Data sources
Where the facts come from and how to credit them.
The sources panel at the bottom of every report names each dataset that answered, when it was fetched and whether it came from cache. The API returns the same list on every lookup. GET /api/v1/sources lists the upstream sources on their own, with each one's capabilities.
The sources
| Source | What it supplies | Attribution |
|---|---|---|
| RDAP | Registration records from the responsible RIR | Registration data via RDAP bootstrap (rdap.org) from the responsible RIR |
| RIPEstat | Routing state and history, RPKI validation, registry history and transfers | Routing and registry history via RIPE NCC RIPEstat |
| Team Cymru | IP to ASN origin mapping, RIR and allocation date | Origin ASN, RIR and allocation date via the Team Cymru IP-to-ASN DNS service |
| PeeringDB | Self-declared operational data and exchange presence | Network self-declared operational data via PeeringDB |
| ipapi.is | Per address VPN, proxy, datacentre and abuser classification, and an operator level abuse rating | VPN, proxy, datacenter and abuser classification via ipapi.is |
| Scamalytics | Per address fraud risk scoring | IP fraud risk scoring via Scamalytics IP Fraud Risk API v3 |
| SubnetHistory active checking | Direct verification that an address is serving as a proxy, and when it stops | Our own measurement, not a third party feed |
The ipapi.is abuse rating describes an ASN or a company, so it feeds the operator level risk and not the per address score.
A source that did not answer leaves its fields n/a. n/a is not zero.
Sampling
A lookup samples addresses inside the queried block rather than sweeping it, and the report states how many were checked. Unsampled space is not clean space.
Caching
Upstream answers are cached server side, and repeat lookups are served from that cache. When an upstream is unreachable, the last known good answer is served and marked stale.
Republishing
Republished data must credit the underlying sources with the attribution strings above, which are the wording the upstream services ask for. The terms ask that the data is not presented as original measurement and that the archive is not bulk mirrored for resale.