/api/v1/vikitron/ip-lookup

Accepted formats:

• IPv4 dot-decimal, e.g. 1.1.1.1 (4 octets, 0–255, no leading zeros).
• IPv6 as defined by RFC 4291 — full 2001:0db8:0000:0000:0000:0000:0000:0001, zero-compressed 2001:db8::1, IPv4-mapped ::ffff:1.2.3.4, or scoped literals. Both upper- and lower-case hex are accepted.

Server-side canonicalization (ipNormalize in core/src/lib/network/ipNormalize.ts):

• Valid IPv4 is passed through verbatim.
• Valid IPv6 is lowercased (RFC 5952 §4.3).
• IPv4-mapped IPv6 ::ffff:X.X.X.X is unwrapped to plain IPv4 (RFC 4291 §2.5.5.2) so 1.2.3.4 and ::ffff:1.2.3.4 share one brj__geo_ip row.
• Loopback aliases (::1, 0.0.0.0, localhost, empty string) collapse to 127.0.0.1.
• Junk values that fail both IPv4 and IPv6 validation are silently rejected and replaced with 127.0.0.1 (loopback).

On the wire: every response returns the canonicalized form — clients can safely rely on lowercase IPv6 and the plain-IPv4 unwrap when de-duping or joining. Server-originated writers (activity log, session log, ban list) resolve the visitor IP via resolveClientIp / resolveClientIpOrNull — always native IPv6 on Vercel Edge (there is no auto-mapping to ::ffff:X.X.X.X).

Enrichment: the system resolves reverse DNS, geolocation, ASN, mobile/proxy/hosting/Tor flags via our VikiTron GEO/IP resolver for both address families. Learn more

Reverse DNS hostname.

IANA timezone identifier.

Human-readable timezone name.

GMT offset string.

Autonomous System number.

AS name.

AS organization.

City name.

Country code.

Region or state within the country.

Postal/ZIP code.

Latitude coordinate.

Longitude coordinate.

Internet Service Provider name.

IP block owner organization.

Whether the IP belongs to a mobile network.

Whether the IP is a known proxy/VPN.

Whether the IP belongs to a hosting/data center provider.

Whether the IP is a known Tor exit node.

Last known ICMP echo reachability. Omitted when the address has not been probed yet.

Whether the IP is CURRENTLY flagged in the platform aggregate abuse database. True when at least one external security feed has reported the address within the last 90 days.

When the IP was first reported by any feed. Set even after the row is aged out (abuse=false) to preserve the historical record. Omitted when the address has never been reported.

When the IP was most recently reported by any feed. Combined with abuse=false this indicates a previously flagged address that has since aged out.

How many distinct external feeds have ever reported this IP. Historical count — bits are OR-only and never cleared per feed.