2026-09-05

IP intelligence round three, from verified crawlers to your own abuse reports

Crawler verification, registry facts, discovered geofeeds with a location confidence, privacy regimes, an abuse feedback loop, monitored IP lists with blocklist alerts, and opt-in RDAP details and reverse DNS.

is_crawler, crawler and crawler_kind name the search, AI and SEO crawlers from the ranges their operators publish for verification: Googlebot and Google's special crawlers and fetchers, Bingbot, GPTBot, ChatGPT-User, OAI-SearchBot, PerplexityBot, Perplexity-User, DuckDuckBot and AhrefsBot, synced daily. A crawler carries no risk weight and, like relay egress, never the datacenter weight.
registry, registry_country and allocated_at come from the RIR delegated statistics that were already synced: which registry allocated the block, the country it recorded and when. A block allocated weeks ago, or a registry country that disagrees with the geolocation, is worth a second look; neither is weighted.
City answers improve from every RFC 8805 geofeed discovered across the five registries, refreshed weekly (lookup:sync-geofeeds), and location_confidence says how far to trust a city: high when the operator declared it, otherwise graded from the weekly accuracy report's agreement for that country.
is_eea and privacy_regime settle consent decisions: the comprehensive privacy law where the address is, by region first (California ccpa, Quebec law25) and otherwise by country (gdpr across the EU and EEA, uk_gdpr, lgpd, pipeda, appi, pipl, popia, …); null when none is known.
POST /api/v1/ip/feedback records what an address turned out to be (abuse, fraud, bot, chargeback), free, stored only as a salted hash for 90 days. Your own reports score your own later lookups of the address (reported_abuse, +60); three or more accounts reporting an address make reported_abuse_widely (+40) for everyone. GET /api/v1/ip/feedback/summary counts your reports.
Monitored IP lists: register up to 500 of your own egress, mail-server or office addresses under /api/v1/ip/monitors, choose a daily, weekly or monthly cadence, and get an email the day one of them lands on Spamhaus DROP or a botnet list, becomes a Tor exit or scores high.
Two opt-in network extras on the single-address endpoints: network_details: true adds the registry's RDAP record (name, organisation, range, dates) from the same cached lookup as the abuse contact, and hostname: true adds the reverse DNS name with hostname_verified saying whether it forward-confirms. A verified name under a crawler operator's domain proves the crawler too.
Bulk result files carry the new columns at their response positions, and the Node, Python and PHP clients, the Zapier, n8n, Make and Google Sheets connectors and the MCP tool know the new fields and endpoints.

markdown version: /changelog/2026-09-05-ip-intelligence-round-three.md · atom feed: /changelog.atom

All releases