{"slug": "show-hn-ip-lookup-api", "title": "Show HN: IP Lookup API", "summary": "Company of Craft released an IP lookup API that returns a verdict of human, proxy, bot, ai_crawler, search_bot or spoofed_crawler for a visitor's IP and request headers, letting site operators verify whether traffic claiming to be Googlebot or GPTBot actually originates from the published IP ranges of Google, Bing, Apple, OpenAI, Anthropic and Perplexity. The API draws network and country data from Team Cymru's IP-to-ASN service and Tor exit nodes from the Tor Project list, stores no looked-up IPs, and allows 600 calls per minute per server or browser. A Netlify Edge Function example blocks requests flagged as spoofed_crawler with a 403 response.", "body_md": "# IP lookup\n\nSee what a website can tell from an IP address: where it is, whose network it is on, and whether it looks like a VPN, a bot or an AI crawler.\n\n## Questions\n\n## How do I check if a request comes from a real Googlebot or GPTBot?\n\nAnyone can put Googlebot or GPTBot in a user agent. Google, Bing, Apple, OpenAI, Anthropic and Perplexity publish the IP ranges their crawlers use. A request is real when its IP is in those ranges. Call the API with the `ip` and `ua` of the request to check it.\n\n## Can it tell if someone uses a VPN?\n\nPartly. Tor exit nodes are on a public list, so those are certain. VPNs and proxies mostly run on hosting networks like AWS, DigitalOcean, Hetzner or M247, so an IP from one of those is likely a VPN, a proxy or a server. A VPN on a home network looks like any home connection.\n\n## Why is my location a different city?\n\nAn IP address belongs to a network, not a house. The location is where your internet provider says that network is, which can be the nearest big city. Mobile networks and VPNs can show a city far away.\n\n## Why is the city missing when I look up another IP?\n\nThe city comes from the network your request arrives through, so it is only known for your own IP. For other IPs the country comes from the regional internet registry.\n\n## Are the IPs I look up saved?\n\nNo. Nothing is stored.\n\n## Detect bots on your site\n\nSend the visitor's IP and a few request headers from your server to `POST /api/ip-lookup`. The answer has a `verdict`: `human`, `proxy`, `bot`, `ai_crawler`, `search_bot` or `spoofed_crawler`, plus `isBot`, `isAiCrawler` and `isProxy`. Send only the headers below, not cookies.\n\n```\ncurl -X POST https://companyofcraft.com/api/ip-lookup \\\n  -d '{\"ip\":\"66.249.66.1\",\"headers\":{\"user-agent\":\"Googlebot/2.1\"}}'\n```\n\nOn Netlify, an Edge Function can check every request:\n\n``` js\nconst HEADERS = [\"user-agent\", \"accept\", \"accept-language\", \"sec-ch-ua\", \"sec-fetch-mode\"];\n\nexport default async (request, context) => {\n  const headers = Object.fromEntries(\n    HEADERS.filter((name) => request.headers.has(name)).map((name) => [name, request.headers.get(name)]),\n  );\n  const response = await fetch(\"https://companyofcraft.com/api/ip-lookup\", {\n    method: \"POST\",\n    body: JSON.stringify({ ip: context.ip, headers }),\n  });\n  const { verdict } = await response.json();\n  if (verdict === \"spoofed_crawler\") {\n    return new Response(\"Forbidden\", { status: 403 });\n  }\n  return context.next();\n};\n```\n\nTo check your own request, call `GET /api/ip-lookup`. Add `?ip=` and `&ua=` to look up another IP. Each server or browser can make 600 calls a minute.\n\n## How it works\n\nThe network and its country come from the [Team Cymru IP to ASN service](https://www.team-cymru.com/ip-asn-mapping). Tor exit nodes come from the [Tor Project list](https://check.torproject.org/torbulkexitlist). Bots are matched by user agent and checked against the IP ranges each company publishes. The map uses [Natural Earth](https://www.naturalearthdata.com) data.\n\nCompany of Craft also builds [stateofpixel](https://stateofpixel.com), which catches UI regressions before they merge.", "url": "https://wpnews.pro/news/show-hn-ip-lookup-api", "canonical_source": "https://companyofcraft.com/ip-lookup", "published_at": "2026-10-18 17:22:05+00:00", "updated_at": "2026-10-18 17:48:21.167895+00:00", "lang": "en", "topics": ["ai-crawlers", "ai-search", "developer-tools"], "entities": ["Company of Craft", "Googlebot", "GPTBot", "Google", "OpenAI", "Anthropic", "Perplexity", "Team Cymru"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-ip-lookup-api", "markdown": "https://wpnews.pro/news/show-hn-ip-lookup-api.md", "text": "https://wpnews.pro/news/show-hn-ip-lookup-api.txt", "jsonld": "https://wpnews.pro/news/show-hn-ip-lookup-api.jsonld"}}