Methodology guide
Understand IP sources and provider risk labels
Enter a single IPv4 or IPv6 address. Private, loopback, link-local and reserved addresses receive local classification instead of being sent to public geolocation providers. A static detail URL keeps its original query object.
Enter a single IPv4 or IPv6 address. Private, loopback, link-local and reserved addresses receive local classification instead of being sent to public geolocation providers. A static detail URL keeps its original query object.
Table of contents
Inspect the queried object
Enter a single IPv4 or IPv6 address. Private, loopback, link-local and reserved addresses receive local classification instead of being sent to public geolocation providers. A static detail URL keeps its original query object.
Separate the facts
ASN and organization describe network ownership. An IP location is a database estimate. Registration country is not the geographic coverage of the network. VPN or hosting labels do not establish malicious behavior.
Read the evidence
A provider risk score is a provider observation on its own scale. Missing scores are unknown, including when the source supplied location successfully. A valid score of zero is preserved. Inspect fetchedAt, cacheStatus and refreshFailed to distinguish old evidence from a fresh result.
Recheck or correct
If a source appears wrong, preserve the queried IP, provider name and observation time. Retry later or consult that provider correction process. Never compare different providers as though they shared a calibrated score.