Give it an IP or a domain, get a CLEAN / ELEVATED / HIGH RISK verdict with a 0–100 score — combining geolocation, ASN/org, reverse DNS, a network-type deduction and live DNS blocklist membership.
| 🌍 Geo + ASN | RIR country, ASN, organisation and BGP prefix via Team Cymru DNS (no GeoIP key) |
| 🏷️ Network type | datacenter/hosting · VPN/proxy · Tor exit · mobile/carrier · residential ISP — deduced from ASN org + PTR + Tor list |
| 🔁 Reverse DNS | the PTR hostname (or its absence — a signal in itself) |
| 🚫 Blocklists | live DNSBL membership: DroneBL, blocklist.de, SORBS, UCEPROTECT, Barracuda, Spamhaus ZEN |
| 🧅 Tor | known Tor exit node (Tor DNS exit list) |
| 📊 Risk score | 0–100 abuse/risk score with an explained verdict |
GET /check?target=8.8.8.8 GET /check?target=example.com&deep=true GET /check_many?targets=1.1.1.1,8.8.8.8,9.9.9.9
Try it: /check?target=8.8.8.8 · /check?target=example.com
{
"mcpServers": {
"ip-doctor": { "command": "npx", "args": ["-y", "ip-doctor-mcp"] }
}
}Or connect over HTTP at POST /mcp. Tools: check_ip, check_many.
The /pro/* routes are gated by x402. Your agent pays $0.02 USDC per call automatically — no sign-up, no API key. DEEP tier adds more blocklists and TXT listing reasons. Settles on-chain to the operator wallet.
GET /pro/check?target=<ip|domain> # 402 → pay → deep result GET /pro/check_many?targets=... # up to 50 targets