Censys vs IPLogs

Censys grew out of the University of Michigan's ZMap internet-scanning research and now re-scans the full public IPv4 space multiple times a day, fingerprinting open ports, services, and TLS certificates. Its Search API exposes that host and certificate-transparency dataset for asset discovery, exposure monitoring, and threat hunting, and underpins Censys's own attack-surface-management product. Access is account-scoped through an API key, with a limited free community tier and metered paid plans for higher query volume.

IPLogs scores an IP address's likelihood of being a VPN, proxy, Tor exit node, or datacenter host by combining 25+ signals -- ASN/PeeringDB classification, TCP/IP and TLS fingerprinting, RTT timing, and active probing -- into a single verdict and confidence score. A single keyless POST to /v1/check (optionally enriched with client-side signals like user-agent, timezone, and WebRTC IP) returns the verdict, a 0-1 risk score, and the matched signals with their weights, run by DigitalD.tech. There's no signup and no enforced rate limit today -- the public endpoint is explicitly fair-use, with dedicated deployments available on request for high-volume callers.