DEV Community: IPRout Team

The Easiest Way to Look Up GeoIP in Laravel

IPRout Team — Mon, 03 Aug 2026 12:15:17 +0000

IP location data is useful when your Laravel application needs a sensible regional default, timezone context, analytics enrichment, or an additional risk signal. The integration does not need a large package or a complicated SDK.

With IPRout, you can send an IPv4 or IPv6 address to a simple HTTP endpoint and receive GeoIP and network information as JSON. In this tutorial, we will get a seven-day developer key, keep it outside the codebase, and build a reusable Laravel service around the API.

GeoIP is an estimate derived from an IP address. It is not GPS data, proof of identity, or a user's exact physical location. Give users a way to correct important location-dependent choices.

What we are building

We will add an endpoint to a Laravel application that accepts an IP address:

GET /geoip?ip=8.8.8.8

The application will validate the input, ask IPRout for the IP context, and return a response containing fields such as:

Country, region, and city
Timezone
Latitude and longitude
Autonomous system number (ASN)
Network organisation

No third-party PHP package is required. Laravel's built-in HTTP client handles the request.

Get a seven-day IPRout developer key

IPRout provides a developer key for evaluating the API without creating an account. At the time of writing, the key:

Is valid for seven days
Includes 1,000 requests in total
Does not require a login

To generate one:

Open the IPRout developer-key page.
Select Generate API Key.
Copy the generated key and store it somewhere secure.

Treat the key like a password. Do not publish it in a DEV post, commit it to Git, expose it in browser-side JavaScript, or write it to application logs.

The developer-key allowance and terms may change, so check the page for the current details before publishing or following this tutorial.

Configure Laravel

Add the key and API base URL to your project's .env file:

IPROUT_API_KEY=replace_with_your_key
IPROUT_API_BASE_URL=https://api.iprout.com

Next, add an IPRout entry to config/services.php:

'iprout' => [
    'key' => env('IPROUT_API_KEY'),
    'base_url' => env('IPROUT_API_BASE_URL', 'https://api.iprout.com'),
],

Using Laravel's configuration layer keeps calls to env() out of application code and works correctly when configuration is cached in production.

If you already cached your configuration, refresh it after changing .env:

php artisan config:clear

Create a reusable IPRout service

Create app/Services/IPRout.php:

<?php

namespace App\Services;

use Illuminate\Http\Client\Response;
use Illuminate\Support\Facades\Http;
use InvalidArgumentException;
use RuntimeException;

class IPRout
{
    /**
     * Look up GeoIP and ASN information for an IPv4 or IPv6 address.
     *
     * @return array<string, mixed>
     */
    public function lookup(string $ip): array
    {
        if (filter_var($ip, FILTER_VALIDATE_IP) === false) {
            throw new InvalidArgumentException('A valid IPv4 or IPv6 address is required.');
        }

        $apiKey = config('services.iprout.key');

        if (! is_string($apiKey) || $apiKey === '') {
            throw new RuntimeException('The IPRout API key is not configured.');
        }

        $response = Http::baseUrl(config('services.iprout.base_url'))
            ->withToken($apiKey)
            ->acceptJson()
            ->timeout(5)
            ->get('/ip/'.rawurlencode($ip));

        $this->ensureRequestSucceeded($response);

        return $response->json();
    }

    private function ensureRequestSucceeded(Response $response): void
    {
        if ($response->successful()) {
            return;
        }

        $message = match ($response->status()) {
            401 => 'The IPRout API key is missing or invalid.',
            422 => 'IPRout rejected the IP address as invalid.',
            429 => 'The IPRout request limit has been reached.',
            500 => 'IPRout encountered an internal server error.',
            default => 'The IPRout lookup failed with HTTP '.$response->status().'.',
        };

        throw new RuntimeException($message);
    }
}

The API also supports the X-API-Key header, but Laravel's withToken() method makes bearer authentication especially readable:

Authorization: Bearer YOUR_API_KEY

The five-second timeout prevents a slow external request from occupying an application worker indefinitely. Choose a production timeout and fallback based on your own request budget.

Add a controller

Generate a controller:

php artisan make:controller GeoIPController

Replace its contents with:

<?php

namespace App\Http\Controllers;

use App\Services\IPRout;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;

class GeoIPController extends Controller
{
    public function __invoke(Request $request, IPRout $iprout): JsonResponse
    {
        $validated = $request->validate([
            'ip' => ['required', 'ip'],
        ]);

        return response()->json(
            $iprout->lookup($validated['ip'])
        );
    }
}

Laravel's service container can construct the IPRout class automatically, so no manual binding is needed for this service.

Register the route

Add the route to routes/web.php:

use App\Http\Controllers\GeoIPController;
use Illuminate\Support\Facades\Route;

Route::get('/geoip', GeoIPController::class);

Start the local development server:

php artisan serve

Then make a lookup from another terminal:

curl "http://127.0.0.1:8000/geoip?ip=8.8.8.8"

A successful response follows this shape:

{
  "ip": "8.8.8.8",
  "country_code": "US",
  "country": "United States",
  "region": "California",
  "city": "Mountain View",
  "timezone": "America/Los_Angeles",
  "latitude": 37.4056,
  "longitude": -122.0775,
  "asn": 15169,
  "organization": "Google LLC"
}

IP allocation and GeoIP datasets change, so do not write tests that require a public IP to return one permanent city or coordinate.

Look up the caller IP instead

IPRout also provides GET /ip, which returns information for the IP address making the API request. That is different from looking up the end user's address from your Laravel request.

In many deployments, IPRout will see the outbound IP of your application server when you call GET /ip. If you need information about a visitor, obtain the visitor IP through Laravel and pass it to GET /ip/{ip}.

Be careful when your application runs behind a reverse proxy or load balancer. Only trust forwarded IP headers when Laravel is configured with the proxies you control. Otherwise, a client may be able to supply a false header value.

Handle failure without breaking the application

An external lookup should not become a single point of failure. Decide what your application will do when the lookup is unavailable:

Use a neutral default for optional personalisation.
Record an analytics event without the enrichment fields.
Ask the user to select their region or timezone.
Require another risk signal instead of making an automatic security decision.

The documented IPRout error statuses are:

Status	Meaning
`401`	Missing or invalid API key
`422`	Invalid IP address
`429`	Rate limited
`500`	Internal server error

Do not retry 401 or 422 responses without correcting the request. A limited retry with backoff may be appropriate for a transient server error, but retries must stay within your latency and request limits.

Production checklist

Before deploying the integration:

Keep IPROUT_API_KEY in your hosting platform's secret store.
Validate every supplied IP address.
Configure a short timeout and an application-specific fallback.
Avoid logging API keys or unnecessary raw IP addresses.
Review how long your application retains IP-derived data.
Cache repeated lookups only if that behaviour fits your data-freshness and privacy requirements.
Monitor 401, 422, 429, and server-error responses.
Let users correct important regional or timezone defaults.

Start your first Laravel GeoIP lookup

You now have a small Laravel integration with secure configuration, input validation, explicit error handling, and no additional package dependency.

Generate a seven-day IPRout developer key, then use the IPRout API documentation when you are ready to explore the complete request contract.

How to Detect VPNs, Data Centers, and Suspicious Traffic Using ASN Data

IPRout Team — Thu, 11 Jun 2026 09:17:29 +0000

How to Detect VPNs, Data Centers, and Suspicious Traffic Using ASN Data

Most developers think about IP intelligence in terms of geolocation.

Questions like:

Which country is this user from?
Which city are they connecting from?
What language should I show?

are common.

But after working with APIs, analytics, and security systems, I've found that ASN data is often more useful than country data.

If you're building authentication systems, fraud detection, analytics platforms, or API security controls, ASN information can provide context that geolocation alone cannot.

What Is an ASN?

ASN stands for Autonomous System Number.

Every major ISP, cloud provider, mobile carrier, and network operator on the internet is assigned one or more ASNs.

Examples include:

Google
Amazon AWS
Microsoft Azure
Cloudflare
Telstra
Comcast

Why ASN Data Matters

Imagine a user signs up from an IP address located in Australia.

Traditional GeoIP data might tell you the country and city.

But ASN data might tell you the traffic originates from Amazon AWS rather than a residential internet connection.

That additional context can be extremely valuable.

Detecting Data Center Traffic

Many bots, scrapers, and automated systems operate from cloud providers.

Common examples:

AWS
Azure
Google Cloud
DigitalOcean
Vultr
Oracle Cloud

If your application receives large volumes of registrations or API requests from these providers, ASN data can help identify patterns.

This doesn't automatically mean the traffic is malicious.

But it does provide another signal that can be combined with:

Rate limits
Device fingerprints
User behavior
Reputation systems

Detecting VPN Usage

Many VPN providers operate infrastructure from hosting providers and data centers.

While ASN data alone cannot definitively identify every VPN user, it can help detect traffic that originates from networks commonly associated with VPN infrastructure.

Fraud Prevention

ASN data is particularly useful during:

User registration
Account recovery
Login verification
Payment processing

ASN is not a final decision-maker.

It's another signal that helps build a risk profile.

Analytics and Reporting

ASN information can also improve visibility into your user base.

Questions you can answer include:

How much traffic comes from mobile carriers?
How much traffic comes from cloud providers?
Which ISPs are most common?
Which networks generate the most abuse reports?

Example Lookup

A simple ASN lookup can provide:

Geographic location
Network owner
ASN information

Final Thoughts

Country-level geolocation is useful.

ASN intelligence often provides the context that makes that geolocation meaningful.

If you're building authentication systems, fraud detection tools, analytics platforms, or API security controls, then ASN data is worth paying attention to.

Example lookups in this article were performed using IPRout, a developer-first GeoIP and ASN API currently in public beta.

Website: https://iprout.com

I Built a Developer-First GeoIP & ASN API Because Most Projects Don’t Need the Complexity

IPRout Team — Tue, 02 Jun 2026 07:49:33 +0000

Why I Built Yet Another GeoIP API

TL;DR: I built IPRout, a developer-first GeoIP and ASN API focused on simplicity, fast onboarding, and free developer access. I'm looking for feedback from other developers building products that rely on IP intelligence.

Most applications only need a few pieces of IP intelligence:

Country
ASN
ISP / Organization
Basic geolocation

Yet many solutions felt overly complex, expensive, or required account creation before you could even test them.

While integrating GeoIP services into several projects, a recurring pattern emerged: developers often needed only a small subset of data but were forced into much larger products and pricing structures.

That led to building IPRout, a developer-first GeoIP and ASN API focused on simplicity and fast onboarding.

The Problem

GeoIP data appears in more applications than most people realize.

Common use cases include:

Fraud prevention
User analytics
Content localization
Security monitoring
API protection
Compliance requirements

In many cases, developers simply need answers to a few straightforward questions:

Which country is this IP from?
Which organization owns this IP?
Which ASN is associated with this address?
Is the traffic coming from a residential ISP or a cloud provider?

For those scenarios, getting started should be simple.

What is IPRout?

IPRout is a GeoIP and ASN lookup API designed with developers in mind.

The goal was straightforward:

Fast API responses
Simple onboarding
Developer-friendly access
No unnecessary complexity

A lookup is as simple as:

curl https://api.iprout.com/ip/8.8.8.8

Example response:

{
  "ip": "8.8.8.8",
  "country": "US",
  "country_name": "United States",
  "asn": 15169,
  "organization": "Google LLC"
}

Free Developer Access

One thing that has always been frustrating as a developer is having to create an account, verify an email address, and sometimes even provide payment details before being able to test an API.

To reduce that friction, IPRout provides a:

7-Day Developer Key

No login required
CAPTCHA protected
1,000 requests over 7 days
Immediate access for testing

Free Account

10,000 requests per month
API key management
Usage dashboard

The goal is simple: let developers try the API properly before deciding whether it fits their project.

Common Use Cases

User Localization

Determine a visitor's country and adapt content or experiences accordingly.

Analytics

Understand where traffic originates and which networks your users connect from.

Security

Identify requests originating from cloud providers, hosting networks, or unexpected regions.

Fraud Prevention

Combine country and ASN information with existing risk signals during signups, authentication, and payment workflows.

API Access Controls

Restrict, allow, or monitor traffic based on geographic location or network ownership.

Built for Simplicity

There are already excellent IP intelligence providers available.

The goal of IPRout is not to replace every enterprise-grade platform.

The goal is to provide a straightforward API for developers who need reliable GeoIP and ASN data without unnecessary complexity.

Sometimes the best developer experience is simply making common things easy.

Looking for Feedback

IPRout is currently in public beta and I'd love feedback from fellow developers.

A few questions I'm particularly interested in:

What GeoIP fields do you actually use in production?
What information do you wish providers exposed more clearly?
What integrations would be useful?
What does a good developer experience look like for this type of API?

Every feature currently planned is being driven by developer feedback.

If you'd like to try it out or share feedback, I'd love to hear your thoughts.

Website: https://iprout.com

Happy building.