Network Intelligence Platform

Network
Intelligence API

Gather network information, such as IP geolocation or disposable email detection, to strengthen fraud and threat prevention systems, analyze detailed networking data, and improve SecOps for businesses.

  • IP geolocation & ASN data
  • VPN, proxy, Tor & relay detection
  • Disposable email verification
  • MAC address vendor lookup
  • VPN
  • Proxy
  • Tor
  • Relay
216.73.216.158 IP Address
Columbus City
Ohio Region
United States Country
Amazon.com, Inc. Organization

Sample result — enter an email address above to run your own check.

Email Address
Deliverable
  • Deliverable
  • Disposable
  • Privacy
  • Role-Based
  • Catch-All
  • Valid MX
Outlook Provider
github.com Domain

Sample result — enter a MAC address above to run your own lookup.

3C:22:FB:11:22:33 MAC Address
Registered
Apple, Inc. Vendor
MA-L Type
3C:22:FB OUI
16,777,216 Block Size
3C:22:FB:00:00:00 Block Start Address
3C:22:FB:FF:FF:FF Block End Address
1 Infinite Loop Cupertino CA 95014, US Address
{
  "ip": "216.73.216.158",
  "security": {
    "vpn": true,
    "proxy": false,
    "tor": false,
    "relay": false,
    "crawler": false
  },
  "location": {
    "city": "Columbus",
    "region": "Ohio",
    "country": "United States",
    "continent": "North America",
    "region_code": "OH",
    "country_code": "US",
    "continent_code": "NA",
    "postal": "43215",
    "latitude": 39.96043,
    "longitude": -82.99842,
    "timezone": "America/New_York",
    "eu": false
  },
  "network": {
    "asn": 16509,
    "name": "Amazon.com, Inc.",
    "route": "216.73.216.0/22"
  }
}
Why Nodedata

Network Intelligence API Benefits

One API to power security, fraud prevention, compliance, and research workflows.

Enhance Network Security

Analyze network traffic and prevent potential security threats and malicious activities. Help security teams identify and respond to threats in real-time.

Prevent Fraud

Detect and prevent fraudulent activities — fake accounts, suspicious transactions, and login attempts originating from unexpected locations.

Improve Compliance

Comply with regional regulations by identifying visitors from countries with specific legal requirements, data protection laws, or content licensing agreements.

Simplify Cybersecurity Research

Researchers can identify emerging threats, while law enforcement agencies can leverage our services to help identify cybercriminals in the digital world.

Get started in minutes

From request to response in one call

Authenticate, send a single GET request with an IP, email, or MAC address, and act on a structured JSON response — no SDK required.

  1. 1

    Create your API key

    Sign up and get your API key from the dashboard. Pass it as a key query parameter on every request — no SDK or OAuth flow required.

  2. 2

    Query an endpoint

    Send a GET request to /v1/{value} with an IP, email, or MAC address and get a structured JSON response back in a single round trip.

  3. 3

    Act on the response

    Read the security flags, location, and network data to score signups, gate logins, or enrich your SIEM.

curl "https://api.nodedata.io/v1/216.24.210.18?hostname=false&cloudflare&key=$API_KEY"
const url =
  "https://api.nodedata.io/v1/216.24.210.18" +
  "?cloudflare&key=<API_TOKEN>";
const res = await fetch(url);
const data = await res.json();
console.log(data.security.vpn); // true
import requests

r = requests.get(
    "https://api.nodedata.io/v1/216.24.210.18",
    params={"cloudflare": "", "key": "<API_TOKEN>"},
)
print(r.json()["security"]["vpn"])  # True
res, _ := http.Get(
    "https://api.nodedata.io/v1/216.24.210.18" +
        "?cloudflare&key=<API_TOKEN>")
defer res.Body.Close()

var data struct {
    Security struct{ VPN bool } `json:"security"`
}
json.NewDecoder(res.Body).Decode(&data)
fmt.Println(data.Security.VPN) // true
$url = "https://api.nodedata.io/v1/216.24.210.18"
     . "?cloudflare&key=<API_TOKEN>";

$data = json_decode(file_get_contents($url), true);
var_dump($data["security"]["vpn"]); // bool(true)
require "json"
require "net/http"

url = URI("https://api.nodedata.io/v1/216.24.210.18" \
          "?cloudflare&key=<API_TOKEN>")

data = JSON.parse(Net::HTTP.get(url))
puts data["security"]["vpn"] # true
var url = "https://api.nodedata.io/v1/216.24.210.18"
        + "?cloudflare&key=<API_TOKEN>";

var req = HttpRequest.newBuilder(URI.create(url)).build();
var res = HttpClient.newHttpClient()
    .send(req, BodyHandlers.ofString());

System.out.println(res.body()); // {"security":{"vpn":true},…}
One response, every signal

Everything you need in a single lookup

Each request returns a rich, structured payload — geolocation, network ownership, threat signals, and verification data — ready to drop into your fraud and SecOps pipelines.

IP Geolocation

  • city
  • region
  • country
  • postal
  • latitude
  • longitude
  • timezone

ASN & Network

  • asn
  • name
  • route
  • cloudflare

Threat Signals

  • vpn
  • proxy
  • tor
  • relay
  • residential_proxy
  • crawler
  • provider

Email Verification

  • deliverable
  • disposable
  • mx
  • catchall
  • role
  • provider
  • privacy

MAC Vendor

  • vendor
  • oui
  • registrant
  • block_type

Email DNS Records

  • mx_record
  • spf_record
  • mx_ip
  • mx_reverse
Use cases

Built for the teams stopping abuse

From payment fraud to account takeover, compliance to threat research — the same API powers every layer of your defense.

Payments & checkout fraud

Flag high-risk transactions in real time using VPN, proxy, and risk-score signals before they're authorized.

Account protection

Block fake signups and detect account takeover by spotting logins from anonymizing networks and improbable locations.

Compliance & KYC

Enforce geo-restrictions and licensing rules, and add a network-intelligence layer to your KYC and onboarding flows.

Threat research & SecOps

Enrich SIEM events and investigations with ASN, hosting, and reputation data to triage incidents faster.

FAQ

Network Intelligence API, explained

Common questions about IP geolocation, VPN detection, disposable email verification, and how the Nodedata API works.

A Network Intelligence API returns structured data about an IP address, email, or MAC address — including geolocation, network ownership (ASN), and threat signals such as VPN, proxy, and Tor usage. Teams use it to assess risk and prevent fraud and abuse in real time.
Detection is continuously updated from active scanning, the public Tor relay list, hosting and datacenter ranges, and behavioral signals. Each lookup also returns a numeric risk score so you can tune thresholds to your own tolerance.
The email endpoint validates format, resolves MX records, and matches the domain against a maintained list of disposable and temporary mail providers. It also flags role-based and free-provider addresses to help you score signup quality.
Each IP lookup returns independent security flags — vpn, proxy, residential_proxy, tor, relay, and crawler — plus the detected provider, such as ExpressVPN. That lets you treat a commercial VPN differently from a Tor exit node or a residential proxy instead of relying on a single “anonymous” label.
Send a GET request to https://api.nodedata.io/v1/{value}, where {value} is an IP, email, or MAC address, and pass your API key as the key query parameter. Optional flags like hostname and cloudflare let you control reverse-DNS lookups and resolution of Cloudflare-proxied IPs.

Start building with the Network Intelligence API

Query IP, email, and MAC intelligence from a single endpoint. Scale from your first request to millions of lookups with plans that grow with you.