Data sources
Where the facts come from and how to credit them.
The sources panel at the bottom of every report names each dataset that answered, when it was fetched and whether it came from cache. The API returns the same list on every lookup. GET /api/v1/sources lists the upstream sources on their own, with each one's capabilities.
The sources
| Source | What it supplies | Attribution |
|---|---|---|
| RDAP | Registration records from the responsible RIR | Registration data via RDAP bootstrap (rdap.org) from the responsible RIR |
| RIPEstat | Routing state and history, RPKI validation, registry history and transfers | Routing and registry history via RIPE NCC RIPEstat |
| Team Cymru | IP to ASN origin mapping, RIR and allocation date | Origin ASN, RIR and allocation date via the Team Cymru IP-to-ASN DNS service |
| PeeringDB | Self-declared operational data and exchange presence | Network self-declared operational data via PeeringDB |
| ipapi.is | Per address VPN, proxy, datacentre and abuser classification, and an operator level abuse rating | VPN, proxy, datacenter and abuser classification via ipapi.is |
| Scamalytics | Per address fraud risk scoring | IP fraud risk scoring via Scamalytics IP Fraud Risk API v3 |
| IP2Proxy | Per address VPN, proxy, residential proxy, Tor and datacentre classification, the named service where there is one, and a fraud score | VPN, proxy, residential proxy and datacenter classification, with a fraud score, from IP2Proxy by IP2Location |
| SubnetHistory active checking | Direct verification that an address is serving as a proxy, and when it stops | Our own measurement, not a third party feed |
The ipapi.is abuse rating describes an ASN or a company, so it feeds the operator level risk and not the per address score.
IP2Proxy is read from a copy of its database held on our servers, so a lookup sends nothing to IP2Location. Its answers carry the release they came from, and an address is read again when a newer release is installed. Scamalytics includes IP2Proxy's verdict among its own inputs, so the two agreeing is not counted as independent corroboration.
A source that did not answer leaves its fields n/a. n/a is not zero.
Sampling
A lookup samples addresses inside the queried block rather than sweeping it, and the report states how many were checked. Unsampled space is not clean space.
Caching
Upstream answers are cached server side, and repeat lookups are served from that cache. When an upstream is unreachable, the last known good answer is served and marked stale.
Republishing
Republished data must credit the underlying sources with the attribution strings above, which are the wording the upstream services ask for. The terms ask that the data is not presented as original measurement and that the archive is not bulk mirrored for resale.