A zero-dependency Cloudflare Worker that turns every visitor request into a rich IP intelligence payload. Deploy once at the edge and get instant geolocation, network info, VPN/proxy/Tor detection, AI-scraper identification, bot scoring, and User-Agent parsing — with per-IP rate limiting and HMAC-SHA256 response signing built in.
- Geolocation — Country, region, city, postal code, coordinates, continent, EU status, timezone
- Network intelligence — ASN, ISP name, Cloudflare colo, TCP RTT
- VPN / Proxy / Tor detection — Keyword + ASN-based classification across 30+ VPN providers, residential proxy networks, and Tor exit nodes
- AI scraper detection — Identifies traffic from known AI-crawler ASNs (GPTBot, Grok/xAI, ByteSpider, ClaudeBot, etc.)
- Behavioral heuristics — Catches rotating-ASN headless scrapers via TCP RTT analysis, OS/browser age mismatch, missing client hints, and TLS fingerprint anomalies
- Bot detection — Cloudflare Bot Management score + UA-based identification of 40+ known bots (search, social, AI, SEO, tools)
- User-Agent parsing — Browser, OS, engine, and device type extraction (zero-dependency)
- Risk scoring — Multi-layered 0–100 risk score with flags and severity levels
- Per-IP rate limiting — KV-backed fixed-window rate limiter (configurable)
- HMAC-SHA256 signing — Optional response integrity verification
- Hardened headers — HSTS, CSP, X-Frame-Options, CORP, Permissions-Policy out of the box
| Endpoint | Description |
|---|---|
/ |
API index — lists all available endpoints |
/ip |
Basic IP, country, region, city, postal code, timezone |
/geo |
Full geolocation with coordinates, continent, EU status |
/network |
ASN, ISP, datacenter colo, TCP RTT |
/risk |
VPN/proxy/Tor/datacenter/AI-scraper detection & risk score |
/bot |
Bot detection (CF bot-management score + UA heuristics) |
/ua |
Parsed User-Agent (browser, OS, engine, device type) |
/headers |
Client hints, Accept-Language, Sec-Fetch-*, DNT, referer |
/tls |
TLS version, cipher, HTTP protocol, JA3/JA4 fingerprint |
/all |
Complete combined response (every field) |
/learn |
Same as / — lists all endpoints |
npx wrangler deploy ip-intelligence.jscurl https://your-worker.your-subdomain.workers.dev/ip{
"status": "success",
"ip": "203.0.113.42",
"ipVersion": "ipv4",
"isPrivate": false,
"countryCode": "US",
"country": "United States",
"regionName": "California",
"regionCode": "CA",
"city": "San Francisco",
"postalCode": "94107",
"timezone": "America/Los_Angeles"
}| Variable | Required | Description |
|---|---|---|
SIGNING_SECRET |
No | HMAC-SHA256 secret — when set, every response includes X-Signature header |
| Binding | Required | Description |
|---|---|---|
RATE_LIMIT_KV |
No | KV namespace for per-IP rate limiting. If unbound, rate limiting is skipped. |
Add to your wrangler.toml:
name = "ip-intelligence"
main = "ip-intelligence.js"
compatibility_date = "2024-01-01"
[vars]
# SIGNING_SECRET = "your-secret-here"
# [[kv_namespaces]]
# binding = "RATE_LIMIT_KV"
# id = "your-kv-namespace-id"Default: 10 requests per IP per 60-second window. Returns 429 with Retry-After header when exceeded. Adjust in the rateLimit() call inside the main handler.
The /risk and /all endpoints return a multi-layered risk assessment:
| Layer | Signal | Score Contribution |
|---|---|---|
| ISP keywords | Known VPN/proxy/datacenter provider names | 40–60 |
| ASN lists | Datacenter & AI-crawler autonomous systems | 30–35 |
| Obfuscated ISP | Generic ISP names hiding the true operator | 15–25 |
| Threat score | Cloudflare's threat intelligence | up to 40 |
| Timezone mismatch | IP country ≠ reported timezone | 15 |
| Bot signals | Low bot-management score or UA-detected bot | 20 |
| Tor exit | Org name matches Tor exit patterns | 70 |
| Behavioral heuristics | RTT anomaly, spoofed UA, missing client hints | 20–35 |
Risk levels: low (0–39) · medium (40–69) · high (70–100)