Lookup response fields explained, one by one
What every field in a host.sh lookup answer means: location, time zone, country facts, ISP and ASN, connection type, anonymity and usage scores.
A lookup answer has up to six parts: geo (where), connection (the network), and, for your own IP or with ua=, the parsed user agent in user_agent, client, os and device. Which parts you get depends on your token's plan. Values the API doesn't know are null. Use the paths below with fields= to get only what you need, e.g. fields=geo.country.code,connection.isp.asn; the OpenAPI reference has the same list with types only.
Locations come from the IP address alone. They are approximate and can be the place of the network's equipment rather than of the person; geo.radius says how far off they may be.
geo: location
| Field | Type | Meaning |
|---|---|---|
geo | object | Where the address is, approximately |
geo.continent | object | The continent |
geo.continent.id | integer or null | Numeric place id of the continent |
geo.continent.code | string or null | Two-letter continent code: AF, AN, AS, EU, NA, OC or SA |
geo.continent.name | string or null | Continent name, in the lang language |
geo.country | object | The country and facts about it |
geo.country.id | integer or null | Numeric place id of the country |
geo.country.code | string or null | ISO 3166-1 alpha-2 country code, e.g. US |
geo.country.name | string or null | Country name, in the lang language |
geo.country.is_eu | boolean | Whether the country is a member of the European Union |
geo.country.flag | string or null | The flag emoji, e.g. 🇺🇸 |
geo.country.calling_code | string or null | International calling code, e.g. +1 |
geo.country.capital | string or null | Name of the capital, in English |
geo.country.tld | string or null | Country code top-level domain, e.g. .us |
geo.country.currency | object or null | The country's currency |
geo.country.currency.code | string | ISO 4217 currency code, e.g. USD |
geo.country.currency.name | string | Currency name, in English |
geo.country.currency.symbol | string or null | Currency sign, e.g. $ |
geo.subdivision | object | The region: state, province or similar |
geo.subdivision.id | integer or null | Numeric place id of the region |
geo.subdivision.code | string or null | Region code, the part after the dash in ISO 3166-2 (CA for US-CA) |
geo.subdivision.name | string or null | Region name, in the lang language |
geo.city | object | The city |
geo.city.id | integer or null | Numeric place id of the city |
geo.city.name | string or null | City name, in the lang language |
geo.postal_code | string or null | Postal code of the area, where known |
geo.latitude | number or null | Approximate latitude, in degrees |
geo.longitude | number or null | Approximate longitude, in degrees |
geo.radius | integer or null | Accuracy radius in km around the latitude and longitude |
geo.timezone: time zone
| Field | Type | Meaning |
|---|---|---|
geo.timezone | object | The time zone of the location |
geo.timezone.name | string or null | IANA time zone name, e.g. America/Chicago |
geo.timezone.offset | integer or null | Minutes behind UTC, like JavaScript getTimezoneOffset(): UTC-5 is 300, UTC+2 is -120 |
geo.timezone.utc_offset | string or null | The offset from UTC as text, e.g. -05:00 |
geo.timezone.is_dst | boolean or null | Whether daylight saving time is in effect now |
geo.timezone.current_time | string or null | Local date and time at the moment of the answer, ISO 8601 with offset, e.g. 2026-10-26T13:17:15-05:00 |
connection: network
| Field | Type | Meaning |
|---|---|---|
connection | object | The address and its network |
connection.ip | string | The address that was looked up |
connection.version | integer | 4 or 6, the IP version |
connection.bogon | boolean | true for a private, reserved or otherwise not routable address, such as 10.0.0.1 or fe80::1 |
connection.hostname | string or null | The reverse DNS (PTR) name. Only with hostname=1, e.g. dns.google for 8.8.8.8 |
connection.type | string or null | Kind of connection, e.g. Cable/DSL or Corporate |
connection.isp | object | Who runs the network |
connection.isp.asn | integer or null | Autonomous system number, e.g. 15169 |
connection.isp.aso | string or null | Name of the organization the AS is registered to |
connection.isp.name | string or null | Name of the ISP |
connection.isp.organization | string or null | Name of the organization using the address, often the same as the ISP |
connection.isp.mcc | string or null | Mobile country code, for mobile carriers only |
connection.isp.mnc | string or null | Mobile network code, for mobile carriers only |
connection.anonymity: VPN, proxy, Tor and more
Each entry has a score from 0 to 1 in steps of 1/16 (0.0625). 0 means the address is not in a known network of that kind, and any score above 0 is a hit. A higher score means more, or more certain, evidence; it is not a probability. The tor, vpn, proxy, dch, cdn and bot lists are updated every 6 hours.
| Field | Type | Meaning |
|---|---|---|
connection.anonymity | object | Whether the address is in a known network of each kind |
connection.anonymity.tor | object | Tor exit nodes |
connection.anonymity.tor.score | number | 1 for a listed exit node |
connection.anonymity.vpn | object | Servers of commercial VPN services and ranges known to be VPN exits |
connection.anonymity.vpn.score | number | Above 0 for a VPN exit. Cloudflare WARP egress scores 0.5, because it also carries ordinary users of a privacy app; Apple iCloud Private Relay is not counted as VPN and scores 0 |
connection.anonymity.proxy | object | Public open proxies, tested about every hour |
connection.anonymity.proxy.score | number | 0.75 or more for a listed proxy. Many open proxies are compromised home devices: a signal, not proof |
connection.anonymity.dch | object | Hosting and data center ranges: cloud, VPS and dedicated servers |
connection.anonymity.dch.score | number | Above 0 for a hosting range |
connection.anonymity.dch.name | string or null | The hosting provider, where known |
connection.anonymity.dch.url | string or null | Its website, where known |
connection.anonymity.cdn | object | CDN edge ranges |
connection.anonymity.cdn.score | number | Above 0 for a CDN edge |
connection.anonymity.cdn.name | string or null | The CDN, where known |
connection.anonymity.cdn.url | string or null | Its website, where known |
connection.anonymity.bot | object | Ranges that search engines, AI crawlers and monitoring services publish for their crawlers |
connection.anonymity.bot.score | number | Above 0 when the address belongs to a known crawler |
connection.anonymity.bot.name | string or null | The crawler, where known |
connection.anonymity.bot.url | string or null | Its website, where known |
connection.anonymity.bot.useragent | string or null | The token the crawler puts in its User-Agent. Check the request's User-Agent too: a browser in the same range is not the crawler |
connection.anonymity.scraper | object | Legacy data, not maintained |
connection.anonymity.scraper.score | number | Currently 0 for every address |
connection.anonymity.ddos | object | Legacy data, not maintained |
connection.anonymity.ddos.score | number | Currently 0 for every address |
connection.usage: kind of network
Scores (0 to 1, as for anonymity) for the kind of organization the network belongs to, each with name and url where known. This is legacy data that has not been updated since 2023: gov, lib, mil and org may be outdated, and com, edu, isp and mob are currently 0 for every address. Not in tokenless answers.
| Field | Type | Meaning |
|---|---|---|
connection.usage | object | The kind of network, by organization type |
connection.usage.com | object | Commercial networks |
connection.usage.org | object | Non-profit organizations |
connection.usage.edu | object | Educational institutions |
connection.usage.lib | object | Libraries |
connection.usage.gov | object | Government |
connection.usage.mil | object | Military |
connection.usage.isp | object | Internet service providers |
connection.usage.mob | object | Mobile networks |
connection.usage.*.score | number | 0 is not listed; any score above 0 is a hit |
connection.usage.*.name | string or null | Name of the network or organization, where known |
connection.usage.*.url | string or null | Its website, where known |
user_agent, client, os and device
For your own IP these describe the request's own User-Agent and Accept-Language headers; with a token, the ua= and al= parameters. Unknown parts are null.
| Field | Type | Meaning |
|---|---|---|
user_agent | string | The User-Agent string that was parsed |
client | object | The browser, app or library |
client.type | string or null | Kind of client, e.g. browser or library |
client.name | string or null | Its name, e.g. Chrome, Mobile Safari or curl |
client.family | string or null | The family it belongs to, e.g. Safari for Mobile Safari |
client.code | string or null | A short code for the client, e.g. CH for Chrome |
client.engine | string or null | The browser engine, e.g. Blink or WebKit |
client.url | string or null | Its website, where known |
client.version | object | Its version, whole and in parts |
client.version.string | string or null | The version as written, e.g. 8.7.1 |
client.version.major | string or null | First part of the version |
client.version.minor | string or null | Second part |
client.version.patch | string or null | Third part |
client.version.build | string or null | Build part, where present |
client.bot | object | Set when the User-Agent is a known bot |
client.bot.name | string or null | The bot's name |
client.bot.category | string or null | Kind of bot, e.g. Search bot |
client.bot.url | string or null | Its website |
client.bot.producer | object | Who runs it |
client.bot.producer.name | string or null | The company or project |
client.bot.producer.url | string or null | Its website |
client.languages | array of strings | Language tags from Accept-Language, in order, e.g. ["de-DE", "de", "en"]. Only when the header or al= is present |
os | object | The operating system |
os.name | string or null | e.g. Windows, iOS or Android |
os.family | string or null | The family it belongs to, where known |
os.code | string or null | A short code, e.g. AND for Android |
os.architecture | string or null | CPU architecture, where the User-Agent says |
os.version | object | Its version: string, major, minor, patch and build, as for client.version |
device | object | The device |
device.type | string or null | e.g. desktop or smartphone |
device.brand | string or null | The maker, e.g. Apple or Samsung |
device.model | string or null | The model, where known |
This page as Markdown: /docs/fields/index.md