Product Updates Updates

Introducing VPN detection

2022-04-16T21:10:45.783Z

We’re excited to announce VPN detection as a new feature. This is available to everybody!

Until now we were detecting abusers, attackers, bogons, cloud providers (datacenters), public proxies, relays, and also tor exit nodes. Starting today, we are adding VPN IP addresses detection to the list. Our VPN dataset contains several millions of IP addresses updated daily.

The new field is named is_vpn and appears under the security object of API responses we return.

As always, we'd love to hear your thoughts on this new feature as well as what you'd like us to build next! Leave us a reaction or feedback below.

New `is_relay` security field

2021-12-21T22:47:54.700Z

We’ve added a new security.is_relay field to responses we return when you look up an IP address (as always, official client libraries have also been updated).

The purpose of this new field is to identify IP addresses that are used by a relay node. Unlike VPNs, relay nodes are location-aware. Instead of bypassing geo-controls, a relay node pools multiple users behind the same IP address.

Using relay nodes is a manner to protect the identity and privacy of users behind individual IPs. Currently, we identify relay IP addresses from Apple Private Relay (APR).

When the new field is_relay returns true as value, then you know the request comes from devices making use of a relay node.

With the end of the year that’s also the time for us to thank you for an amazing 2021. See you in January, and have a wonderful holiday season!

Introducing Company Data

2021-10-28T11:55:00Z

We’re continuously working on improving our datasets. Innovation is also an important part. Today, we are introducing company data to provide customers with data on the company behind their IP traffic.

API endpoints returning data about an IP address are now including a new field named company. This field shares 3 pieces of information: the company’s name, domain name, and what type of company it is.

Official client libraries have been updated to support the new field. We suggest upgrading to the latest version if you are using one of these libraries.

Interested in accessing this new dataset as CSV for on-promise deployment? [email protected]" rel="noopener nofollow" target="_blank">drop us a line.

Changes about the Connection Type field

2021-07-27T11:14:58.661Z

Starting August 3, 2021, we will introduce the value of government for the connection.type field.

Due to confusion and low interest with the cdn type classification from the connection field, the value cdn has been merged with hosting. This means you will see the value hosting for entries with connection.type field that had value cdn in the past.

Official client libraries have been updated. We suggest upgrading to the latest version as soon as possible, especially with the Java library since old versions were not supporting new connection type values (this is fixed and parsing is now more robust with the latest version).

Change regarding API field `security.is_threat`

2020-11-30T08:00:00.001Z

The Ipregistry API includes in its responses the field security.is_threat. This field contains as value a boolean that is true if one field of the following fields evaluate to true:

security.is_abuser
security.is_attacker
security.is_cloud_provider.

After February 1, 2021 the Ipregistry API will set the value associated with security.is_threat to true if the field security.is_abuser or the field security.is_attacker evaluates to true. In other words, the field security.is_cloud_provider will no longer be taken into consideration.

In the case you rely on this field and you want to keep the behavior unchanged after the date above, we suggest updating your code right now as follows:

security.is_threat OR security.is_cloud_provider

The United Kingdom left the European Union

2020-01-31T23:00:00.001Z

The United Kingdom left the European Union on 31 January 2020, at midnight. This change is reflected in the Ipregistry API and data sets.

The field in_eu is returning true for the remaining 27 state members: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Italy, Ireland, Latvia, Lithuania, Luxembourg, Malta, the Netherlands, Poland, Portugal, Romania, Spain, Slovakia, Slovenia and Sweden.

IP lookups are now returning the routing prefix

2020-01-15T05:12:00.001Z

Following recent requests, it was expressed a need to get the routing prefix associated with an IP address. This data is now included under the field connection.route for all API calls that return IP data. The value uses the CIDR notation.

Here is an example for an IPv4 address:

{
"ip" : "54.85.132.205",
"connection" : {
"asn" : 14618,
"domain" : "amazon.com",
"organization" : "Amazon Technologies Inc.",
"route" : "54.84.0.0/15",
"type" : "hosting"
}
}

and another sample with an IPv6 address:

{
"ip" : "2a01:e35:2f22:e3d0::1",
"connection" : {
"asn" : 12322,
"domain" : "free.fr",
"organization" : "Free SAS",
"route" : "2a01:e35:2000::/36",
"type" : "isp"
}
}

Other than this new data, we have improved our correlation algorithms and are proud to announce that IP geolocation accuracy has been improved for more than 30% of the entries we manage.

New field value CDN for connection type

2020-01-02T15:02:00.001Z

Happy New Year! We wish you the best for 2020. Last year was incredible and we are looking forward to continue innovating in the IP and cyber-security domains with you.

It was not possible to start this year without announcing something new! Starting Today, the API is now distinguishing IP addresses used by CDN (Content Delivery Network) from those used by a hosting provider. In other words, the connection.type field can now have values business, education, hosting, isp and cdn.

Following this change, the field security.is_cloud_provider is returning true if the connection usage type is cdn or hosting.

Here is an output excerpt from a Cloudflare IP address:

{
"connection" : {
"asn" : 13335,
"domain" : "cloudflare.com",
"organization" : "CloudFlare Inc.",
"type" : "cdn"
},
"security" : {
"is_cloud_provider" : true
}
}

New currency data 💱

2019-10-30T10:08:00.001Z

The API has been updated to include 2 new fields in the currency section: name_native and plural_native.

The existing fields name and plural are returning, respectively, the currency name and plural name in US locale. The new fields return value in native locale based on detected location and primary language.

Here is an example for an IP address located in Tokyo:

"currency" : {
"code" : "JPY",
"name" : "Japanese Yen",
"name_native" : "日本円",
"plural" : "Japanese yen",
"plural_native" : "円",
...
}

Official client libraries have been updated to reflect the changes.

More Data Points!

2019-08-08T12:00:00.001Z

It was awaited by most of you. We’ve deployed a big update that brings new data points. Thanks to the hard work we made these last weeks to correlate and analyze data, we are proud to announce new data fields!

The API is returning a new carrier field that includes the carrier name, mcc and mnc as values. When non-null, it means the IP address is used for mobile carrier traffic with high probability.

New data includes also a connection.type field. It enables IP usage classification among business, education, hosting and isp. We provide this information with no extra fees! Besides, the connection field contains a new domain subfield that associates the organization name with a top level domain when available.

Last but not least, the security data includes a is_cloud_provider field. You can use it to identify IP addresses used for hosting purposes (e.g. a node on Google Cloud Platform, Amazon EC2, and more) and thus detect potential attacks.

You can read more in our documentation:
https://ipregistry.co/docs/fields#content

As always, your feedback is welcome!