0–100
How scoring works
The score is the sum of weights that match the address, capped at 100. The default response does not hide a machine-learning model.
Check order
Bogon and reserved ranges, Tor exits, datacenter ranges, published VPN relays, public proxies, then blocklists. ASN data (DB-IP lite) and the Vietnamese network table come next. A Vietnamese ASN that is residential or mobile and also sits inside a datacenter range is marked a residential-proxy suspect.
Default weights
Tor 70, bogon 60, blocklist 50, residential-proxy suspect 45, VPN 40, datacenter 40, proxy 35. Each reasons[] entry records the weight that was added. If nothing matches, one reason is returned with weight 0 and the text “No risk factors detected”.
Bands
0–19 minimal, 20–39 low, 40–59 medium, 60–79 high, 80–100 critical.
What the score does not say
It does not prove identity, measure intent, or replace a bank’s or a marketplace’s own decision. A city is inferred from the network block. Hosting only means the address belongs to known server infrastructure.
When data is missing
If one feed fails, the others still run. data_freshness marks a source missing. A result computed before the ASN file exists is not cached, and the engine reloads when the file appears or changes.