Understanding the report/Tags and labels
Tags and labels
The analyst vocabulary for labelling networks and address space.
Tags are the strongest claims SubnetHistory makes, so they are held to the highest standard: a tag on a network or a block was confirmed by a person, with evidence. The machine can propose, but people decide.
Confirmed and suggested
- Confirmed tags were applied by an analyst (or, in one narrow case, by a high confidence finding from our own active checks, which is an objective measurement). They appear prominently, and the worst severity among them drives the report's banner.
- Suggested tags are proposals from the sampling evidence, shown separately with their confidence and the rationale behind them. A suggestion an analyst has ruled on disappears: once a person has decided, the machine's opinion is redundant.
Severity
| Severity | Reading |
|---|---|
| 0 | Descriptive. Says what the network is, implies nothing bad. |
| 1 | A minor signal. Worth knowing, rarely decisive. |
| 2 | Caution. Should change how you treat the space. |
| 3 | Severe. The strongest labels the vocabulary has. |
The vocabulary
This list is generated live from the vocabulary the analyst console uses, so it is always what the site is actually applying rather than a copy that can fall behind. The raw set, including each tag's slug and colour, is available from GET /api/v1/tags.
Anonymity and evasion
| Tag | Severity | Meaning |
|---|---|---|
| Mobile proxy | 3 | Mobile/4G/5G address space resold as rotating proxy exits. |
| Residential proxy | 3 | Address space monetised as "residential" exit nodes, often via SDK-bundled consumer devices. |
| Proxy provider | 2 | Network selling forward/backconnect proxy access. |
| Tor exit | 2 | Hosts published Tor exit relays. |
| VPN provider | 2 | Network operated by a commercial VPN service. |
| Proxy exits | 1 | Addresses here answered as working proxies when we last checked. This describes what the addresses did, not who runs or sells them. |
Ownership and registration
| Tag | Severity | Meaning |
|---|---|---|
| Fabricated registration | 3 | Registration data appears invented: non-existent company, recycled address, unreachable contacts. |
| Hijacked space | 3 | Address space announced without the legitimate holder's authorisation. |
| Shell ASN | 3 | ASN registered to an entity with no genuine network operations, created to obtain address space or clean reputation. |
| Frequent origin change | 2 | Prefix rotates between origin ASNs far more often than normal operations explain. |
| Revived dormant space | 2 | Long-unannounced legacy space suddenly routed again, frequently by an unrelated party. |
| Address leasing | 1 | Holder leases address space to third parties rather than using it. |
Infrastructure type
| Tag | Severity | Meaning |
|---|---|---|
| Business ISP | 0 | Enterprise access / transit for business customers. |
| CDN | 0 | Content delivery network. |
| Cloud provider | 0 | Public cloud compute network. |
| Education / research | 0 | University, school, or research network. |
| Eyeball ISP | 0 | Residential/consumer access network. |
| Government | 0 | Government or public sector network. |
| Hosting / datacenter | 0 | Datacenter or dedicated/VPS hosting network. |
| Infrastructure | 0 | General network infrastructure, where no more specific type applies. |
| Mobile carrier | 0 | Mobile network operator address space. |
Abuse
| Tag | Severity | Meaning |
|---|---|---|
| Bulletproof hosting | 3 | Provider that demonstrably ignores abuse reports as a selling point. |
| Fraud traffic | 3 | Associated with carding, account takeover, or ad fraud traffic. |
| Malware C2 | 3 | Hosted command-and-control infrastructure. |
| Spam source | 2 | Sustained outbound spam observed or listed. |
| Scanning | 1 | Sustained internet-wide scanning activity. |
Quality and operations
| Tag | Severity | Meaning |
|---|---|---|
| Unreachable abuse contact | 2 | Registered abuse contact bounces or is never answered. |
| No RPKI | 1 | Announces space without valid ROAs. |
| Stale registration | 1 | Registration data has not been maintained and no longer reflects reality. |
| Verified clean | 0 | Reviewed by an analyst and found to be a legitimate operator. |
Disputes
If you operate a network and believe a tag is wrong, write to [email protected] with the resource. An analyst reviews every dispute, and a label revoked by a person stays revoked: an automatic process is not allowed to quietly revive it.
Last updated 2026-08-09subnethistory.com