Know who is behind every IP address.
For any IPv4 or IPv6 address, Bafir returns the organisation, ASN, country and network type in milliseconds – telling a real user on home or mobile internet apart from a bot, a VPN or a rented server.
Use cases
Every service sees the IP address. Few know what it means.
The network type reveals the difference between a real customer and automated traffic – before the order, click or login goes through.
E-commerce and payments
Flag risky orders: a customer on home or mobile internet is normal, an order from a rented server or through Tor is not.
Advertising and analytics
Separate clicks from data centres, search crawlers and AI bots, and see which companies and institutions visit your site.
Security and IT
Enrich logs, SIEM alerts and firewall rules with network ownership data – instead of manual whois lookups one address at a time.
What you get
More than geolocation
One request returns everything you need to decide – with a known source for every field.
Network type
Fixed or mobile operator, data centre, CDN, education, government, military, company – standard labels with a risk estimate.
ISP · MOB · DCH · CDN · EDU…Tor and VPN
Tor exit nodes are refreshed hourly and VPN provider servers daily. Such an address is marked high risk.
anonimizator: tor | vpnCrawlers and AI bots
Googlebot, Bingbot, Applebot, GPTBot, PerplexityBot and CCBot are recognised from official address lists – not from a User-Agent that is easy to fake.
SES · AICCloud providers
Official ranges from AWS, Google Cloud, Azure, Oracle, DigitalOcean, Linode, Cloudflare and Fastly take precedence over registry data.
izvor_tipa: pruzateljWhois chain and leased space
Range owner, intermediaries and end user – flagged when the addresses are rented through an IPv4 leasing marketplace.
iznajmljeno: trueBusiness customers
Spots companies that an operator has assigned their own address block – useful for B2B analytics and visitor identification.
poslovni_korisnik: trueCoverage
Ranges by network type
ISPFixed broadband
6,273,867
ISP/MOBFixed and mobile operator
2,446,490
DCHData centre / hosting
1,029,909
UNKNot yet classified
301,262
EDUEducation and research
148,522
GOVGovernment
66,519
COMVerified company
27,805
MOBMobile operator
12,907
ORGNon-profits
10,287
MILMilitary
4,894
CDNCDN
3,548
SESSearch engine crawlers
14
As of 19 Oct 2026, 03:14 UTC · total 10,328,639 ranges
API
One HTTP request. A JSON response.
Integration takes minutes – no SDK, no database downloads.
- IPv4 and IPv6, same response shape
- Response in Croatian or English (
lang=en) - Rate limit and usage headers (
X-RateLimit-*) - CORS enabled – works straight from the browser
- Keyless demo: 60 requests per minute, 1000 per day
curl -H "X-API-Key: bfr_…" \ "https://bafir.link/api.php?ip=93.136.10.1" # Response (shortened) { "ip": "93.136.10.1", "organizacija": "Hrvatski Telekom d.d.", "asn": 5391, "drzava": { "kod": "HR", "naziv": "Croatia" }, "tip": { "kod": "ISP", "naziv": "Fixed-line ISP", "procjena_rizika": "nizak" }, "anonimizator": null, "poslovni_korisnik": false, "trajanje_ms": 1.3 }
$ctx = stream_context_create(['http' => [ 'header' => "X-API-Key: bfr_…\r\n", ]]); $d = json_decode(file_get_contents( 'https://bafir.link/api.php?ip=' . urlencode($ip), false, $ctx ), true); if (in_array($d['tip']['procjena_rizika'] ?? '', ['visok', 'bot'])) { // e.g. require extra verification for the order }
const r = await fetch( `https://bafir.link/api.php?ip=${ip}&lang=en`, { headers: { 'X-API-Key': 'bfr_…' } } ); const d = await r.json(); if (d.anonimizator || d.tip?.kod === 'DCH') { // traffic from a VPN, Tor or a server }
import requests d = requests.get( "https://bafir.link/api.php", params={"ip": ip, "lang": "en"}, headers={"X-API-Key": "bfr_…"}, timeout=2, ).json() print(d["organizacija"], d["tip"]["kod"])
Plans
Start free, scale when you need to
Bafir is in its pilot phase: early users get free access in exchange for feedback. Paid plan pricing is being set together with pilot users.
Demo
- 60 requests / min
- 1.000 requests per day
- Full response data
Start
- 300 requests / min
- 250,000 requests per month
- Support in Croatian and English
Pro
- 1.200 requests / min
- 2,000,000 requests per month
- Downloadable database licence
FAQ
Frequently asked questions
How is Bafir different from MaxMind or IPinfo?
The focus is on network type – home broadband, mobile, data centre or VPN – because that says the most about risk. Data comes straight from primary registries and official lists, is refreshed every night, and every type comes with its source. Bafir is a European service with local-language support and pricing aimed at small and mid-sized companies.
How accurate is the classification?
We measure accuracy every week against cloud providers' official address lists and fix the errors we find. Ranges we cannot yet classify reliably are labelled UNK rather than guessed, and a web agent reduces their number every night. The risk estimate is indicative and works best as one signal among several in your decision.
Does Bafir collect personal data?
Bafir describes networks, not people: a response contains organisation and address range data from public registries, with no information about the person using the address. Queries are not used to build user profiles.
How fresh is the data?
The range database is rebuilt every night from the registries' daily exports. Tor exit nodes are refreshed hourly, VPN servers and cloud providers' official ranges daily.
Can I host the database myself?
Yes – for users who cannot send data to an external service, we offer an annual licence to download the database. Get in touch and we'll work out the details.
Try Bafir on your own traffic
We're looking for pilot users – online shops, agencies and IT teams. You get a free API key and a direct line to the developers.
Get in touch · [email protected]