Castle is becoming two things. There's the platform, which watches a session and decides for you, and there's the intelligence underneath it, which you can now buy on its own. The IP intelligence API is live today, free to sign up, and $0.001 per lookup after your free quota.
We built this data for ourselves, because we protect the full authenticated surface for some of the largest consumer platforms on the internet, where the job means knowing whether an IP address is an ordinary home connection, a datacenter, a mobile carrier, or someone renting a residential proxy by the hour.
Some of the teams we talk to have already built their own rules engine, and some even their own scoring, and the data underneath is the part they were missing. We felt that it wasn’t always making a lot of sense that they had to buy a whole platform to get at it.
Connection type and tunnel observations
A residential address can belong to a real customer and sit on a proxy network at the same time. A corporate VPN can be expected traffic. Those are different situations, and a boolean collapses them into one answer.
So the response keeps the facts separate. address and asn situate the IP, and each entry in tunnels is one observation of a proxy or VPN on that address, with who operated it when we know and when we last confirmed it. In the example below, the same address showed up on FloppyData and AnyIP a few days apart. You can treat those providers differently, or treat them the same, and either way the decision is yours.
curl -sSf -u ":$CASTLE_API_SECRET" \
<https://api.castle.io/v1/ips/1.0.105.13>
{
"address": "1.0.105.13",
"type": "ipv4",
"asn": 18144,
"location": {
"continent_code": "AS",
"country_code": "JP"
},
"tunnels": [
{
"type": "proxy",
"operator": "FloppyData residential",
"tier": null,
"last_seen_at": "2026-06-25T21:38:40.000Z",
"proxy_type": "residential"
},
{
"type": "proxy",
"operator": "AnyIP residential",
"tier": null,
"last_seen_at": "2026-06-21T22:55:42.000Z",
"proxy_type": "residential"
}
]
}
Lookups, batches, and downloads
GET /v1/ips/{value} fits a live decision. POST /v1/ips/query takes up to a thousand addresses when you're enriching a table. GET /v1/ips/downloads/proxies/{window}.{format}.gz returns a precomputed tunnel feed over a 1d, 7d, 30d, or 60d window, as .csv.gz or .jsonl.gz, for loading into your own store.
Try it on traffic you already know
Sign up, take the key from the getting started wizard, and run addresses from an attack you've already investigated. The free quota should be enough for that, and the price is on the page if you want to understand how it scales to full production use. Also, just reach out to us if you're looking for enterprise needs and volume discounts.
