Verifiable IP purity checks
Scoring method
Weights, thresholds, sources and changelog are public. Every report carries a model version so the exact weights used can be looked up later.
Current model v1.0.0 · 2026-11-14
Signal weights
| Signal | Dimension | Points |
|---|---|---|
| Datacenter / hosting connection | Connection type | +45 |
| Residential proxy / relay | Connection type | +35 |
| Generic proxy / VPN egress | Connection type | +30 |
| Mobile network (mitigating) | Connection type | -5 |
| Tor exit | Anonymity network | +50 |
| VPN flag | Anonymity network | +25 |
| Open proxy flag | Anonymity network | +22 |
| Widespread abuse | Abuse reputation | +30 |
| Moderate abuse | Abuse reputation | +15 |
| Minor abuse | Abuse reputation | +5 |
| Fraud score 90+ | Composite intel | +40 |
| Fraud score 75 to 89 | Composite intel | +25 |
| Fraud score 50 to 74 | Composite intel | +12 |
| Recent / frequent abuse | Composite intel | +20 |
| Shared connection | Composite intel | +10 |
Within a dimension, multiple source hits count once at the highest tier. Different dimensions add up. Total is capped at 100.
Dimensions & coverage
| Dimension | Coverage weight |
|---|---|
| Connection type | 40% |
| Anonymity network | 25% |
| Abuse reputation | 20% |
| Composite intel | 15% |
Coverage & confidence
Coverage is the sum of weights for dimensions with valid evidence (absolute, not normalised). Unconfigured premium dimensions are excluded from the denominator, but the ceiling and an accuracy warning are shown. Confidence starts from coverage and is reduced by source disagreement, staleness and single-source dimensions. If coverage is below 0.60, confidence below 0.50, or a high-risk dimension has an unresolved conflict, no score is returned — only 'cannot decide'.
Evidence tiers
First-party (T0) = Cloudflare edge metadata and a build-time baked ASN list, always available and unspoofable. Public sources (T1) = keyless third-party intelligence for cross-checking. Bring-your-own (T2) = commercial or registered sources wired in through server-side environment variables.
Sources & terms
| Source | Tier | Used for | Terms / limits |
|---|---|---|---|
| Cloudflare edge request metadata | First-party | IP / ASN / owner / edge colo | Cloudflare first-party, client-unspoofable, zero outbound requests |
| Local ASN list (build-time baked) | First-party | Datacenter ASN / organisation matching | Build-time baked public list with a generatedAt stamp |
| IPQuery | Public source | Raw connection / anonymity boolean signals | Keyless HTTPS; raw signals only, its bundled score is discarded |
| ip-api (free HTTP tier) | Public source | proxy / hosting / mobile flags | Free tier is HTTP-only and non-commercial; cloud egress may be rejected |
| ipwho.is | Public source | Geolocation / ASN fallback | Keyless HTTPS; no risk flags |
| RIPE Stat | Public source | ASN holder / registry evidence | Open API; failure does not affect scoring |
| StopForumSpam | Public source | Report frequency (abuse layer) | Forum spam reports; not equivalent to AI vendor reputation |
| IPQualityScore | Bring-your-own | Fraud score / connection type / recent abuse | Bring-your-own key via server env; quota per vendor |
| AbuseIPDB | Bring-your-own | Abuse confidence and report count | Bring-your-own key; missing key is explicit, never treated as clean |
| ipapi.is | Bring-your-own | Datacenter / VPN / Tor / abuse flags | Full flags require a registered free key; unregistered source is skipped |
| IPHub | Bring-your-own | Connection class (reserved) | Unreachable from this environment; disabled in V1 |
Model changelog
v1.0.02026-11-14 — First public version: T0/T1/T2 evidence tiers, coverage and confidence gates, explicit conflicts, and a distinct insufficient state.
Scope & disclaimer
This tool provides an IP-dimension risk assessment and is not a guarantee. Vendor risk systems include behavioural signals; the actual outcome is determined by the vendor. Accuracy of external data is the responsibility of each provider.