Strengthen security decisions with IP geolocation, proxy and VPN detection, network intelligence, and WHOIS domain data that help teams to identify suspicious activity and investigate online threats.
Security teams combine IP location and network signals with WHOIS domain information to add context to logins, payments, account activity, and investigations. Geographic anomalies, proxy indicators, network ownership, domain age, and registration details can all contribute to stronger fraud screening and threat analysis.
See how security teams use IP and domain intelligence to identify risky activity and protect online services.
Compare login locations and network characteristics with expected user behavior to flag unusual access attempts.
Identify privacy networks, public proxies, data centers, and Tor-related traffic before applying additional verification or access rules.
Use IP risk indicators and geographic context as additional signals when evaluating transactions and account activity.
Detect known crawler, scanner, spammer, and botnet-related network signals to support automated traffic controls.
Review domain age, registrar and ownership-related WHOIS details when investigating suspicious links, phishing, or brand abuse.
Apply country, region, or network-based rules to sensitive services where geographic access policies are appropriate.
Add proxy status and fraud scoring signals to login, signup, and transaction rules.
Understand the type of intermediary network and available threat classification.
Detect VPN and Tor usage so higher-risk requests can receive appropriate controls.
Add WHOIS registration context when reviewing suspicious or newly observed domains.
Explore how security workflows can combine geolocation, proxy intelligence, network context, and domain registration data.
IP geolocation data assists in fraud prevention through the analysis of geographic locations and behavioral patterns in online transactions. It detects anomalies, such as high-risk IP addresses and proxy usage, verifies user locations, and facilitates geolocation-based controls to enhance security. Leveraging IP geolocation data minimizes fraud and strengthens defenses against unauthorized transactions and identity theft.
{
"ip": "8.8.8.8",
"country_code": "US",
"country_name": "United States of America",
"region_name": "California",
...
"is_proxy":false,
"proxy":{
"last_seen": 1,
"proxy_type": "DCH",
"threat": "-",
"provider": "-",
...
}WHOIS data is crucial for cybersecurity. It provides domain ownership details which can be used to validate legitimacy, detect malicious activities, trace cyberattacks, and assess domain reputation. Organizations can leverage this data to monitor brand misuse, detect threats at an early stage, respond to incidents, and enhance their cybersecurity posture.
{
"domain": "locaproxy.com",
"domain_id": "1710914405_DOMAIN_COM-VRSN",
"status": "clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited",
"create_date": "2012-04-03T07:34:32Z",
"update_date": "2025-01-23T03:00:38Z",
"expire_date": "2027-04-03T07:34:32Z",
"domain_age": "5248",
"whois_server": "whois.godaddy.com",
...
}IP geolocation data and WHOIS data can be used together to enhance network security. By understanding where traffic is coming from and who owns the domains it's associated with, organizations can better detect and respond to potential threats. This can help prevent unauthorized access, protect sensitive data, and maintain the integrity of the network.
{
"ip":"8.8.8.8",
"country_code": "US",
"country_name": "United States of America",
...
}
{
"domain": "locaproxy.com",
"domain_id": "1710914405_DOMAIN_COM-VRSN",
"status": "clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited",
...
}Use network, geolocation, proxy, threat, and WHOIS fields as inputs to your security rules and investigation workflows.
| Field | Security Use |
|---|---|
| ip | IP address. |
| country_code | Two-character country code based on ISO 3166. |
| country_name | Country name based on ISO 3166. |
| region_name | Region or state name. |
| is_proxy | A indicator that tells you whether the IP address belongs to a known proxy, VPN, Tor exit node, or other types of masking services. |
| proxy.last_seen | Proxy last seen in days. |
| proxy.proxy_type | Type of proxy. (VPN) Virtual Private Networks (TOR) Tor Exit Nodes (DCH) Hosting Providers, Data Centers or Content Delivery Networks (PUB) Public Proxies (WEB) Web Proxies (SES) Search Engine Robots (AIC) AI Crawler (RES) Residential Proxies (CPN) Consumer Privacy Networks (EPN) Enterprise Private Networks |
| proxy.threat | Security threat reported. (SPAM) Email and forum spammers (SCANNER) Network security scanners (BOTNET) Malware infected devices (BOGON) Unassigned or illegitimate IP addresses announced via BGP. |
| proxy.provider | Name of VPN provider if available. |
| domain | Domain name. |
| domain_id | Domain name ID. |
| status | Domain name status. |
| create_date | Domain name creation date. |
| update_date | Domain name updated date. |
| expire_date | Domain name expiration date. |
| domain_age | Domain name age in day(s). |
| whois_server | WHOIS server name. |
IP geolocation is not GPS. It estimates the location associated with an IP network and should not be interpreted as a person's exact physical location. Legitimate users may use VPNs, corporate gateways, mobile networks, or hosting infrastructure, and domain registration data may be privacy-protected.
{
"ip": "8.8.8.8",
"country_code": "US",
"country_name": "United States of America",
"region_name": "California",
"district": "Santa Clara County",
"city_name": "Mountain View",
"latitude": 37.38605,
"longitude": -122.08385,
"zip_code": "94043",
"time_zone": "-07:00",
"asn": "15169",
"as": "Google LLC",
"as_info": {
"as_number": "15169",
"as_name": "Google LLC",
"as_domain": "google.com",
"as_usage_type": "DCH",
"as_cidr": "8.8.8.0/24"
},
"isp": "Google LLC",
"domain": "google.com",
"net_speed": "T1",
"idd_code": "1",
"area_code": "650",
"weather_station_code": "USCA0746",
"weather_station_name": "Mountain View",
"mcc": "-",
"mnc": "-",
"mobile_brand": "-",
"elevation": 32,
"usage_type": "DCH",
"address_type": "Anycast",
"ads_category": "622",
"ads_category_name": "Web Hosting",
"continent": {
"name": "North America",
"code": "NA",
"hemisphere": [
"north",
"west"
],
"translation": {
"lang": "en",
"value": "North America"
}
},
"country": {
"name": "United States of America",
"alpha3_code": "USA",
"numeric_code": 840,
"demonym": "Americans",
"flag": "https://cdn.ip2location.io/assets/img/flags/us.png",
"capital": "Washington, D.C.",
"total_area": 9826675,
"population": 339665118,
"currency": {
"code": "USD",
"name": "United States Dollar",
"symbol": "$"
},
"language": {
"code": "EN",
"name": "English"
},
"tld": "us",
"translation": {
"lang": "en",
"value": "United States of America"
}
},
"region": {
"name": "California",
"code": "US-CA",
"translation": {
"lang": "en",
"value": "California"
}
},
"city": {
"name": "Mountain View",
"translation": {
"lang": "en",
"value": "Mountain View"
}
},
"time_zone_info": {
"olson": "America/Los_Angeles",
"current_time": "2026-08-16T21:59:30-07:00",
"gmt_offset": -25200,
"is_dst": true,
"abbreviation": "PST",
"dst_start_date": "2026-03-08",
"dst_end_date": "2026-11-01",
"sunrise": "06:26",
"sunset": "20:01"
},
"geotargeting": {
"metro": "807"
},
"is_proxy": false,
"fraud_score": 0,
"proxy": {
"last_seen": 1,
"proxy_type": "DCH",
"threat": "-",
"provider": "-",
"is_vpn": false,
"is_tor": false,
"is_data_center": true,
"is_public_proxy": false,
"is_web_proxy": false,
"is_web_crawler": false,
"is_ai_crawler": false,
"is_residential_proxy": false,
"is_consumer_privacy_network": false,
"is_enterprise_private_network": false,
"is_spammer": false,
"is_scanner": false,
"is_botnet": false,
"is_bogon": false
}
}
{
"domain": "locaproxy.com",
"domain_id": "1710914405_DOMAIN_COM-VRSN",
"status": "clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited",
"create_date": "2012-04-03T07:34:32Z",
"update_date": "2025-01-23T03:00:38Z",
"expire_date": "2027-04-03T07:34:32Z",
"domain_age": "5248",
"whois_server": "whois.godaddy.com",
"registrar": {
"iana_id": "146",
"name": "GoDaddy.com, LLC",
"url": "http://www.godaddy.com"
},
"registrant": {
"name": "",
"organization": "",
"street_address": "",
"city": "",
"region": "",
"zip_code": "",
"country": "",
"phone": "",
"fax": "",
"email": ""
},
"admin": {
"name": "",
"organization": "",
"street_address": "",
"city": "",
"region": "",
"zip_code": "",
"country": "",
"phone": "",
"fax": "",
"email": ""
},
"tech": {
"name": "",
"organization": "",
"street_address": "",
"city": "",
"region": "",
"zip_code": "",
"country": "",
"phone": "",
"fax": "",
"email": ""
},
"billing": {
"name": "",
"organization": "",
"street_address": "",
"city": "",
"region": "",
"zip_code": "",
"country": "",
"phone": "",
"fax": "",
"email": ""
},
"nameservers": [
"vera.ns.cloudflare.com",
"walt.ns.cloudflare.com"
]
}Dive deeper into proxy detection, network ownership, fraud signals, and domain intelligence used in security decision-making.
Learn how IP intelligence, proxy detection, fraud signals,and WHOIS data can support security and fraud prevention.
Add IP geolocation, proxy detection, network context, and WHOIS data to your security and fraud workflows.