Sources and methodology
How lookups, reports and network classifications are produced.
Geolocation and network identity
- Single-IP lookups
- The API reads Enterprise MMDB records for location, ASN and ISP fields.
- Directory reports
- Country, ASN and network profiles aggregate the Enterprise CSV. They describe exported records and their associations.
- Location estimates
- City and coordinates describe network context. They do not locate an individual person or device.
Enterprise data attribution
This database utilizes data provided by RouteViews (www.routeviews.org). Use of this data is subject to the CC BY 4.0 license. It contains RIPE RIS data from the RIPE NCC (https://www.ripe.net/ris), GeoNames data (CC BY 4.0, www.geonames.org), Royal Mail data © Royal Mail copyright and database right 2022 and 2026, OS data © Crown copyright and database right 2026, Office for National Statistics data licensed under the Open Government Licence v.3.0, Unicode CLDR data, data from the Cadastro Nacional da Pessoa Jurídica (CNPJ), Receita Federal do Brasil, licensed under Creative Commons Attribution, INSEE's Sirene database under the Licence Ouverte 2.0, the Finnish Patent and Registration Office's trade-register data under CC BY 4.0, and ANATEL's fixed-broadband access data under CC BY-ND 3.0. Contains data under the Norwegian licence for Open Government data (NLOD) distributed by Brønnøysundregistrene, which IPQuery has changed. Adapted from Statistics Canada, Forward Sortation Areas Cartographic Boundary File, 2021 Census; this does not constitute an endorsement by Statistics Canada of this product. Adapted from Statistics Canada, Dissemination Areas Cartographic Boundary File, and Population and dwelling counts by dissemination area. Adapted from Statistics Canada, National Address Register; this does not constitute an endorsement by Statistics Canada of this product. Contains information licensed under the Open Government Licence - Yukon. Mobile carrier names and codes contain data from Wikipedia (CC BY-SA 4.0) and the Android Open Source Project's carrier list (Apache License 2.0).
Registration and abuse contacts
- Network records
- Registration, company and contact fields come from the exported record. Missing fields are omitted. A company can differ from the ASN operator.
- Contact scope
- An IP report shows the contact associated with its matching record. ASN pages group contacts and link to example IPs; a contact need not cover the entire autonomous system.
- Matching record range
- Adjacent addresses with the same displayed facts. This derived coverage is separate from a published registered block or contact network.
A listed abuse contact is a reporting destination, not evidence of abusive activity. Contact details can change after collection.
Public network references
- Address-to-ASN reference
- IPtoASN by Frank Denis, under the Public Domain Dedication and License (PDDL 1.0). Collected ; 459,655 IPv4 and 119,798 IPv6 assigned intervals.
- Matching rules
- An IP or whole network must fit inside one source interval. Unassigned gaps do not inherit the previous ASN. Intervals are not BGP prefixes, registry ownership or geographic coverage. This reference does not change API responses, risk classifications or the Enterprise snapshot.
- Public DNS endpoints
- Provider-published facts reviewed . Only exact resolver addresses receive these service details; nearby addresses do not inherit them. A documented endpoint is not a live service-health measurement.
Classification rules
Each flag reports a separate match. A listed address does not prove that a specific request used a VPN, proxy or Tor.
- VPN
- Listed VPN range or reviewed VPN-operated ASN matches the address.
risk.is_vpn - Proxy
- Listed proxy IP, reviewed proxy-provider network or privacy relay exit range matches the address.
risk.is_proxy - Tor
- is_tor = true
risk.is_tor - Hosting
- is_hosting = true OR user_type = hosting
risk.is_datacenter - Mobile
- is_mobile = true OR connection_type = Cellular
risk.is_mobile
Tor and hosting may also match retained API overrides. Their website totals use the CSV fields. A datacenter classification alone does not set the VPN flag.
VPN and proxy directory totals describe their listed prefixes or public hosts. The API also checks reviewed VPN-operated ASNs and known proxy-provider or privacy relay ranges. A privacy relay match is not evidence of abuse.
Anycast, relay, satellite and operator categories are report-only CSV classifications. They are not additional public API fields.
Risk score adds fixed weights for active proxy, Tor, VPN and hosting flags. It is not a probability. A non-match is not a safety verdict.
Proxy data is attributed to proxio.io and Proxmint’s Free Proxy List, under CC BY 4.0.
Public proxy list versions
What the counts measure
- Data ranges
- Adjacent addresses with equal published CSV data. These are not necessarily BGP routes.
- Address coverage
- The number of addresses in non-overlapping ranges. Listed VPN coverage uses the union of its prefixes. IPv6 counts measure address space, not active devices.
- VPN entries
- Distinct listed CIDRs. ASN and country associations use each prefix’s first address.
- Proxy entries
- Unique listed IP hosts, deduplicated across ports, protocols and lists.
- Country associations
- Countries assigned to exported records, not a measure of the operator’s physical presence.
Rankings use matching entry counts unless labeled as address coverage. Tags can overlap, so their totals cannot be added into a combined host count.
Maps and flags
Country outlines use public-domain Natural Earth 1:110 million boundaries. Small territories may be omitted at this scale. A missing outline does not mean a country has no records.
Flags use the flag-icons SVG collection under the MIT license. They accompany country names and codes.
Browse country dataRelease scope
Reports and classifications use a fixed data release. They are not a live routing or proxy-membership feed.
Assignments, routing and membership can change after collection. Compare the records with request activity and other observations before assessing a host.