Download websites that use ipify

About ipify

Not every technology on a website was bought. ipify is a free public API that answers exactly one question, which is what the caller's public IP address is, and it returns the answer as plain text or JSON with no key, no account and no contract involved. A developer who needed that answer in a hurry pasted a few lines of JavaScript into a page, and the call has been firing on every page load ever since.

The Geolocation classification is honest about what that is. Nothing about the presence of this endpoint tells you about a company's budget, its purchasing behaviour or the maturity of its stack, because there was no purchase to reason about. What it does tell you is architectural, and for some kinds of research architecture is the more interesting fact.

Every page that calls a public address lookup is making a request to a server nobody at that site controls, at load time, from the visitor's own browser. The client library is MIT licensed and the code is trivial to read, but the service behind it is a single external dependency sitting in the critical path of whatever feature depends on it, whether that is a geolocation redirect, a fraud check, a form prefill or a logging call. For a security or privacy review, an outbound request that carries a visitor's address to an unaffiliated endpoint is a finding worth recording, however benign the operator happens to be.

The pattern has been circulating since 2014, long enough to be copied into tutorials, code samples and internal boilerplate, which is how it spreads. Installations cluster around whatever framework or snippet introduced them rather than around an industry, a country or a company size, and a detection therefore says more about where the developer learned than about the business behind the site.

As of October 2026 we detect it on 1,000 sites. Looking up a single domain would only confirm that one site calls the endpoint. A downloadable list is far more useful in aggregate, either as a study of how a free utility quietly becomes infrastructure without anyone deciding that it should, or as an input to third party risk work, since these are sites routing a piece of visitor data through the same external service and liable to break in the same way on the same day if that service ever stops answering.