A Developer's Tour of IP99: Free IP Lookup, pDNS, CT and an MCP Endpoint in One Place

If you've ever needed to answer "where is this IP, and is it acting like a proxy right now?", you've probably used several tools to do it: one for geolocation, another for proxy detection, a third for DNS history. IP99, built by ThreatHunter, puts these in one place. Some parts are free with no key, and some are enterprise products.

I wrote earlier about how IP99's risk score is designed to expire. This post isn't about that. It's a quick tour of what the site offers, what's free, what costs money, and where each piece fits.

1. Free IP lookup: risk and geolocation in one call

The main feature is a single JSON endpoint. You don't need to sign up or get an API key:

curl https://ip99.com/v1/ip/8.8.8.8 

One response gives you:

• Risk signals: proxy, vpn, dialup_pool, hijacked_proxy, cloud_phone, cloud_service, osint, crawler, plus the network properties hosting and mobile. You also get a 0–100 risk.score, a level, an evidence_state (active / stale / none), and computed_at.
• Geolocation: continent, ISO country code, region and city worldwide, latitude/longitude and an IANA time zone. For addresses in China it goes down to the district, and adds an ISO 3166-2 subdivision and a six-digit GB/T 2260 admin_code. For example, a home broadband address in 27.22.66.xxx resolves to Hubei / Xiangyang / Nanzhang, admin_code 420624.
• Network: the ASN plus a usage_type code (IDC, DYN for home broadband, MOB, EDU, CDN, and others).
• IPv4 and IPv6 both work (try 2001:4860:4860::8888).

To look up your own IP, call GET /v1/ip with no address. To check your plan and remaining quota, call GET /v1/me. The endpoint also sends Access-Control-Allow-Origin: *, so you can call it straight from a browser.

A few things to know before you rely on it:

• hosting and mobile describe the network. They don't mean an IP is risky. 8.8.8.8 comes back with hosting and a score of 0. If you block on those two signals, you'll block whole clouds and whole mobile carriers.
• A score of 0 doesn't mean an IP is safe. It means IP99 has no current evidence against it.
• The API returns codes and ASNs, not ISP names. The web lookup on the homepage shows the ISP name; the API doesn't.
• There is no Tor signal. Don't expect one.

2. Passive DNS and Certificate Transparency (free trial lookups)

IP99 also offers two domain tools for security research and OSINT work. Both are free to try at 10 lookups per IP per day:

# Passive DNS: historical A/AAAA/CNAME/MX/NS/TXT records with first_seen / last_seen curl https://ip99.com/v1/domain/dns/example.com # Certificate Transparency: certificates issued for a domain curl https://ip99.com/v1/domain/certs/example.com # Every other domain listed on the same certificate (64-hex SHA-256, no colons) curl https://ip99.com/v1/domain/fingerprint/<sha256> 

Passive DNS results also show the country, city and ASN of each IP the domain resolved to, plus malware-list hits. The site is clear about what these tools don't do:

• The CT data covers a rolling recent window, not the full CT history. Some large domains return nothing.
• There's no subdomain enumeration by suffix.
• Full reverse lookups (IP → every domain) aren't public. You have to contact sales and explain a legitimate use.

They're good for pivoting to related infrastructure, not a replacement for a full CT archive.

3. Phone-number risk (enterprise only)

/phone offers phone-number risk profiles. The site says the numbers are captured where they're sold, on SMS-verification and card-selling platforms, rather than guessed from user behaviour. Results fall into six categories: SIM-farm cards, account-bound cards, intercepted cards (the owner is a normal user whose SMS was hijacked), privacy numbers, historical-risk cards and suspected crowdsourced real users. The site lists roughly 210 million numbers.

This feature is not free. It has to be enabled for your account, is billed per number, and a time-limited test quota is available before you buy. An anonymous call to POST /v1/phone/lookup returns 401 key_required.

4. Pulse and private deployment

If the free endpoint doesn't give you enough detail, there are paid enterprise options:

• Pulse API (/pulse/v1/ip/{ip}): uses the same score as the free endpoint, plus per-item evidence with freshness, a share_tier (T0–T3) that estimates how many people share an address, and anonymous resource-pool handles. You can look back up to 30 days with ?at=, which has to be enabled separately. It requires a contract and a data processing agreement.
• Pulse private deployment: the full risk dataset runs inside your own network, so IP99 never sees which IPs you query. The site lists about 22.16 million records in 3.76 GB, with a measured P99 of 27 ms.
• Tide: a separate on-premises product. It takes your traffic (IP and timestamp is enough to start), finds the resource pools hitting you and produces evidence reports you can check yourself. It makes recommendations only; it doesn't block anything. A sample report is public.

Both are priced separately. /enterprise compares them.

5. Developer extras

This is the part I liked most:

• OpenAPI 3.1 at https://ip99.com/openapi.json. You can import it into Postman, a code generator or GPT Actions.
• MCP endpoint for AI agents: POST https://ip99.com/mcp (stateless Streamable HTTP) exposes an ip_risk_lookup tool that returns the same fields as /v1/ip. The free tier needs no auth. A signed-in variant at https://ip99.com/en/mcp/account uses OAuth, so clients like Claude Code, Cursor, VS Code or ChatGPT connectors open the IP99 login and charge lookups to your account quota:

 claude mcp add --transport http ip99 https://ip99.com/en/mcp/account 

• llms.txt at /llms.txt: a plain-text description of the site for AI assistants.
• Console at /console: sign in with an email code, then create and revoke API keys yourself (no approval step). It also has a 14-day usage overview, query analytics (score distribution, evidence freshness, risk types), a daily usage ledger with CSV export, and a list of connected OAuth apps.
• Keys go in a header only (X-API-Key or Authorization: Bearer). A key in the query string is rejected with 400 key_in_query.
• Docs with curl / Python / Go examples are at /api.

6. Public data pages

IP99 also publishes data you can browse without calling the API:

• Country pages (/en/geo/): 244 countries and regions. Each shows its IPv4 ranges, address counts, the residential / datacenter / mobile mix, top carriers and ASNs, cities, and proxy-type IPs newly captured in the last 7 days. They refresh daily.
• ASN pages (/en/asn/): one page for each of the largest ASNs, with range counts, countries and network mix.
• Weekly proxy-exit stats (/en/proxy-exits): aggregate counts only, with no address lists. In the 4–10 Oct 2026 (UTC) window it reported 11,171,033 newly captured proxy exits (+24% week over week), 80% of them on residential broadband and 13% on mobile networks. That figure counts what IP99's 53 upstream sources captured that week, not every proxy in the world. Check the page for the current week.

7. Pricing and quotas

These figures are from the English pricing page and the API docs:

According to the pricing page, every plan gets the same data and the same fields. Paying gets you more lookups, not better answers. Quotas reset at 00:00 Asia/Shanghai. Pro and Pro+ are self-serve overseas subscriptions paid in USD through Stripe. The same key and quota also apply to the MCP endpoint.

Try it

Start with one line and read the JSON:

curl https://ip99.com/v1/ip/8.8.8.8 

Then try the web lookup, read the API docs, or add the MCP endpoint to your agent. For phone risk, Pulse or Tide, start at /enterprise. Either way, treat IP data as one input to a decision, not the decision itself.