IP intelligence with edge-captured TLS fingerprints
One GET request returns geolocation, network ownership, VPN/proxy/Tor detection, and the caller's JA3/JA4 TLS fingerprint. Served from CloudFront, so the handshake is fingerprinted at the edge — something an origin-side API physically cannot do.
Geolocation and network
Country, region, city, postal code, timezone, and coordinates, plus ASN and the owning organization. Enough to route, personalize, or price by region without shipping a GeoIP database.
VPN, proxy, Tor, and datacenter flags
Four independent booleans plus a rolled-up is_anonymizer flag and a 0-100 risk score. Every verdict carries its source dataset and a confidence value, so you can tune your own thresholds instead of trusting a black box.
JA3 and JA4 TLS fingerprints
Identify the caller's TLS stack — browser and OS build — independent of user agent, which anyone can spoof. Captured at the CloudFront edge from the live handshake, never cached per-IP, because a fingerprint describes a device and not a network.
Most IP intelligence APIs answer the same question: where is this address, and who owns it. That's a solved problem, and IPinfo and MaxMind solve it well. The harder question is whether the thing on the other end of the connection is what it claims to be — and a user agent string is worthless there, because it's a header the client writes.
A TLS fingerprint isn't. JA3 and JA4 hash the shape of the ClientHello — cipher suites, extensions, elliptic curves, in the order the client offered them. That ordering falls out of the TLS library, so a Python script pretending to be Chrome on macOS produces a fingerprint that doesn't match any real Chrome build. Spoofing it means reimplementing the handshake, not editing a string.
Why the edge matters
You can only fingerprint a TLS handshake if you terminate it. By the time a request reaches an origin server, the handshake is over and the detail is gone. Our lookup endpoint sits behind CloudFront specifically so the fingerprint is captured at termination and forwarded inward. This is also why we never cache JA3/JA4 against an IP: several devices sit behind one NAT address, so a cached fingerprint would describe whoever happened to connect first. Geolocation and ASN are cached per-IP and refreshed in place; fingerprints always come from the current request.
Confidence, not verdicts
Every threat response carries the dataset that produced it and a confidence score from 0 to 1. A Tor exit node from the official consensus list is high confidence. A datacenter ASN that might be a corporate VPN is not. Collapsing both into one boolean is how fraud systems end up blocking legitimate users on office networks, so we hand you the provenance and let you set your own thresholds.
Plan limits
Free: 1,000 lookups/month. Lite ($12/mo): 25,000. Pro ($39/mo): 250,000. Business ($99/mo): 2,500,000. Paid plans burst to 2x the cap before refusing requests, so a traffic spike degrades gracefully rather than failing at exactly the limit. Higher volumes available — contact us.
How it works
Call the endpoint
GET /v1/lookup with your site ID and API key. The endpoint enriches the caller's own IP — call it from your backend, your edge worker, or the visitor's browser.
We enrich at the edge
CloudFront fingerprints the TLS handshake and attaches viewer geolocation headers. We merge that with our threat datasets and a persisted per-IP cache, then return JSON in a single round trip.
Act on the signal
Gate a signup, step up verification, personalize by region, or drop the result into your fraud model. Threat flags also annotate your session replays automatically, at no extra cost.
How Nevision compares
| Feature | Nevision | IPinfo | MaxMind | IPQualityScore |
|---|---|---|---|---|
| Free lookups/month | 1,000 | 1,000 | Trial only | 5,000 |
| Paid plan starts at | $12/mo | $99/mo | $25/mo | $50/mo |
| Geolocation + ASN | ||||
| VPN / proxy / Tor detection | Add-on | Add-on | ||
| JA3 / JA4 TLS fingerprints | — | — | — | |
| Confidence + source on every verdict | — | — | — | |
| Includes session replay | — | — | — | |
| Includes error tracking | — | — | — |
Comparison based on publicly listed pricing and features as of August 2026.
Frequently asked questions
Can I look up an arbitrary IP address?+
No — the endpoint enriches the IP of whoever called it. That's deliberate: JA3/JA4 fingerprints only exist for a live TLS handshake, so a lookup of some third-party address could never carry them. To enrich a visitor, call the endpoint from that visitor's browser or forward the result from your edge.
What are JA3 and JA4, in practical terms?+
Hashes of the TLS ClientHello — the cipher suites, extensions, and curves a client offers, in order. That ordering comes from the client's TLS library, so it identifies the real browser and OS build regardless of what the user agent claims. JA4 is the newer revision and is more resistant to trivial randomization than JA3.
How accurate is the geolocation?+
City-level. Country and region are highly reliable; city is a good signal but not an address. Use it for routing, currency, language, and fraud scoring — not for anything that must be exact.
Does caching mean I get stale data?+
Enrichment for each IP is persisted and refreshed in place, and every response includes cache_added_at, cache_last_updated, and cache_lookup_count so you can judge freshness yourself. Threat lists are refreshed on a schedule. Fingerprints are never cached.
Do cached lookups still count against my quota?+
Yes. The cache reduces latency, not billing. If you're calling this on every page view, cache the result in your own session store keyed by IP — most fraud and personalization use cases only need one lookup per session.
Can I try it before signing up?+
Yes. The free IP lookup and IP threat check tools run the same pipeline against your own IP, with a small daily cap and no account required.