--- title: "IPLocate Integration" description: "Turn any IPv4 or IPv6 address into geolocation, network, and threat intelligence with IPLocate. Agents localize an experience and flag proxy or hosting traffic before it reaches a signup flow." url: https://flowrunner.ai/integrations/iplocate date_modified: 2026-08-07T17:20:23-07:00 --- # IPLocate [Analytics & Data](https://flowrunner.ai/integrations/category/analytics-data) Turn any IPv4 or IPv6 address into geolocation, network, and threat intelligence with IPLocate. Agents localize an experience and flag proxy or hosting traffic before it reaches a signup flow. [Verified](https://flowrunner.ai/integrations/verified "What does verified mean?") · 10 actions · API key · available [IPLocate website](https://iplocate.io/) · [Platform Documentation](https://www.iplocate.io/docs) · Capability data verified 2026-08-12 1. A new account completes signup 2. Get Privacy And Threat Flags returns the proxy, VPN, Tor, iCloud Relay, hosting and abuser flags 3. Get Company Details resolves the organisation behind the address range 4. Agent compares the resolved company against the email domain on the signup 5. Clean signups are provisioned and the enrichment is written onto the CRM record 6. Trust and safety reviews the held accounts and releases or rejects each one ## What This Integration Enables IPLocate is the threat-detection member of this group. Every other field it returns, and it returns plenty, sits underneath a privacy object that names the risk precisely instead of collapsing it into one score. is\_abuser covers addresses on an abuse blocklist and is\_anonymous covers proxy, Tor, VPN and iCloud Relay, with is\_bogon, is\_hosting, is\_icloud\_relay, is\_proxy, is\_tor and is\_vpn also exposed as separate booleans. That data set is refreshed multiple times per day. Alongside it sit a hosting object naming the provider, network range and even the service and region where the provider publishes them, a company object identifying the organisation behind a range for B2B visitor identification, an ASN record, and an abuse contact pulled from public Whois. The reason those flags stay separate matters operationally. is\_icloud\_relay is on for millions of ordinary Apple customers who never opted into anything more sinister than a default privacy setting, while is\_abuser means the address has been reported for abuse. Treating those two as the same signal is how a fraud rule starts rejecting paying customers. FlowRunner agents read the flags individually, act on the unambiguous ones, and route the rest to a person. IPLocate also offers granular actions that return only the slice you need, plus historical lookups that show what a network looked like on a past date, which is what compliance and legal review actually need after an incident. ### Without FlowRunner **Blocklist logic with no nuance**: A single anonymiser flag blocks the account, and legitimate privacy users are caught with the abusers **Fraud signals arrive after the charge**: The address is only examined once a chargeback or an abuse report lands **Company attribution done by hand**: Someone reverse-looks-up the visiting network to work out which account it belongs to ### With FlowRunner **Flags separated by what they mean**: Abuse reputation, Tor, VPN, iCloud Relay, hosting and bogon come back as distinct signals **Risk assessed at signup**: The address is profiled before the account is provisioned, not after the loss **Company resolved automatically**: The organisation, domain, country and network type land on the record without a manual lookup ## Use Case Scenarios ### Signup screening that does not punish privacy A self-serve product gets a wave of trial signups. For each one the agent calls Get Privacy And Threat Flags. Addresses flagged is\_abuser or is\_tor with a disposable email domain are held immediately. Addresses flagged only is\_icloud\_relay are provisioned normally, because that flag on its own describes an Apple default rather than a bad actor. Addresses flagged is\_hosting get one more question asked of them with Get Hosting Details, since an EC2 range behind a consumer signup is a different story than a small managed host. The distinction is the whole value: three different flags, three different responses. ### Identifying the company behind anonymous traffic A marketing team wants to know which target accounts are reading the pricing page. The agent enriches the day's sessions with Get Company Details, which returns the organisation name, domain, country and type, and drops the ones typed as hosting or isp because those are infrastructure, not companies. The named organisations are matched against the target account list in [HubSpot](https://flowrunner.ai/integrations/hubspot) and posted to the sales channel with the pages viewed. Sessions that resolve to no company at all stay out of the report rather than being padded with a guess. ### Reconstructing what a network looked like during an incident A compliance review asks whether an address used during a disputed transaction last quarter was a data center at the time. Present-day data cannot answer that, because networks are reallocated. The agent calls Look Up Historical IP Data with the incident date and gets the record as IPLocate held it then, complete with the hosting and privacy state, and attaches it to the case file in [Notion](https://flowrunner.ai/integrations/notion). The finding is dated evidence rather than a current lookup presented as history. ## Human-in-Loop Highlight The gate is the block. When the flags come back mixed, is\_anonymous true but is\_abuser false, hosting provider identified but the company object null, the agent has genuinely ambiguous evidence and rejecting the signup is a customer-visible action with no undo: the person does not come back and you never learn they were real. So the agent provisions nothing and rejects nothing. It holds the account in a pending state and posts the case to the trust and safety channel: "Signup for jordan@northfield.example held. is\_anonymous true, is\_icloud\_relay true, is\_abuser false, is\_tor false, hosting null. Email domain registered 2019. Release, reject, or request verification?" A person decides, and the decision is recorded against the account. That is what [human-in-the-loop](https://flowrunner.ai/concepts/human-in-the-loop) means here: the agent runs the whole screen and hands over exactly the cases where the evidence points both ways. Agent processes routinely Detects exception requiring judgment Clear match Continues automatically Ambiguous Routes to human via preferred channel Human decides Agent resumes with decision ## Agent Capabilities 10 actions ### IP Intelligence 4 - **Look Up IP Address** Returns the complete IPLocate record for an IPv4 or IPv6 address: country, city, subdivision, continent, coordinates, time zone, postal code, currency and calling codes, anycast and satellite flags, plus the asn, privacy, hosting, company and abuse objects. Fields To Include trims the response to what the flow reads. Hosting and company objects are omitted when IPLocate has no data for the address. - **Look Up Calling IP Address** Returns the full record for the address that made the request, without needing it in advance. Because the call originates from the FlowRunner runtime, the result describes the runtime's outbound address rather than an end user's. Use Look Up IP Address when you already hold the address to inspect. - **Look Up Historical IP Data** Returns the record for an address as it stood on a specific past date, from IPLocate's historical data set. Used for fraud investigation, compliance auditing and legal review, where the question is what the network was at the time of the event rather than what it is now. Requires an IPLocate Enterprise plan. - **Batch Look Up IP Addresses** Looks up many addresses in one request and returns an object keyed by each submitted address. Accepts up to 1,000 IPv4 or IPv6 addresses per call. Invalid addresses come back as inline error objects alongside the successful results, and each address consumes one API request. Requires a paid plan or purchased credits. ### Threat Detection 1 - **Get Privacy And Threat Flags** Returns only the privacy and threat flags for an address: is\_abuser, is\_anonymous, is\_bogon, is\_hosting, is\_icloud\_relay, is\_proxy, is\_tor and is\_vpn. Refreshed multiple times per day. Used to gate signups, checkouts and logins with each flag treated on its own terms rather than collapsed into a single verdict. ### Network Intelligence 4 - **Get ASN Details** Returns only the Autonomous System record for an address: AS number, announced route, network name, organisation name and domain, organisation country, organisation type across business, hosting, government, education, isp or unknown, and the Regional Internet Registry that assigned it. Returns null where no ASN data exists. - **Get Hosting Details** Returns only the hosting and datacenter record: provider name and domain, network range and, where published, the region code and service name such as EC2 in ap-northeast-2. Returns null when IPLocate has no detailed hosting data, in which case the is\_hosting flag may still be true. - **Get Company Details** Returns only the company record behind an address range: organisation name, domain, country and type. Used for B2B visitor identification and account-based marketing. The company type describes how the specific network is used and may differ from the ASN type. Returns null when no company is matched. - **Get Abuse Contact** Returns only the abuse contact for an address from public Whois: responsible organisation, postal address, country, email, phone and the network range the contact covers. Used to report malicious traffic to the operator responsible for it. Returns null when no contact is published. ### Utilities 1 - **Get Calling IP Address** Returns just the public address that made the request, as JSON, from IPLocate's free current-IP endpoint. Needs no API key, is not rate limited and consumes no quota, so it is a cheap way to discover the FlowRunner runtime's outbound address before feeding it into a full lookup. ## Frequently Asked Questions ### What can FlowRunner do with IPLocate? FlowRunner agents can run Look Up IP Address, Look Up Calling IP Address, and Look Up Historical IP Data in IPLocate, plus 7 more actions. ### Does connecting IPLocate to FlowRunner require OAuth? No. IPLocate connects to FlowRunner with an API key, no OAuth flow required. ### Can IPLocate trigger a FlowRunner workflow automatically? IPLocate doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger. **Work at IPLocate?** This integration exposes IPLocate to AI agents on every FlowRunner plan, including through MCP, at no cost to you. [See what FlowRunner offers integration partners](https://flowrunner.ai/integrations/partners), including how to keep this page current. --- Markdown version of https://flowrunner.ai/integrations/iplocate. Site index: https://flowrunner.ai/llms.txt