# IP Address Risk Scoring (IP Intelligence) (`greip/ip-scoring`) Actor

Access comprehensive threat intelligence data for IP addresses. Provides insights into malicious activity, reputation scoring, and potential security risks for enhanced fraud detection and security.

- **URL**: https://apify.com/greip/ip-scoring.md
- **Developed by:** [Greip](https://apify.com/greip) (community)
- **Categories:** Developer tools, Other, Automation
- **Stats:** 14 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.11 / 1,000 requests

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Greip IP Reputation Scoring

An Apify Actor for analyzing IP addresses using the Greip IP Reputation API. This Actor provides comprehensive threat intelligence data linked to specific IP addresses, including insights into malicious activity, reputation scoring, and potential security risks.

### Features

- **Threat Intelligence**: Comprehensive analysis of IP addresses for security risks
- **Malicious Activity Detection**: Identifies IP addresses associated with malware, phishing, spam, and other threats
- **Proxy & VPN Detection**: Detects IP addresses using proxies, VPNs, or Tor networks
- **Bot Detection**: Identifies automated traffic and bot activity
- **Hosting Provider Detection**: Flags IP addresses from hosting services and data centers
- **Geolocation Data**: Provides geographic information about the IP address
- **ISP Information**: Details about the Internet Service Provider
- **Custom Rules Support**: Applies organization-specific rules for enhanced filtering
- **Risk Scoring**: Numerical risk assessment for decision-making

### Quick Start

Once you've installed the dependencies, start the Actor:

```bash
apify run
```

Once your Actor is ready, you can push it to the Apify Console:

```bash
apify login # first, you need to log in if you haven't already done so

apify push
```

### Input Parameters

- **ip** (required): IP address to analyze for reputation scoring. Supports both IPv4 and IPv6 formats:
  - IPv4: `1.1.1.1`
  - IPv6: `2001:db8::1`

- **userID** (optional): User identifier for tracking requests in the Greip dashboard (e.g., email address, user ID, name).

- **mode** (optional): API mode for development or production environment:
  - `live` (default): Production environment
  - `test`: Development/testing environment

### Output Data

The Actor outputs structured data with the following fields:

- **ip**: The analyzed IP address
- **timestamp**: When the analysis was performed
- **riskScore**: Numerical risk score for the IP address
- **threats**: Object containing threat intelligence data:
  - `isProxy`: Whether the IP is a proxy
  - `proxyType`: Type of proxy (if applicable)
  - `isTor`: Whether the IP is using Tor network
  - `isBot`: Whether the IP is associated with bot activity
  - `isRelay`: Whether the IP is a relay server
  - `isHosting`: Whether the IP belongs to a hosting provider
  - `blacklisted`: Whether the IP is blacklisted
  - `malware`: Whether the IP is associated with malware
  - `phishing`: Whether the IP is associated with phishing
  - `spam`: Whether the IP is associated with spam
  - `suspicious`: Whether the IP shows suspicious activity
- **geolocation**: Geographic information about the IP
- **isp**: Internet Service Provider information
- **customRulesApplied**: Custom rules that were applied during analysis
- **status**: API response status
- **ipType**: Type of IP address (IPv4 or IPv6)
- **mode**: API mode used for the request

### Environment Variables

You need to set the following environment variable:

- **GREIP\_API\_KEY**: Your Greip API key (required)

To obtain an API key, create an account at [Greip](https://greip.io) and find your API key in the dashboard.

### Project Structure

```text
.actor/
├── actor.json # Actor config: name, version, env vars, runtime settings
├── dataset_schema.json # Structure and representation of data produced by an Actor
├── input_schema.json # Input validation & Console form definition
└── output_schema.json # Specifies where an Actor stores its output
src/
└── main.ts # Actor entry point and orchestrator
storage/ # Local storage (mirrors Cloud during development)
├── datasets/ # Output items (JSON objects)
├── key_value_stores/ # Files, config, INPUT
└── request_queues/ # Pending crawl requests
Dockerfile # Container image definition
```

For more information, see the [Actor definition](https://docs.apify.com/platform/actors/development/actor-definition) documentation.

### How it works

This Actor uses TypeScript and the Greip IP Reputation API to analyze IP addresses for threat intelligence:

1. **Input Processing**: The Actor accepts an IP address (with optional user ID and mode)
2. **API Request**: Makes a request to the Greip IP Reputation API endpoint (`/lookup/ip/threats`)
3. **Data Processing**: Processes the API response to extract threat intelligence and risk data
4. **Output Storage**: Stores the structured results in the Actor's dataset

The analysis process provides:

- Comprehensive threat intelligence data
- Risk scoring for security assessment
- Detection of malicious activity associations
- Proxy, VPN, and Tor network identification
- Bot and automated traffic detection
- Geolocation and ISP information

### Use Cases

- **Fraud Prevention**: Analyze IP addresses in payment transactions for fraud detection
- **Content Moderation**: Identify high-risk IP addresses attempting to bypass filters
- **User Registration**: Screen new user registrations for suspicious IP addresses
- **API Security**: Block or flag requests from known malicious IP addresses
- **Threat Intelligence**: Enhance security systems with real-time IP reputation data
- **Compliance**: Meet regulatory requirements for transaction monitoring and user verification

### What's included

- **[Apify SDK](https://docs.apify.com/sdk/js)** - toolkit for building [Actors](https://apify.com/actors)
- **[Input schema](https://docs.apify.com/platform/actors/development/input-schema)** - define and easily validate a schema for your Actor's input
- **[Dataset](https://docs.apify.com/sdk/python/docs/concepts/storages#working-with-datasets)** - store structured data where each object stored has the same attributes
- **TypeScript** - strongly typed JavaScript for better development experience

### Resources

- [Greip IP Reputation API Documentation](https://docs.greip.io/api-reference/endpoint/scoring/ip-reputation)
- [Greip IP Lookup API Documentation](https://docs.greip.io/api-reference/endpoint/data-lookup/ip)
- [Greip Documentation](https://docs.greip.io)
- [Quick Start](https://docs.apify.com/platform/actors/development/quick-start) guide for building your first Actor
- [Integration with Zapier](https://apify.com/integrations), Make, Google Drive and others
- [Video guide on getting data using Apify API](https://www.youtube.com/watch?v=ViYYDHSBAKM)

### Getting started

For complete information [see this article](https://docs.apify.com/platform/actors/development#build-actor-at-apify-console). In short, you will:

1. Build the Actor
2. Run the Actor

### Pull the Actor for local development

If you would like to develop locally, you can pull the existing Actor from Apify console using Apify CLI:

1. Install `apify-cli`

   **Using Homebrew**

   ```bash
   brew install apify-cli
   ```

   **Using NPM**

   ```bash
   npm -g install apify-cli
   ```

2. Pull the Actor by its unique `<ActorId>`, which is one of the following:

   - unique name of the Actor to pull (e.g. "apify/hello-world")
   - or ID of the Actor to pull (e.g. "E2jjCZBezvAZnX8Rb")

   You can find both by clicking on the Actor title at the top of the page, which will open a modal containing both Actor unique name and Actor ID.

   This command will copy the Actor into the current directory on your local machine.

   ```bash
   apify pull <ActorId>
   ```

### Documentation reference

To learn more about Apify and Actors, take a look at the following resources:

- [Apify SDK for JavaScript documentation](https://docs.apify.com/sdk/js)
- [Apify SDK for Python documentation](https://docs.apify.com/sdk/python)
- [Apify Platform documentation](https://docs.apify.com/platform)
- [Join our developer community on Discord](https://discord.com/invite/jyEM2PRvMU)

# Actor input Schema

## `ip` (type: `string`):

IP address to analyze for reputation scoring using Greip IP Reputation API. Supports both IPv4 and IPv6 addresses (e.g., 1.1.1.1, 2001:db8::1).

## `userID` (type: `string`):

Optional user identifier for tracking requests in the Greip dashboard (e.g., email address, user ID, name).

## Actor input object example

```json
{
  "ip": "1.1.1.1"
}
```

# Actor output Schema

## `ipReputationScores` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "ip": "1.1.1.1"
};

// Run the Actor and wait for it to finish
const run = await client.actor("greip/ip-scoring").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "ip": "1.1.1.1" }

# Run the Actor and wait for it to finish
run = client.actor("greip/ip-scoring").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "ip": "1.1.1.1"
}' |
apify call greip/ip-scoring --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "command": "npx",
            "args": [
                "mcp-remote",
                "https://mcp.apify.com/?tools=greip/ip-scoring",
                "--header",
                "Authorization: Bearer <YOUR_API_TOKEN>"
            ]
        }
    }
}

```

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/H7DsT4O5B8DbmAWML/builds/UfOQWbWlyA2EgTyJW/openapi.json