How it works

How a lookup is answered

Look up an address and you get back where it is, who runs it, and whether anything is hiding behind it. Here is how each of those answers is reached, and how far we will go in stating them.

Longest prefix wins

An address is not in one list. It sits inside a registry allocation, inside a routed prefix, inside a geolocation block, and possibly inside a published cloud range and a proxy listing as well. Each of those blocks is a different size, and the most specific one is the one that describes the address best. Every lookup here resolves each question independently and takes the narrowest block that contains the address, which is the longest route.

Evidence is graded, not asserted

A flag that says only yes or no hides the difference between an operator publishing an address as its own exit and a wide block somebody once associated with proxy use. Those are not the same claim, and treating them alike is how commercial tools end up flagging ordinary broadband subscribers.

Every anonymiser signal carries a grade set by two things together: where the listing came from, and how much address space it covers. A narrow listing from the operator itself reads as confirmed. An independent list naming a block reads as listed. A wide block, or an inference from the network an address sits on, reads as inferred and is worded so a reader can see it is an inference. The grade changes the score, the wording, and what the page is willing to state.

Two scores, deliberately kept apart

One number asks whether this address hides where its user is. The other asks whether this address space has been reported. They are different questions with different answers, and averaging them is useless for both. Somebody on a corporate VPN scores high on concealment and nothing on abuse. Hijacked space scores high on abuse whether or not anyone is hiding behind it.

Each score ships with the signals that produced it. A number you cannot take apart is a verdict, and this application reports evidence.

Physical location, and registration, as separate answers

Where address space is used and where its holder is registered are different facts. They agree for most of the internet and diverge sharply for VPNs, content networks and multinational hosting. Both are reported, labelled as what they are, and a caveat is attached to the field when they disagree.

Your lookups stay here

When you look up an address, we do not go and ask anybody else. The answer is already on our own servers, so the addresses you search for are never passed on to another company.