CheckIP.sh provides a free IP gelocation and reputation API for software developers.

It uses a database of IP addresses that are associated to cities along with other relevant information like time zone, latitude and longitude and it check IP address repution in hourly updated collection of blacklists.


You're allowed up to 1,500 queries per hour for free. Once this limit is reached, all of your requests will result in HTTP 403, forbidden, until your quota is cleared.

Check your current IP address :

curl https://api.checkip.sh
{
  "success": true,
  "ip": "91.163.131.241",
  "ip_long": 1537442771,
  "subnet": "91.163.131.192/26",
  "country_iso": "FR",
  "country_name": "France",
  "subdivision_iso": "80",
  "subdivision_name": "Somme",
  "city": "Fort-Mahon-Plage",
  "postal_code": "80120",
  "latitude": 50.3396,
  "longitude": 1.5598,
  "reputation": "good"
}

Possibles error codes :

curl https://api.checkip.sh
Unroutable IP address  :
{
  "success":"false",
  "error":"The address 127.0.0.1 is not in the database."
}

Incorrect IPv4 format :
{
  "success":"false",
  "error":"Not a valid IP address"
}

Over quota :
< HTTP/1.1 403 FORBIDDEN
< Status: 403 quota exceeded

Check any IP address :

curl https://api.checkip.sh/82.64.89.252
{
"success": true,
"ip": "82.64.89.252",
"ip_long": 1379949052,
"subnet": "82.64.89.128/25",
"country_iso": "FR",
"country_name": "France",
"subdivision_iso": "78",
"subdivision_name": "Yvelines",
"city": "Adainville",
"postal_code": "78113",
"latitude": 48.7261,
"longitude": 1.6519,
"reputation": "good"
}

About IP address reputation :

Valid for all requests : 
Reputation possible answers :
{ "good", "bad" }

Blacklists possible category :
{
"category": "abuse",
"category": "anonymizers",
"category": "attack",
"category": "malware",
"category": "organizations",
"category": "reputation",
"category": "spam",
"category": "geolocation",
"category": "unroutable",
}

Example with a bad reputation IP address (tor-exit node) :

curl https://api.checkip.sh/176.10.99.200
{
"success": true,
"ip": "176.10.99.200",
"ip_long": 2953470920,
"subnet": "176.10.99.128/25",
"country_iso": "CH",
"country_name": "Switzerland",
"latitude": 47.1449,
"longitude": 8.1551,
"reputation": "bad",
"blacklist_categories": [
  "attacks",
  "abuse",
  "reputation",
  "anonymizers"
],
"blacklist_hits": [
  {
  "feed_name": "bds_atif",
  "category": "reputation",
  "maintainer": "Binary Defense Systems",
  "maintainer_url": "https://www.binarydefense.com/",
  "current_status": "present"
  },
  {
  "feed_name": "blocklist_net_ua",
  "category": "abuse",
  "maintainer": "blocklist.net.ua",
  "maintainer_url": "https://blocklist.net.ua",
  "current_status": "present"
  },
  {
  "feed_name": "bm_tor",
  "category": "anonymizers",
  "maintainer": "torstatus.blutmagie.de",
  "maintainer_url": "https://torstatus.blutmagie.de/",
  "current_status": "present"
  },
  {
  "feed_name": "cleantalk",
  "category": "abuse",
  "maintainer": "CleanTalk",
  "maintainer_url": "https://cleantalk.org/",
  "current_status": "present"
  },
  {
  "feed_name": "cleantalk_updated",
  "category": "abuse",
  "maintainer": "CleanTalk",
  "maintainer_url": "https://cleantalk.org/",
  "current_status": "absent"
  },
  {
  "feed_name": "cruzit_web_attacks",
  "category": "attacks",
  "maintainer": "CruzIt.com",
  "maintainer_url": "http://www.cruzit.com/wbl.php",
  "current_status": "present"
  },
  {
  "feed_name": "dm_tor",
  "category": "anonymizers",
  "maintainer": "dan.me.uk",
  "maintainer_url": "https://www.dan.me.uk/",
  "current_status": "present"
  },
  {
  "feed_name": "et_tor",
  "category": "anonymizers",
  "maintainer": "Emerging Threats",
  "maintainer_url": "http://www.emergingthreats.net/",
  "current_status": "present"
  },
  {
  "feed_name": "greensnow",
  "category": "attacks",
  "maintainer": "GreenSnow.co",
  "maintainer_url": "https://greensnow.co/",
  "current_status": "present"
  },
  {
  "feed_name": "maxmind_proxy_fraud",
  "category": "anonymizers",
  "maintainer": "MaxMind.com",
  "maintainer_url": "https://www.maxmind.com/en/high-risk-ip-sample-list",
  "current_status": "present"
  },
  {
  "feed_name": "snort_ipfilter",
  "category": "attacks",
  "maintainer": "Snort.org Labs",
  "maintainer_url": "https://labs.snort.org/",
  "current_status": "present"
  },
  {
  "feed_name": "stopforumspam",
  "category": "abuse",
  "maintainer": "StopForumSpam.com",
  "maintainer_url": "http://www.stopforumspam.com/",
  "current_status": "present"
  },
  {
  "feed_name": "talosintel_ipfilter",
  "category": "attacks",
  "maintainer": "TalosIntel.com",
  "maintainer_url": "http://talosintel.com/",
  "current_status": "present"
  },
  {
  "feed_name": "tor_exits",
  "category": "anonymizers",
  "maintainer": "TorProject.org",
  "maintainer_url": "https://www.torproject.org/",
  "current_status": "present"
    }
  ]
}