank, or pass or fail. Never the CVV itself.
Account numberaccount_numbertext: A bank account, SEPA or crypto wallet number. Never a card number, which is refused.
Routing numberrouting_numbertext: The bank's routing number.
Recurringrecurringtrue/false: Whether the order rebills automatically.
Times rebilledrecurring_timesnumber: For a recurring order, which billing this is: 1 for the first.At least 1.
Transaction strictnesstransaction_strictnessnumber: How heavily to weigh irregularities in the details, 0 to 2. Only with an IP address.From 0 to 2.
Custom variablescustom_variablesobject: Your own tracking variables to record with the lookup, such as userID or transactionID, so you can find it again in your history and IPQS can spot patterns per user. Each must first be set up in your IPQS account settings.

Outputs

address_email_identity_matchtext: Enterprise feature: whether the billing address and email address belong to the same person: Match, No Match (they could not be paired), Mismatch (they belong to someone else) or Unknown (not checked).
avstext: The address verification (AVS) code the card's bank answered with.
avs_match_foundtrue/false: Whether the AVS code is one that means the address matched: A, B, D, M, P, X or Y.
billing_address_distanceobject: How far the billing address is from where the IP address is. Its fields are null when either is unknown.
billing_phone_carriertext: The billing phone number's carrier, e.g. AT&T.
billing_phone_countrytext: Two-letter code of the billing phone number's country.
billing_phone_country_codenumber: The billing phone number's dialing code, e.g. 1.
billing_phone_line_typetext: The billing phone number's line type, e.g. Wireless, Landline or VOIP.
bin_bank_nametext: The bank or processor that issued the card, from its BIN.
bin_countrytext: The country of the card's issuer, from its BIN.
bin_typetext: The kind of card, from its BIN: Credit, Debit, Prepaid or Virtual. Prepaid and virtual cards carry slightly more risk.
cvvtext: The card verification (CVV) code the card's bank answered with.
cvv_match_foundtrue/false: Whether the CVV code is one that means it matched: A, B, M, P, X or Y.
email_name_identity_matchtext: Enterprise feature: whether the billing email address and the name belong to the same person: Match, No Match (they could not be paired), Mismatch (they belong to someone else) or Unknown (not checked).
fraudulent_behaviortrue/false: Whether the details show high risk patterns and a high chance of fraud.
high_risk_billing_addresstrue/false: Enterprise feature: whether IPQS flags the billing address, such as a drop shipper, a package forwarder or an empty lot.
high_risk_shipping_addresstrue/false: Enterprise feature: whether IPQS flags the shipping address, such as a drop shipper, a package forwarder or an empty lot.
is_prepaid_cardtrue/false: Whether the card is prepaid.
leaked_billing_emailtrue/false: Whether the billing email address was in a recent data breach.
leaked_shipping_emailtrue/false: Whether the shipping email address was in a recent data breach.
leaked_user_datatrue/false: Whether the customer's details, phone and address included, were in a recent data breach.
name_address_identity_matchtext: Enterprise feature: whether the name and the billing address belong to the same person: Match, No Match (they could not be paired), Mismatch (they belong to someone else) or Unknown (not checked).
phone_address_identity_matchtext: Enterprise feature: whether the billing phone number and address belong to the same person: Match, No Match (they could not be paired), Mismatch (they belong to someone else) or Unknown (not checked).
phone_email_identity_matchtext: Enterprise feature: whether the billing phone number and email address belong to the same person: Match, No Match (they could not be paired), Mismatch (they belong to someone else) or Unknown (not checked).
phone_name_identity_matchtext: Enterprise feature: whether the billing phone number and the name belong to the same person: Match, No Match (they could not be paired), Mismatch (they belong to someone else) or Unknown (not checked).
recent_data_matcheslist: How often IPQS has seen the values sent in this lookup over the last 7 days, one entry per value. Empty when it has none to report.
recent_unique_user_valueslist: For your own tracking variables sent with the lookup (such as a user ID), how many different values of each kind IPQS has seen with them recently. Empty when none were sent.
recommended_actiontext: What IPQS recommends doing, from the risk score or your own transaction rules: approve, review, 3ds (ask for 3-D Secure) or deny. By default up to 75 approves, 75 to 85 reviews, 85 to 95 asks for 3-D Secure and above 95 denies.
request_idtext: IPQS's ID for this lookup. Pass it to Report fraud to report the lookup as fraudulent, or to Get past lookup to read it again.
resultsobject: The full checks behind the score, as the dedicated actions return them. A check that was not run has every field null.
risk_factorslist: Why the risk score is raised, in IPQS's words, e.g. Suspicious billing email address reputation.
risk_scorenumber: IPQS's risk score for the transaction or user, 0 to 100. 75 and above is suspicious and 90 and above is high risk. It leans less on the IP address than an IP check's fraud score does.
risky_billing_phonetrue/false: Whether the billing phone number is tied to abuse.
risky_shipping_phonetrue/false: Whether the shipping phone number is tied to abuse.
risky_usernametrue/false: Whether the username is often tied to fraud.
shipping_address_distanceobject: How far the shipping address is from where the IP address is. Its fields are null when either is unknown.
shipping_phone_carriertext: The shipping phone number's carrier.
shipping_phone_countrytext: Two-letter code of the shipping phone number's country.
shipping_phone_country_codenumber: The shipping phone number's dialing code.
shipping_phone_line_typetext: The shipping phone number's line type.
user_activitytext: How often this customer makes legitimate purchases and sign ups: high, medium, low or none. Higher plans only.
user_flagged_billing_addresstrue/false: Enterprise feature: whether the billing address is on your own blocklist.
user_flagged_shipping_addresstrue/false: Enterprise feature: whether the shipping address is on your own blocklist.
valid_billing_addresstrue/false: Whether the billing address is valid and has a good reputation.
valid_billing_emailtrue/false: A light check of the billing email address. Validate email address checks one in depth.
valid_billing_phonetrue/false: Whether the billing phone number is valid and active with its carrier.
valid_shipping_addresstrue/false: Whether the shipping address is valid and has a good reputation.
valid_shipping_emailtrue/false: A light check of the shipping email address.
valid_shipping_phonetrue/false: Whether the shipping phone number is valid and active with its carrier.

Example output

{
  "address_email_identity_match": "Enterprise plan required.",
  "avs": null,
  "avs_match_found": null,
  "billing_address_distance": {
    "kilometers": null,
    "miles": null
  },
  "billing_phone_carrier": null,
  "billing_phone_country": null,
  "billing_phone_country_code": null,
  "billing_phone_line_type": "Unknown",
  "bin_bank_name": null,
  "bin_country": null,
  "bin_type": null,
  "cvv": null,
  "cvv_match_found": null,
  "email_name_identity_match": "Enterprise plan required.",
  "fraudulent_behavior": false,
  "high_risk_billing_address": false,
  "high_risk_shipping_address": null,
  "is_prepaid_card": null,
  "leaked_billing_email": true,
  "leaked_shipping_email": false,
  "leaked_user_data": true,
  "name_address_identity_match": "Enterprise plan required.",
  "phone_address_identity_match": "Enterprise plan required.",
  "phone_email_identity_match": "Enterprise plan required.",
  "phone_name_identity_match": "Enterprise plan required.",
  "recent_data_matches": [],
  "recent_unique_user_values": [],
  "recommended_action": "3ds",
  "request_id": "lIUyaAnYku",
  "results": {
    "billing_email": {
      "a_records": [
        "172.66.147.243",
        "104.20.23.154"
      ],
      "associated_names": {
        "names": [],
        "status": "Enterprise Plus or higher required."
      },
      "associated_phone_numbers": {
        "phone_numbers": [],
        "status": "Enterprise Plus or higher required."
      },
      "catch_all": false,
      "common": false,
      "deliverability": "low",
      "disposable": true,
      "dmarc_record": true,
      "dns_valid": true,
      "domain_age": {
        "human": "31 years ago",
        "iso": "1995-08-14T00:00:00-04:00",
        "timestamp": 808372800
      },
      "domain_trust": "Upgraded plan required.",
      "domain_velocity": "Enterprise Mini or higher required.",
      "email": "user@example.com",
      "first_name": "Corporate",
      "first_seen": {
        "human": "10 years ago",
        "iso": "2017-01-01T01:01:01-05:00",
        "timestamp": 1483250461
      },
      "fraud_score": 100,
      "frequent_complainer": true,
      "generic": true,
      "honeypot": true,
      "identity_data": null,
      "leaked": true,
      "mx_records": [],
      "overall_score": 0,
      "recent_abuse": true,
      "recent_data_matches": [],
      "recent_unique_user_values": [],
      "request_id": "lIUyaAnYku",
      "result_type": "live",
      "risky_tld": false,
      "sanitized_email": "user@example.com",
      "smtp_score": 0,
      "spam_trap_score": "high",
      "spf_record": true,
      "suggested_domain": null,
      "suspect": false,
      "timed_out": false,
      "user_activity": "Enterprise L4+ required.",
      "valid": false
    },
    "billing_phone": {
      "accurate_country_code": null,
      "active": null,
      "active_status": null,
      "associated_email_addresses": {
        "emails": [],
        "status": null
      },
      "carrier": null,
      "city": null,
      "country": null,
      "dialing_code": null,
      "do_not_call": null,
      "formatted": null,
      "fraud_score": null,
      "identity_data": null,
      "leaked": null,
      "line_type": null,
      "local_format": null,
      "mcc": null,
      "mnc": null,
      "name": null,
      "number_recycling": {
        "last_ported_date": null,
        "message": null,
        "ported": null,
        "recently_recycled": null
      },
      "phone_number": null,
      "prepaid": null,
      "recent_abuse": null,
      "recent_data_matches": [],
      "recent_unique_user_values": [],
      "region": null,
      "request_id": null,
      "risky": null,
      "sms_domain": null,
      "sms_email": null,
      "sms_pumping": {
        "message": null,
        "risk_score": null,
        "velocity": null
      },
      "spammer": null,
      "tcpa_blacklist": null,
      "timezone": null,
      "user_activity": null,
      "valid": null,
      "voip": null,
      "zip_code": null
    },
    "ip_address": {
      "abuse_events": [],
      "abuse_velocity": null,
      "active_tor": null,
      "active_vpn": null,
      "asn": null,
      "bot_status": null,
      "browser": null,
      "city": null,
      "connection_type": null,
      "country_code": null,
      "device_brand": null,
      "device_model": null,
      "dynamic_connection": null,
      "fraud_score": null,
      "frequent_abuser": null,
      "high_risk_attacks": null,
      "host": null,
      "ip_address": null,
      "is_crawler": null,
      "isp": null,
      "latitude": null,
      "longitude": null,
      "mobile": null,
      "operating_system": null,
      "organization": null,
      "proxy": null,
      "recent_abuse": null,
      "recent_data_matches": [],
      "recent_unique_user_values": [],
      "region": null,
      "request_id": null,
      "security_scanner": null,
      "shared_connection": null,
      "timezone": null,
      "tor": null,
      "trusted_network": null,
      "vpn": null,
      "zip_code": null
    },
    "shipping_email": {
      "a_records": [],
      "associated_names": {
        "names": [],
        "status": null
      },
      "associated_phone_numbers": {
        "phone_numbers": [],
        "status": null
      },
      "catch_all": null,
      "common": null,
      "deliverability": null,
      "disposable": null,
      "dmarc_record": null,
      "dns_valid": null,
      "domain_age": {
        "human": null,
        "iso": null,
        "timestamp": null
      },
      "domain_trust": null,
      "domain_velocity": null,
      "email": null,
      "first_name": null,
      "first_seen": {
        "human": null,
        "iso": null,
        "timestamp": null
      },
      "fraud_score": null,
      "frequent_complainer": null,
      "generic": null,
      "honeypot": null,
      "identity_data": null,
      "leaked": null,
      "mx_records": [],
      "overall_score": null,
      "recent_abuse": null,
      "recent_data_matches": [],
      "recent_unique_user_values": [],
      "request_id": null,
      "result_type": null,
      "risky_tld": null,
      "sanitized_email": null,
      "smtp_score": null,
      "spam_trap_score": null,
      "spf_record": null,
      "suggested_domain": null,
      "suspect": null,
      "timed_out": null,
      "user_activity": null,
      "valid": null
    },
    "shipping_phone": {
      "accurate_country_code": null,
      "active": null,
      "active_status": null,
      "associated_email_addresses": {
        "emails": [],
        "status": null
      },
      "carrier": null,
      "city": null,
      "country": null,
      "dialing_code": null,
      "do_not_call": null,
      "formatted": null,
      "fraud_score": null,
      "identity_data": null,
      "leaked": null,
      "line_type": null,
      "local_format": null,
      "mcc": null,
      "mnc": null,
      "name": null,
      "number_recycling": {
        "last_ported_date": null,
        "message": null,
        "ported": null,
        "recently_recycled": null
      },
      "phone_number": null,
      "prepaid": null,
      "recent_abuse": null,
      "recent_data_matches": [],
      "recent_unique_user_values": [],
      "region": null,
      "request_id": null,
      "risky": null,
      "sms_domain": null,
      "sms_email": null,
      "sms_pumping": {
        "message": null,
        "risk_score": null,
        "velocity": null
      },
      "spammer": null,
      "tcpa_blacklist": null,
      "timezone": null,
      "user_activity": null,
      "valid": null,
      "voip": null,
      "zip_code": null
    }
  },
  "risk_factors": [],
  "risk_score": 95,
  "risky_billing_phone": null,
  "risky_shipping_phone": null,
  "risky_username": null,
  "shipping_address_distance": {
    "kilometers": null,
    "miles": null
  },
  "shipping_phone_carrier": null,
  "shipping_phone_country": null,
  "shipping_phone_country_code": null,
  "shipping_phone_line_type": "Unknown",
  "user_activity": null,
  "user_flagged_billing_address": false,
  "user_flagged_shipping_address": null,
  "valid_billing_address": true,
  "valid_billing_email": false,
  "valid_billing_phone": false,
  "valid_shipping_address": null,
  "valid_shipping_email": false,
  "valid_shipping_phone": false
}

Send fraud flow

Start one of your IPQS Fraud Flows for a user: a link to a hosted verification (their email, phone, IP, device or ID), returned for you to send, or emailed or texted by IPQS. Build the flow first in IPQS's Fraud Flows editor, then follow it with Get fraud flow results.

Inputs

Flow IDflow_idtextRequired: The flow's ID, from IPQS's Fraud Flows page.
Deliverydeliverytext: How the user gets the link.One of: link (Just return the link), email (Email the link), text (Text the link). Default: link.
Email addressemailtext: Where to email the link, when emailing it.
Phone numberphone_numbertext: Where to text the link, when texting it.
Messagemessagetext: A message shown before the link, instead of the flow's own.
Start the session nowstart_sessiontrue/false: Start the user's session at once rather than when they open the link.Default: false.
Link lifetimelink_lifetimenumber: How many seconds the link works for. It never expires by default.From 1 to 31536000.
Session lifetimesession_lifetimenumber: How many seconds the user has to come back to a started session; 600 by default.From 1 to 31536000.
Link querylink_querytext: Text to add to the end of the link as its query, e.g. ref=signup&user=1234.

Outputs

deliverytext: How the link was handed over: link, email or text.
flow_idtext: The flow that was started.
linktext: The verification link for the user, e.g. https://verify.is/... It is also emailed or texted when that was chosen.
link_request_idtext: The link's ID. Pass it to Get fraud flow results.

Example output

{
  "delivery": "link",
  "flow_id": "ABCDE12345",
  "link": "https://verify.is/ABCDE12345/BCDEF23456",
  "link_request_id": "BCDEF23456"
}

Start bulk validation

Send a whole list of email addresses, phone numbers, IP addresses or URLs for IPQS to check in bulk: as values from an earlier step, or as a CSV file. IPQS processes it in the background; check on it with Get bulk validation, then use Download bulk validation results.

Inputs

List typelist_typetextRequired: What the list holds.One of: email (Email addresses), phone (Phone numbers), proxy (IP addresses), url (URLs).
Valuesvalueslist: The values to check: a list from an earlier step, or one on each line. Leave empty to send a file instead.
CSV filefiletext: Instead of values, a CSV file of them: upload one, pick one from an earlier step, or give a link to one.
Namefile_nametext: A name for the list in IPQS, e.g. signups.csv.

Outputs

abortedtrue/false: Whether processing was cancelled before it finished.
file_nametext: The list's file name.
finishedtrue/false: Whether processing is finished, so the results can be downloaded.
idnumber: The bulk validation's ID. Pass it to Get bulk validation and to Download bulk validation results.
invalid_recordsnumber: How many records in the list were invalid, so far.
list_typetext: What the list holds: email, phone, proxy (IP addresses) or url.
request_idtext: IPQS's ID for this request.
statustext: Where processing is: NEW, PROCESSING, UNIQUE_RESULTS (removing repeats), FINALIZING or FINISHED.
strictnessnumber: The strictness the list is checked at, 0 to 3; 0 is IPQS's default.

Example output

{
  "aborted": null,
  "file_name": "sample_emails.csv",
  "finished": false,
  "id": 827746,
  "invalid_records": 0,
  "list_type": "email",
  "request_id": "HDOgXxgMHJ",
  "status": "NEW",
  "strictness": 0
}

Update past lookup

Update a past IP, email or device fingerprint lookup: mark it converted or not (say, when a sign up turns into a paying customer) with the date, or correct its click date, user agent, language or custom variables, so IPQS can learn and rescore. Find it by request ID or by custom variables. Costs no credits.

Inputs

Request IDrequest_idtext: The lookup's request_id, as an earlier step returned it. Leave it empty to find the lookup by its custom variables instead.
Lookup typelookup_typetext: Which lookups to search when finding one by its custom variables.One of: proxy (IP address checks), email (Email address checks), devicetracker (Device fingerprints (website)), mobiletracker (Device fingerprints (mobile app)).
Find by custom variablesfind_byobject: Instead of a request ID, the custom variables the lookup was made with, such as userID, to find the latest lookup that has them.
Conversion statusconversion_statustext: Whether the lookup led to a conversion.One of: converted, not_converted (Not converted).
Conversion dateconversion_datedate and time: When it converted, in UTC.
Click dateclick_datedate and time: When the device was first seen, in UTC.
User agentuser_agenttext: The browser user agent to record instead.
Languagelanguagetext: The browser language to record instead, e.g. en-US.
Set custom variablesset_variablesobject: Custom variables to set on the lookup, such as a new transactionID.

Outputs

lookupobject: The past lookup as IPQS answered after the update, in its own names. Empty when it answered with no record.
request_idtext: The request ID IPQS answered with.
updatedtrue/false: True once IPQS accepted the update.
updatesobject: What was changed, by IPQS's name for each field, e.g. ConversionStatus: true.

Example output

{
  "lookup": {
    "ASN": 30036,
    "IP": "192.0.2.110",
    "ISP": "Mediacom Cable",
    "abuse_velocity": "medium",
    "active_tor": false,
    "active_vpn": false,
    "bot_status": false,
    "city": "Houston",
    "connection_type": "Residential",
    "country_code": "US",
    "fraud_score": 25,
    "host": "192-0-2-110.client.mchsi.com",
    "is_crawler": false,
    "latitude": 29.7079,
    "longitude": -95.401,
    "mobile": false,
    "organization": "Mediacom Cable",
    "proxy": false,
    "recent_abuse": true,
    "region": "Texas",
    "request_id": "0w8WYS",
    "timezone": "America Matamoros",
    "tor": false,
    "vpn": false,
    "zip_code": "77001"
  },
  "request_id": "0w8WYS",
  "updated": true,
  "updates": {
    "ConversionDate": "2026-09-30 14:05:00",
    "ConversionStatus": "true"
  }
}

Validate email address

Check whether an email address is real and safe to accept: whether it is valid and deliverable, disposable, a spam trap or honeypot, a catch-all, recently abusive or leaked, with a fraud score, its domain's age and trust, and a suggested domain for typos like gmai.com. Use it to clean a mailing list or screen sign ups.

Inputs

Email addressemailtextRequired: The email address to check, e.g. someone@example.com.
Timeouttimeoutnumber: How many seconds to wait for the mail server, 1 to 60; 7 by default. IPQS suggests 20 when the answer is not needed at once: a check that times out is less reliable.From 1 to 60. Default: 7.
Fastfasttrue/false: Skip asking the mail server, for a much quicker answer. The syntax, DNS, disposable and risk checks still run.Default: false.
Suggest a domainsuggest_domaintrue/false: Always check whether the domain is a typo of a popular mail service, such as gmai.com for gmail.com. Otherwise IPQS only checks invalid or abusive addresses.Default: false.
Spam trap strictnessstrictnessnumber: How readily to flag spam traps and honeypots, 0 to 2. 0 flags only those IPQS is very sure of; 2 catches the most.From 0 to 2. Default: 0.
Abuse strictnessabuse_strictnessnumber: How readily to mark the address as recently abusive, 0 to 2. IPQS suggests 1 or 2 for screening sign ups against determined fraudsters.From 0 to 2. Default: 0.
Custom variablescustom_variablesobject: Your own tracking variables to record with the lookup, such as userID or transactionID, so you can find it again in your history and IPQS can spot patterns per user. Each must first be set up in your IPQS account settings.

Outputs

a_recordslist: The domain's A (address) records.
associated_namesobject: First and last names linked to the address. Upgraded plans only.
associated_phone_numbersobject: Phone numbers linked to the address. Upgraded plans only.
catch_alltrue/false: Whether the domain's mail server accepts every address, so this one cannot be confirmed.
commontrue/false: Whether the address is at a common free provider, such as gmail.com, yahoo.com or hotmail.com.
deliverabilitytext: How likely mail is to reach the inbox: high, medium or low.
disposabletrue/false: Whether the address belongs to a temporary or disposable mail service, as fraudsters and scammers often use.
dmarc_recordtrue/false: Whether the domain has a proper DMARC record.
dns_validtrue/false: Whether the domain has valid DNS records.
domain_ageobject: When the domain was registered. Its fields are null when unknown.
domain_trusttext: How trustworthy the domain is from its history: trusted, positive, neutral, suspicious, malicious or not rated.
domain_velocitytext: How many legitimate users the domain has: high, medium, low or none. Upgraded plans only.
emailtext: The email address that was checked.
first_nametext: The first name the address suggests. CORPORATE for a company address, UNKNOWN when there is none.
first_seenobject: When IPQS first saw the address, an estimate of how old it is. Its fields are null when unknown.
fraud_scorenumber: IPQS's fraud score for the address, 0 to 100, from its reputation and recent behavior. 75 and above is suspicious, 80 and above is suspicious for user scoring, and 90 and above is risky.
frequent_complainertrue/false: Whether the address often unsubscribes or reports mail as spam.
generictrue/false: Whether the address is a shared one for a domain, such as admin@, sales@ or contact@.
honeypottrue/false: Whether the address is believed to be a honeypot or spam trap. Bulk mail sent to one risks getting a sender blocked.
identity_dataobject: An Enterprise add-on: identity details from authoritative sources such as credit bureaus and telecoms, one entry per person, with names, addresses, email addresses, phone numbers and age, exactly as IPQS sends them. Null when the account does not have the add-on.
leakedtrue/false: Whether the address was in a recent data breach, which puts its accounts at risk of takeover.
mx_recordslist: The domain's MX (mail server) records.
overall_scorenumber: Overall validity, 0 to 4: 0 invalid, 1 the mail server cannot be reached, 2 a temporary rejection, 3 the server accepts all mail, 4 the address is verified. Above 1 can be a valid address.
recent_abusetrue/false: Whether IPQS has verified abuse from the address in the past few days: a chargeback, fake sign up, compromised device and the like.
recent_data_matcheslist: How often IPQS has seen the values sent in this lookup over the last 7 days, one entry per value. Empty when it has none to report.
recent_unique_user_valueslist: For your own tracking variables sent with the lookup (such as a user ID), how many different values of each kind IPQS has seen with them recently. Empty when none were sent.
request_idtext: IPQS's ID for this lookup. Pass it to Report fraud to report the lookup as fraudulent, or to Get past lookup to read it again.
result_typetext: How the result was produced: live (a full check now), cached (from recent checks) or fast (a quicker, less accurate check).
risky_tldtrue/false: Whether the domain ends in a top-level domain often used for malware, scams or phishing.
sanitized_emailtext: The address with aliases and masking removed, such as the extra dots in a Gmail address.
smtp_scorenumber: How the mail server answered, -1 to 3: -1 invalid address, 0 the server rejects all mail, 1 a temporary error, 2 the server accepts all mail, 3 the server confirmed the address.
spam_trap_scoretext: How confident IPQS is that the address is an active spam trap: high, medium, low or none. Scrub high (and, to be stricter, medium) from promotional mailings.
spf_recordtrue/false: Whether the domain has a proper SPF record.
suggested_domaintext: The domain the address was probably meant to have, when it looks like a typo of a popular mail service (gmai.com for gmail.com). Null when there is no suggestion.
suspecttrue/false: Whether the mail server gave a temporary error or a broken handshake, so valid may not be reliable. Also true for catch-all domains.
timed_outtrue/false: Whether checking with the mail server timed out. A timed-out lookup that says the address is not valid should not be trusted; raise the timeout and try again.
user_activitytext: How often the address is used for legitimate purchases and sign ups: high, medium, low or none. High and medium are strong signs of a real user. Higher plans only.
validtrue/false: Whether the address appears valid. For a mailing list, keep addresses that are valid, not disposable and whose spam_trap_score is not high.

Example output

{
  "a_records": [
    "192.0.2.110"
  ],
  "associated_names": {
    "names": [],
    "status": "Enterprise Plus or higher required."
  },
  "associated_phone_numbers": {
    "phone_numbers": [],
    "status": "Enterprise Plus or higher required."
  },
  "catch_all": false,
  "common": true,
  "deliverability": "high",
  "disposable": false,
  "dmarc_record": true,
  "dns_valid": true,
  "domain_age": {
    "human": "3 months ago",
    "iso": "2019-09-09T16:40:34-04:00",
    "timestamp": 1568061634
  },
  "domain_trust": "trusted",
  "domain_velocity": "high",
  "email": "noreply@ipqualityscore.com",
  "first_name": "Unknown",
  "first_seen": {
    "human": "3 months ago",
    "iso": "2019-09-09T16:40:34-04:00",
    "timestamp": 1568061634
  },
  "fraud_score": 25,
  "frequent_complainer": false,
  "generic": false,
  "honeypot": false,
  "identity_data": null,
  "leaked": false,
  "mx_records": [
    "us-smtp-inbound-1.mimecast.com",
    "aspmx.l.google.com"
  ],
  "overall_score": 4,
  "recent_abuse": false,
  "recent_data_matches": [],
  "recent_unique_user_values": [],
  "request_id": "4JAer3sX6rF3PO",
  "result_type": "live",
  "risky_tld": false,
  "sanitized_email": "validated@example.com",
  "smtp_score": 3,
  "spam_trap_score": "none",
  "spf_record": true,
  "suggested_domain": null,
  "suspect": false,
  "timed_out": false,
  "user_activity": "medium",
  "valid": true
}

Validate phone number

Check whether a phone number is real and safe to accept: whether it is valid and active, its line type (mobile, landline, VOIP, toll free), carrier and location, whether it is prepaid, risky, a spammer or recently abusive, with a fraud score. An invalid number comes back with valid false, not an error.

Inputs

Phone numberphone_numbertextRequired: The phone number to check. Spaces, dashes and brackets are fine. With fewer than 10 digits it needs its country code after a +, or its country under Countries.
Countriescountrieslist: The countries the number is likely from, as two-letter codes like US, GB or DE. IPQS prefers them when reading the number, and needs one for a short number without a country code.
Strictnessstrictnessnumber: How strict the check is, 0 to 2. IPQS recommends starting at 0; stricter checks flag more, honest ones included.From 0 to 2. Default: 0.
Custom variablescustom_variablesobject: Your own tracking variables to record with the lookup, such as userID or transactionID, so you can find it again in your history and IPQS can spot patterns per user. Each must first be set up in your IPQS account settings.

Outputs

accurate_country_codetrue/false: Whether the number's dialing code matches one of the countries given with the lookup.
activetrue/false: Whether the number is live and reachable. An add-on IPQS enables on request; null without it.
active_statustext: The line's status, with enhanced line checks enabled: Active Line (with a High, Medium or Low Confidence when IPQS can tell), Disconnected Line, Phone Turned Off or Inconclusive Status. Null when unknown.
associated_email_addressesobject: Email addresses linked to the number. Upgraded plans only.
carriertext: The carrier the number is assigned to, when known.
citytext: The number's city, when known.
countrytext: Two-letter code of the number's country, e.g. US.
dialing_codenumber: The country dialing code, 1 to 4 digits, e.g. 1. Null when unknown.
do_not_calltrue/false: Whether the number is on a Do Not Call list. United States and Canada only; null when the feature is not enabled.
formattedtext: The number in international format, e.g. +18007132618.
fraud_scorenumber: IPQS's fraud score for the number, 0 to 100. 75 and above is suspicious, 85 and above is risky, and 90 and above has already been used for abuse.
identity_dataobject: An Enterprise add-on: identity details from authoritative sources such as credit bureaus and telecoms, one entry per person, with names, addresses, email addresses, phone numbers and age, exactly as IPQS sends them. Null when the account does not have the add-on.
leakedtrue/false: Whether the number was recently exposed in a data breach.
line_typetext: The kind of line: Wireless, Landline, Toll-Free, VOIP, Satellite, Premium Rate or Pager. Null when unknown.
local_formattext: The number as it is written in its own country, e.g. (800) 713-2618.
mcctext: The mobile country code, typically 3 digits. Null for landlines, toll free numbers and when unknown.
mnctext: The mobile network code of the carrier, typically 3 digits. Null for landlines, toll free numbers and when unknown.
nametext: The name of the number's owner, a person or a business, when known. Several are separated by commas.
number_recyclingobject: An add-on: whether the number recently changed owners or carriers. Its fields are null without it.
phone_numbertext: The phone number that was checked, as sent.
prepaidtrue/false: Whether the number is on a prepaid plan.
recent_abusetrue/false: Whether the number has been tied to recent or ongoing fraud.
recent_data_matcheslist: How often IPQS has seen the values sent in this lookup over the last 7 days, one entry per value. Empty when it has none to report.
recent_unique_user_valueslist: For your own tracking variables sent with the lookup (such as a user ID), how many different values of each kind IPQS has seen with them recently. Empty when none were sent.
regiontext: The number's region or state, when known.
request_idtext: IPQS's ID for this lookup. Pass it to Report fraud to report the lookup as fraudulent, or to Get past lookup to read it again.
riskytrue/false: Whether the number is tied to fraud, scams, robocalls, fake accounts or other unfriendly behavior.
sms_domaintext: The carrier's domain for sending email to the phone as text, e.g. tmomail.net, when it has one.
sms_emailtext: The carrier's email address for texting the phone, e.g. 5555551234@tmomail.net, when it has one.
sms_pumpingobject: An add-on: how likely the number is to be used for SMS pumping fraud. Its fields are null without it.
spammertrue/false: Whether the number has recently been reported for spam or harassing calls or texts.
tcpa_blacklisttrue/false: Whether the number belongs to, or is tied to, someone who often files TCPA lawsuits. An add-on; null without it.
timezonetext: The number's time zone, when known.
user_activitytext: How often the number is used for legitimate purchases and sign ups: high, medium, low or none. Higher plans only.
validtrue/false: Whether the number is properly formatted and assigned to a carrier in its country.
voiptrue/false: Whether the number is a VOIP (internet) or other digital number.
zip_codetext: The number's postal code, when known.

Example output

{
  "accurate_country_code": true,
  "active": true,
  "active_status": "Active Line - High Confidence",
  "associated_email_addresses": {
    "emails": [
      "hello@ipqualityscore.com"
    ],
    "status": "Associated emails found."
  },
  "carrier": "Verizon Wireless",
  "city": "Las Vegas",
  "country": "US",
  "dialing_code": 1,
  "do_not_call": false,
  "formatted": "+18007132618",
  "fraud_score": 44,
  "identity_data": null,
  "leaked": false,
  "line_type": "Toll Free",
  "local_format": "(800) 713-2618",
  "mcc": null,
  "mnc": null,
  "name": "IPQualityScore",
  "number_recycling": {
    "last_ported_date": null,
    "message": null,
    "ported": null,
    "recently_recycled": null
  },
  "phone_number": "+18007132618",
  "prepaid": false,
  "recent_abuse": false,
  "recent_data_matches": [],
  "recent_unique_user_values": [],
  "region": "Nevada",
  "request_id": "4ZGSfWu9RDf3oH",
  "risky": true,
  "sms_domain": null,
  "sms_email": null,
  "sms_pumping": {
    "message": "Low risk of SMS pumping attack.",
    "risk_score": 0,
    "velocity": "low"
  },
  "spammer": false,
  "tcpa_blacklist": false,
  "timezone": "America/Los_Angeles",
  "user_activity": "high",
  "valid": true,
  "voip": false,
  "zip_code": "89132"
}

ActionsCopy Anchor Link

Add to allowlistCopy Anchor Link

Inputs

Outputs

Add to blocklistCopy Anchor Link

Inputs

Outputs

Check for leaked dataCopy Anchor Link

Inputs

Outputs

Check IP addressCopy Anchor Link

Inputs

Outputs

Download bulk validation resultsCopy Anchor Link

Inputs

Outputs

Get average fraud scoreCopy Anchor Link

Inputs

Outputs

Get bulk validationCopy Anchor Link

Inputs

Outputs

Get credit usageCopy Anchor Link

Inputs

Outputs

Get device fingerprint resultCopy Anchor Link

Inputs

Outputs

Get file scan resultCopy Anchor Link

Inputs

Outputs

Get fraud flow resultsCopy Anchor Link

Inputs

Outputs

Get IP abuse feedCopy Anchor Link

Inputs

Outputs

Get login historyCopy Anchor Link

Inputs

Outputs

Get past lookupCopy Anchor Link

Inputs

Outputs

List allowlistCopy Anchor Link

Inputs

Outputs

List blocklistCopy Anchor Link

Inputs

Outputs

List bulk validationsCopy Anchor Link

Inputs

Outputs

List countriesCopy Anchor Link

Inputs

Outputs

List device risk reasonsCopy Anchor Link

Inputs

Outputs

List past lookupsCopy Anchor Link

Inputs

Outputs

List transaction risk reasonsCopy Anchor Link

Inputs

Outputs

Remove from allowlistCopy Anchor Link

Inputs

Outputs

Remove from blocklistCopy Anchor Link

Inputs

Outputs

Report fraudCopy Anchor Link

Inputs

Outputs

Scan file for malwareCopy Anchor Link

Inputs

Outputs

Scan URLCopy Anchor Link

Inputs

Outputs

Actions

Add to allowlist

Add to blocklist

Check for leaked data

Check IP address

Download bulk validation results

Get average fraud score

Get bulk validation

Get credit usage

Get device fingerprint result

Get file scan result

Get fraud flow results

Get IP abuse feed

Get login history

Get past lookup

List allowlist

List blocklist

List bulk validations

List countries

List device risk reasons

List past lookups

List transaction risk reasons

Remove from allowlist

Remove from blocklist

Report fraud

Scan file for malware

Scan URL

Score transaction

Send fraud flow

Start bulk validation

Update past lookup

Validate email address

Validate phone number