How a lookup works
What a response contains, where the data comes from and how fresh it is.
One address, one complete answer
Every lookup returns the full record for the address: location, the network that routes it, the registry record, network evidence such as reverse DNS, anonymizer detection, threat flags and a fraud score. Every plan gets every field, so the Free plan sees exactly what Business sees.
Known and new addresses
Most addresses are already in our database, which is rebuilt every day. Those lookups are read from memory and answer in about a millisecond.
If an address is new to us, we classify it live before answering. That takes up to about 2.5 seconds, and the result is saved, so the next lookup is fast.
How fresh the data is
| Data | Refreshed |
|---|---|
| Threat feeds | Daily |
| Crawler IP ranges (Googlebot, GPTBot, ClaudeBot and others) | Daily |
| VPN and proxy probes | Every 2 days |
| BGP routing and ASN data | Every 3 days |
| WHOIS records and cloud provider ranges | Weekly |
The lookup database is rebuilt at 00:00 UTC and is live by 04:00 UTC, so a change can take up to about a day to show.
The fraud score
scoring.fraud_score runs from 0 to 100 and is built from many weighted signals. Some signals add risk, like a known VPN server or a blocklisted datacenter address. Others lower it, like a residential ISP or a verified crawler. scoring.detection_methods lists exactly which signals fired, so you can see why an address got its score. See scoring.
What it can't tell you
- An IP address is not a person. Many people can share one address, especially on mobile networks.
- Location is approximate. Country is the most reliable part; city can be off, and relays and VPNs show the location of the server, not the user.
- "Not detected" is not the same as "clean". We can only flag what we've observed.