Explore Our Data.​

Data You Can Trust — and Prove.

Identifies the network operator that owns or routes the IP address.

• asn — The Autonomous System Number identifying the network that owns or routes the IP.
• organization — The registered entity operating this network.
• description — A short label or trade name for the network provider.

Classifies the network environment (datacenter, mobile, residential, or mixed).

• type — The network environment: datacenter, mobile, or residential.
• category — The sub-classification within the infrastructure (e.g., hosting provider, ISP).
• provider — The specific network or company providing the connection.
• network_environment — Broader grouping describing the IP’s operational context.

The IP record under analysis, used for correlation and audit.

• address — The IP address currently being enriched or analyzed.
• hostname — The reverse DNS record, if available, associated with the IP.
• reverse_dns — Domain name returned when performing reverse DNS lookup.

Verified geographic context derived from network telemetry, not self-reported data.

• country — Two-letter country code where the IP is registered or observed.
• city — Closest urban area derived from network telemetry.
• region — Regional or state-level designation tied to the IP’s registration.
• timezone — Time zone associated with the location for correlation and logging.

Observed patterns of user or device activity associated with this IP.

• behaviors — Observed activity types, such as peer-to-peer, scraping, or proxy use.
• types — Device or client categories seen connecting from this IP (browser, mobile, automation).
• proxy_use — Indicates whether the IP has been observed using proxy infrastructure.
• count — Approximate number of unique clients or sessions observed behind this IP.

Measures how clustered or distributed activity is within this IP range.

• density — The intensity of observed connections from a small area or network segment.
• diversity — How varied the traffic is; high diversity can indicate shared or proxy infrastructure.
• skew — The balance between inbound and outbound activity for this IP or subnet.

Risk tags assigned from observed anonymization behavior, proxy chaining, or malicious activity.

• CALLBACK_PROXY — Indicates participation in a proxy callback network.
• GEO_MISMATCH — The observed traffic location doesn’t match registration or expected geography.
• MALWARE_INFRASTRUCTURE — Associated with malicious or compromised systems.
• ANONYMIZED_TRAFFIC — Known to route anonymized sessions (VPNs, proxies, Tor).
• RESIDENTIAL_PROXY — Traffic observed via residential IPs used for proxying.

Identifies services and protocols on the IP that indicate VPN, proxy, or anonymization use.

• OPENVPN — OpenVPN service detected; commonly used by VPN providers.
• SOCKS — SOCKS proxy protocol identified on this IP.
• SHADOWSOCKS — Encrypted SOCKS-based proxy service detected.
• TOR — TOR node detected; indicates anonymized network participation.
• HTTP_PROXY — Generic HTTP or HTTPS proxy service found on this host.

Describes VPN or proxy tunnels and their entry/exit nodes.

• operator — The known VPN or proxy provider operating the tunnel.
• entries — The ingress points or entry nodes into the anonymization service.
• exits — The egress nodes where traffic leaves the anonymization network.
• type — Tunnel protocol (e.g., L2TP, WireGuard, OpenVPN).