IP to Privacy Detection Data

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "IPinfo Core API - IP Flags Response",
  "description": "Schema for IPinfo Core - Privacy detection flags in the IP lookup response",
  "type": "object",
  "properties": {
    "is_anonymous": {
      "type": "boolean",
      "description": "Indicates whether the IP address is associated with an anonymization service such as a VPN, proxy, Tor, or relay.",
      "example": true
    },
    "is_hosting": {
      "type": "boolean",
      "description": "Indicates whether the IP address belongs to a hosting provider, cloud service, or data center.",
      "example": true
    }
  }
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "IPinfo Plus API - Anonymous IP Detection Response",
  "description": "Schema for IPinfo Plus - Anonymous IP Detection API response",
  "type": "object",
  "properties": {
    "name": {
      "type": "string",
      "description": "The name of the VPN, proxy, or anonymization service associated with the IP address.",
      "example": "CyberGhost"
    },
    "is_proxy": {
      "type": "boolean",
      "description": "Indicates whether the IP address is associated with a proxy service.",
      "example": false
    },
    "is_relay": {
      "type": "boolean",
      "description": "Indicates whether the IP address is associated with a relay service.",
      "example": false
    },
    "is_tor": {
      "type": "boolean",
      "description": "Indicates whether the IP address is a Tor exit node.",
      "example": false
    },
    "is_vpn": {
      "type": "boolean",
      "description": "Indicates whether the IP address is associated with a VPN service.",
      "example": true
    }
  }
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "IPinfo IP to Privacy Detection API Response",
  "description": "Schema for IPinfo IP to Privacy Detection API response",
  "type": "object",
  "properties": {
    "vpn": {
      "type": "boolean",
      "description": "Indicates whether the IP address is associated with a VPN service.",
      "example": true
    },
    "proxy": {
      "type": "boolean",
      "description": "Indicates whether the IP address is associated with a proxy service.",
      "example": false
    },
    "tor": {
      "type": "boolean",
      "description": "Indicates whether the IP address is a Tor exit node.",
      "example": false
    },
    "relay": {
      "type": "boolean",
      "description": "Indicates whether the IP address is associated with a relay service.",
      "example": false
    },
    "hosting": {
      "type": "boolean",
      "description": "Indicates whether the IP address is associated with a hosting or cloud provider.",
      "example": true
    },
    "service": {
      "type": "string",
      "description": "The name of the VPN, proxy, or anonymization service associated with the IP address.",
      "example": "CyberGhost"
    }
  }
}

{
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "IPinfo IP to Privacy Detection Extended API Response",
  "description": "Schema for IPinfo IP to Privacy Detection Extended API response",
  "type": "object",
  "properties": {
    "vpn": {
      "type": "boolean",
      "description": "Indicates whether the IP address is an exit node of a Virtual Private Network (VPN) service.",
      "example": true
    },
    "proxy": {
      "type": "boolean",
      "description": "Indicates whether the IP address is associated with an open web proxy service.",
      "example": false
    },
    "tor": {
      "type": "boolean",
      "description": "Indicates whether the IP address is a Tor (The Onion Router) exit node.",
      "example": false
    },
    "relay": {
      "type": "boolean",
      "description": "Indicates whether the IP address is part of a location-preserving anonymous relay service.",
      "example": false
    },
    "hosting": {
      "type": "boolean",
      "description": "Indicates whether the IP address belongs to a hosting provider, cloud service, or data center.",
      "example": true
    },
    "service": {
      "type": "string",
      "description": "The name of the privacy service provider, including VPN, proxy, and relay service providers.",
      "example": "CyberGhost"
    },
    "confidence": {
      "type": "integer",
      "description": "The confidence level (1–3) attributed to the best detection source for this IP range. Level 3 indicates direct observation of commercial VPN use; level 2 indicates observed VPN software with provider association or strong device activity signals; level 1 indicates observed VPN software without a known provider association.",
      "example": 3
    },
    "coverage": {
      "type": "number",
      "description": "For inferred IP ranges, the proportion of the range (by IP count) where direct VPN activity was observed. For ranges with full direct evidence, this value is 1.0.",
      "example": 1.0
    },
    "census": {
      "type": "boolean",
      "description": "Indicates whether VPN software or associated ports were detected on this IP range through active port scanning.",
      "example": true
    },
    "census_ports": {
      "type": "string",
      "description": "The ports that returned positive results during VPN detection census scans.",
      "example": "500"
    },
    "device_activity": {
      "type": "boolean",
      "description": "Indicates whether device activity patterns consistent with VPN usage were observed on this IP range, such as simultaneous use across a large geographic area or association with hosting providers.",
      "example": false
    },
    "inferred": {
      "type": "boolean",
      "description": "Indicates whether the privacy classification is based on direct observation or inferred from activity on neighboring IP addresses.",
      "example": false
    },
    "vpn_config": {
      "type": "boolean",
      "description": "Indicates whether VPN activity was confirmed by directly running VPN software from known providers and collecting exit IPs.",
      "example": true
    },
    "whois": {
      "type": "boolean",
      "description": "Indicates whether VPN software or ports were detected on this range and the WHOIS record associates the IP with a VPN provider or VPN-related activity.",
      "example": false
    },
    "first_seen": {
      "type": "string",
      "description": "The date when anonymous activity on this IP address was first observed, in ISO 8601 format (YYYY-MM-DD). Within a 3-month lookback period.",
      "example": "2025-12-12"
    },
    "last_seen": {
      "type": "string",
      "description": "The date when anonymous activity on this IP address was most recently observed, in ISO 8601 format (YYYY-MM-DD).",
      "example": "2025-12-12"
    }
  }
}