IPLocate
Analytics & DataTurn any IPv4 or IPv6 address into geolocation, network, and threat intelligence with IPLocate. Agents localize an experience and flag proxy or hosting traffic before it reaches a signup flow.
What This Integration Enables
IPLocate is the threat-detection member of this group. Every other field it returns, and it returns plenty, sits underneath a privacy object that names the risk precisely instead of collapsing it into one score. is_abuser covers addresses on an abuse blocklist and is_anonymous covers proxy, Tor, VPN and iCloud Relay, with is_bogon, is_hosting, is_icloud_relay, is_proxy, is_tor and is_vpn also exposed as separate booleans. That data set is refreshed multiple times per day. Alongside it sit a hosting object naming the provider, network range and even the service and region where the provider publishes them, a company object identifying the organisation behind a range for B2B visitor identification, an ASN record, and an abuse contact pulled from public Whois.
The reason those flags stay separate matters operationally. is_icloud_relay is on for millions of ordinary Apple customers who never opted into anything more sinister than a default privacy setting, while is_abuser means the address has been reported for abuse. Treating those two as the same signal is how a fraud rule starts rejecting paying customers. FlowRunner agents read the flags individually, act on the unambiguous ones, and route the rest to a person. IPLocate also offers granular actions that return only the slice you need, plus historical lookups that show what a network looked like on a past date, which is what compliance and legal review actually need after an incident.
Without FlowRunner
With FlowRunner
Use Case Scenarios
Signup screening that does not punish privacy
A self-serve product gets a wave of trial signups. For each one the agent calls Get Privacy And Threat Flags. Addresses flagged is_abuser or is_tor with a disposable email domain are held immediately. Addresses flagged only is_icloud_relay are provisioned normally, because that flag on its own describes an Apple default rather than a bad actor. Addresses flagged is_hosting get one more question asked of them with Get Hosting Details, since an EC2 range behind a consumer signup is a different story than a small managed host. The distinction is the whole value: three different flags, three different responses.
Identifying the company behind anonymous traffic
A marketing team wants to know which target accounts are reading the pricing page. The agent enriches the day's sessions with Get Company Details, which returns the organisation name, domain, country and type, and drops the ones typed as hosting or isp because those are infrastructure, not companies. The named organisations are matched against the target account list in HubSpot and posted to the sales channel with the pages viewed. Sessions that resolve to no company at all stay out of the report rather than being padded with a guess.
Reconstructing what a network looked like during an incident
A compliance review asks whether an address used during a disputed transaction last quarter was a data center at the time. Present-day data cannot answer that, because networks are reallocated. The agent calls Look Up Historical IP Data with the incident date and gets the record as IPLocate held it then, complete with the hosting and privacy state, and attaches it to the case file in Notion. The finding is dated evidence rather than a current lookup presented as history.
Human-in-Loop Highlight
The gate is the block. When the flags come back mixed, is_anonymous true but is_abuser false, hosting provider identified but the company object null, the agent has genuinely ambiguous evidence and rejecting the signup is a customer-visible action with no undo: the person does not come back and you never learn they were real. So the agent provisions nothing and rejects nothing. It holds the account in a pending state and posts the case to the trust and safety channel: "Signup for [email protected] held. is_anonymous true, is_icloud_relay true, is_abuser false, is_tor false, hosting null. Email domain registered 2019. Release, reject, or request verification?" A person decides, and the decision is recorded against the account. That is what human-in-the-loop means here: the agent runs the whole screen and hands over exactly the cases where the evidence points both ways.
Agent Capabilities
10 actionsIP Intelligence
4- Look Up IP Address Returns the complete IPLocate record for an IPv4 or IPv6 address: country, city, subdivision, continent, coordinates, time zone, postal code, currency and calling codes, anycast and satellite flags, plus the asn, privacy, hosting, company and abuse objects. Fields To Include trims the response to what the flow reads. Hosting and company objects are omitted when IPLocate has no data for the address.
- Look Up Calling IP Address Returns the full record for the address that made the request, without needing it in advance. Because the call originates from the FlowRunner runtime, the result describes the runtime's outbound address rather than an end user's. Use Look Up IP Address when you already hold the address to inspect.
- Look Up Historical IP Data Returns the record for an address as it stood on a specific past date, from IPLocate's historical data set. Used for fraud investigation, compliance auditing and legal review, where the question is what the network was at the time of the event rather than what it is now. Requires an IPLocate Enterprise plan.
- Batch Look Up IP Addresses Looks up many addresses in one request and returns an object keyed by each submitted address. Accepts up to 1,000 IPv4 or IPv6 addresses per call. Invalid addresses come back as inline error objects alongside the successful results, and each address consumes one API request. Requires a paid plan or purchased credits.
Threat Detection
1- Get Privacy And Threat Flags Returns only the privacy and threat flags for an address: is_abuser, is_anonymous, is_bogon, is_hosting, is_icloud_relay, is_proxy, is_tor and is_vpn. Refreshed multiple times per day. Used to gate signups, checkouts and logins with each flag treated on its own terms rather than collapsed into a single verdict.
Network Intelligence
4- Get ASN Details Returns only the Autonomous System record for an address: AS number, announced route, network name, organisation name and domain, organisation country, organisation type across business, hosting, government, education, isp or unknown, and the Regional Internet Registry that assigned it. Returns null where no ASN data exists.
- Get Hosting Details Returns only the hosting and datacenter record: provider name and domain, network range and, where published, the region code and service name such as EC2 in ap-northeast-2. Returns null when IPLocate has no detailed hosting data, in which case the is_hosting flag may still be true.
- Get Company Details Returns only the company record behind an address range: organisation name, domain, country and type. Used for B2B visitor identification and account-based marketing. The company type describes how the specific network is used and may differ from the ASN type. Returns null when no company is matched.
- Get Abuse Contact Returns only the abuse contact for an address from public Whois: responsible organisation, postal address, country, email, phone and the network range the contact covers. Used to report malicious traffic to the operator responsible for it. Returns null when no contact is published.
Utilities
1- Get Calling IP Address Returns just the public address that made the request, as JSON, from IPLocate's free current-IP endpoint. Needs no API key, is not rate limited and consumes no quota, so it is a cheap way to discover the FlowRunner runtime's outbound address before feeding it into a full lookup.
Frequently Asked Questions
What can FlowRunner do with IPLocate?
FlowRunner agents can run Look Up IP Address, Look Up Calling IP Address, and Look Up Historical IP Data in IPLocate, plus 7 more actions.
Does connecting IPLocate to FlowRunner require OAuth?
No. IPLocate connects to FlowRunner with an API key, no OAuth flow required.
Can IPLocate trigger a FlowRunner workflow automatically?
IPLocate doesn't currently expose triggers in FlowRunner. It connects as an action step inside workflows started by another trigger.
Start building with IPLocate
$100 in credits. No card required. Connect in minutes.