Bot Detection API
IP bot detection: is this address a known bot or crawler?
Tell verified bots from everything else by IP: search engine and AI crawlers, uptime monitors and scanners publish the ranges they crawl from, and this check matches any IPv4 or IPv6 address against them — naming the operator — together with our datacenter, proxy, VPN and Tor flags. It is IP-level detection from data we hold, not behavioural or browser-fingerprint bot management.
IP Bot Detection From Published Ranges
Operators that want to be recognised publish the address ranges their crawlers use. This API matches an IP against those ranges and names the operator. It is not behavioural or browser-fingerprint bot management: it answers what an address is, not what a session does.
Known bot or not, with the operator
Google, Bing, OpenAI, Apple, Ahrefs, uptime monitors and security scanners publish their crawler ranges. An address inside one of them is a known bot, and bot_name says whose. An address outside all of them is "not a known bot" — which is not the same as a human.
Refreshed with our intelligence data
The bot providers list is part of the same data set as the proxy, VPN, Tor, datacenter and threat flags, rebuilt every half hour and checked locally. A lookup is instant and never queries a third party.
The other flags next to it
A self-declared crawler from a datacenter range and a residential address on a threat feed are different problems. The same response carries is_datacenter, is_proxy, is_vpn and is_tor_node, so one lookup supports the whole decision.
Bot Detection API
Bot detection is part of the IP lookup response: suspicious_factors.is_crawler says whether the address belongs to a bot network that publishes its ranges and suspicious_factors.bot_name names the operator, next to the datacenter, proxy, VPN and Tor flags. No extra call, no extra charge.
GET /api/v1/ip/{ip}?api_key={key}
# Bot detection is part of the IP lookup: suspicious_factors.is_crawler + bot_name
curl "https://ip-api.io/api/v1/ip/66.249.66.1?api_key=YOUR_API_KEY"
{
"ip": "66.249.66.1",
"isp": "Google LLC",
"asn": "AS15169",
"suspicious_factors": {
"is_proxy": false,
"is_tor_node": false,
"is_spam": false,
"is_crawler": true,
"bot_name": "google",
"is_datacenter": true,
"is_vpn": false,
"is_threat": false,
"is_bogon": false
},
"location": {
"country": "United States",
"country_code": "US",
"city": null,
"latitude": 37.751,
"longitude": -97.822,
"zip": null,
"timezone": "America/Chicago",
"local_time": "2026-11-04T07:12:44-06:00",
"local_time_unix": 1793797964,
"is_daylight_savings": false
}
}
GET /api/v1/ip/{ip}?api_key={key}
async function knownBot(ip) {
const res = await fetch(
`https://ip-api.io/api/v1/ip/${ip}?api_key=YOUR_API_KEY`
);
const f = (await res.json()).suspicious_factors;
return f.is_crawler ? f.bot_name : null; // "google"
}
{
"ip": "66.249.66.1",
"isp": "Google LLC",
"asn": "AS15169",
"suspicious_factors": {
"is_proxy": false,
"is_tor_node": false,
"is_spam": false,
"is_crawler": true,
"bot_name": "google",
"is_datacenter": true,
"is_vpn": false,
"is_threat": false,
"is_bogon": false
},
"location": {
"country": "United States",
"country_code": "US",
"city": null,
"latitude": 37.751,
"longitude": -97.822,
"zip": null,
"timezone": "America/Chicago",
"local_time": "2026-11-04T07:12:44-06:00",
"local_time_unix": 1793797964,
"is_daylight_savings": false
}
}
GET /api/v1/ip/{ip}?api_key={key}
import requests
res = requests.get(
"https://ip-api.io/api/v1/ip/66.249.66.1",
params={"api_key": "YOUR_API_KEY"}
)
f = res.json()["suspicious_factors"]
print(f["is_crawler"], f["bot_name"]) # True google
{
"ip": "66.249.66.1",
"isp": "Google LLC",
"asn": "AS15169",
"suspicious_factors": {
"is_proxy": false,
"is_tor_node": false,
"is_spam": false,
"is_crawler": true,
"bot_name": "google",
"is_datacenter": true,
"is_vpn": false,
"is_threat": false,
"is_bogon": false
},
"location": {
"country": "United States",
"country_code": "US",
"city": null,
"latitude": 37.751,
"longitude": -97.822,
"zip": null,
"timezone": "America/Chicago",
"local_time": "2026-11-04T07:12:44-06:00",
"local_time_unix": 1793797964,
"is_daylight_savings": false
}
}
GET /api/v1/ip/{ip}?api_key={key}
$f = json_decode(file_get_contents(
"https://ip-api.io/api/v1/ip/66.249.66.1?api_key=YOUR_API_KEY"
))->suspicious_factors;
echo $f->is_crawler ? "known bot: " . $f->bot_name : "not a known bot";
{
"ip": "66.249.66.1",
"isp": "Google LLC",
"asn": "AS15169",
"suspicious_factors": {
"is_proxy": false,
"is_tor_node": false,
"is_spam": false,
"is_crawler": true,
"bot_name": "google",
"is_datacenter": true,
"is_vpn": false,
"is_threat": false,
"is_bogon": false
},
"location": {
"country": "United States",
"country_code": "US",
"city": null,
"latitude": 37.751,
"longitude": -97.822,
"zip": null,
"timezone": "America/Chicago",
"local_time": "2026-11-04T07:12:44-06:00",
"local_time_unix": 1793797964,
"is_daylight_savings": false
}
}
Where IP Bot Detection Earns Its Keep
Cheap, deterministic and explainable: one lookup per request, and the answer says why.
Let verified crawlers through
Rate limits, CAPTCHAs and fraud rules should never fire on Googlebot, Bingbot or GPTBot. Check the IP first: a known bot with its operator name is allowed on the operator's terms, and a request that claims to be Googlebot from an unknown address is a spoof.
Slow down unknown automation
An address that is not a known bot, sits in a datacenter and hits endpoints no browser would is automation that did not announce itself. Rate-limit or challenge it; keep the humans and the verified crawlers fast.
Clean analytics and logs
Tag crawler traffic by operator in your analytics and server logs so dashboards show visitors, not fetchers, and so a crawl spike is attributed to Google or an SEO tool rather than mistaken for an attack.
Bot Detection API — FAQs
What is a bot detection API?
A bot detection API tells you whether an IP address belongs to a known bot or crawler network — search engines, AI crawlers, uptime and security scanners, link-preview fetchers — by matching it against the address ranges those operators publish. ip-api.io answers that with the is_crawler flag and the operator's name in bot_name, both inside the lookup's suspicious_factors, next to the datacenter, proxy, VPN and Tor flags.
How does IP bot detection work here?
Operators that want to be recognised publish their crawler ranges (Google, Bing, OpenAI, Apple, Ahrefs and many more) or sign their reverse DNS. ip-api.io collects those published ranges in its bot providers list and refreshes them with the rest of its intelligence data, so a check is an instant local lookup. An address outside every published range is "not a known bot" — which is not the same as "a human".
Is this the same as bot management?
No. Bot management products (Akamai, Cloudflare, DataDome, PerimeterX and others) watch browser sessions — fingerprints, mouse movements, JavaScript challenges — to decide whether a visitor is automated. This API answers a narrower, cheaper question from the IP alone: is this address a bot network that publishes itself? Use it to allow verified crawlers, to rate-limit unknown datacenter traffic, and to keep analytics clean; use session-level tools for the rest.
Which bots and crawlers are detected?
Every operator in our bot providers list: search engine crawlers, AI and LLM crawlers, SEO and monitoring crawlers, social and messaging link fetchers, and security scanners that publish their ranges. The list grows with the intelligence data; bot_name tells you which operator matched.
Can I use it to verify Googlebot?
Yes. Googlebot's addresses are published by Google and are in the list, so a request claiming to be Googlebot from an address that is not a known bot is a spoof. The same works for Bingbot, GPTBot and the other operators that publish their ranges.
Is there a free bot checker and an API?
The checker on this page is free with no sign-up. The API is GET /api/v1/ip/{ip}: suspicious_factors.is_crawler and suspicious_factors.bot_name are part of the IP lookup response, so bot detection costs nothing extra on top of a lookup you already make.
Simple, transparent pricing
Start small, scale as you grow. No hidden fees.
Tell verified bots from the rest, by IP
One lookup returns whether an address belongs to a bot network that publishes its ranges, which operator it is, and whether it sits in a datacenter — so verified crawlers pass and unknown automation gets a second look.