Data notes
Where the results come from, how often they are updated, and what we can and cannot guarantee.
Where the data comes from
The data comes from a number of paid commercial data sources, together with a few public threat lists and measurement networks.
What we can guarantee: any risk these sources know about goes into the result and the score. A finding from one source is never dropped because another source has no flag.
Using many sources does not deduct points twice or flag the same risk twice. A risk found by several sources at once is counted once; when sources confirm each other, the result only becomes more reliable.
How often it is updated
These are the main data sources and how often their data is updated. A single lookup does not necessarily use all of them.
| Source | Access | Licence | Used for | Data updated |
|---|---|---|---|---|
 | Held locally | Paid | Location, operator, proxy / VPN / Tor detection | Twice a week |
 | Held locally | Paid | Location, operator | Checked for updates daily |
 ip2region | Held locally | Paid | Location in mainland China | Monthly |
 | Held locally | Paid | Location, operator, proxy / VPN / Tor detection, risk score | Daily |
 IP2Proxy | Held locally | Paid | Proxy / VPN / Tor detection | Monthly |
 | Online API | Paid | Location, operator, proxy / VPN / Tor detection | Daily |
 | Online API | Paid | Location, proxy / VPN / Tor detection | Twice a month |
 | Online API | Paid | Location, operator | Daily |
 | Online API | Paid | Location, operator, proxy and hosting flags | Continuously |
 proxycheck.io | Online API | Paid | Proxy / VPN / Tor detection, risk score | Daily |
 AbuseIPDB | Online API | Paid | Abuse reports | Daily |
 Spur | Online API | Paid | Residential proxy and VPN exit detection | Daily |
 ipdata | Online API | Paid | Location, operator, proxy / VPN / Tor detection | Continuously |
 ipregistry | Online API | Paid | Location, operator, proxy / VPN / Tor detection | Continuously |
 | Online API | Paid | Fraud risk | Continuously |
 | Online API | Paid | Fraud risk | Continuously |
 | Online API | Paid | Open ports | Weekly |
 IPsum | Held locally | Combined threat lists | Daily | |
 Tor Project | Held locally | Tor exit nodes | Daily | |
 Feodo Tracker | Held locally | Botnet command servers | Daily | |
 CINS Army | Held locally | IPs that keep attacking | Daily | |
 Emerging Threats | Held locally | Compromised hosts | Daily | |
 SANS DShield | Held locally | Most-attacking ranges recently | Daily | |
 RPKI | Held locally | Route origin validation | Hourly | |
 | Online API | Malware and threat intelligence | Daily | |
 URLhaus | Online API | Records of hosted malicious URLs | Daily | |
 | Online API | DNS history | Continuously | |
 Spamhaus | Online API | Mail blocklist | Queried live | |
 SpamCop | Online API | Mail blocklist | Queried live | |
 Barracuda | Online API | Mail blocklist | Queried live | |
 UCEPROTECT | Online API | Mail blocklist | Queried live | |
| Abuseat CBL | Online API | Mail blocklist | Queried live | |
 blocklist.de | Online API | Mail blocklist | Queried live | |
 DroneBL | Online API | Mail blocklist | Queried live | |
| S5H | Online API | Mail blocklist | Queried live | |
 GBUdb | Online API | Mail blocklist | Queried live | |
 Project Honey Pot | Online API | Spam and malicious visits seen by honeypots | Daily | |
 StopForumSpam | Online API | Spam sign-up records | Daily | |
 AlienVault OTX | Online API | DNS history | Continuously | |
 Regional Internet Registries | Online API | Registration and transfer records | Synced regularly | |
 Geofeed | Online API | Locations published by operators | Synced regularly | |
 | Online API | ASN and peering data | Synced regularly | |
 | Online API | Network traffic mix | Synced regularly | |
 Globalping | Online API | Probe measurements to verify location | Measured at each verification | |
 RIPE Atlas | Online API | Probe measurements to verify location | Measured at each verification |
How accurate the location is
Location is accurate to city level, but not guaranteed to be 100% correct. An IP's location is inferred from registry data, routing and measurements, and the same IP can land in different cities in different sources.
This is how we correct locations:
- Several location sources are shown side by side, so disagreements are visible.
- Probes around the world measure latency to check where the IP really is.
- On the result page, click "Correct" next to the location to pick the accurate source or enter the right place. It is updated once verified.
What the score means
The score is an overall judgement of known risks. A score above 95 means the sources we use found no clear risk. It does not mean the IP is free of every risk.
Abuse that has only just started, proxies no source has listed yet, and each platform's own risk rules may all be outside the score. Use it to compare and filter IPs, not as a guarantee that a platform will accept one.
If something looks wrong
For a wrong location, click "Correct" on the result page. For anything else, tell us through the feedback page.
Send feedback