Prerequisites
- Python 3.8+ with
ip-api-ioinstalled - A free ip-api.io API key
Read suspicious_factors on any lookup
No dedicated call needed — the flags ride along with a normal lookup.
import os
from ipapi_io import IpApiClient
client = IpApiClient(api_key=os.environ["IP_API_IO_KEY"])
info = client.lookup("185.220.101.1")
f = info["suspicious_factors"]
print(f["is_vpn"]) # VPN service
print(f["is_proxy"]) # open / anonymizing proxy
print(f["is_tor_node"]) # Tor node
print(f["is_datacenter"]) # hosting / datacenter IP (often a bot)
print(f["is_spam"]) # known spam source
print(f["is_crawler"]) # known crawler / bot
print(f["is_threat"]) # listed on a threat feed
if f["is_vpn"] or f["is_proxy"] or f["is_tor_node"]:
pass # require step-up verification (CAPTCHA, 2FA) Confirm a Tor exit node with tor_check
A dedicated check against the live Tor node list, with a count of matching nodes.
tor = client.tor_check("185.220.101.1")
print(tor["is_tor"]) # True
print(tor["tor_node_count"]) # number of matching Tor nodes risk_score.