2026-09-12

IP intelligence round four, from corporate gateways to your own lists

Corporate proxy egress, three more VPN lists and an inferred WARP, GitHub runners, a thirty-day Tor exit history, sanctions and FATF facts, time zones by nearest place with a browser mismatch check, mobile and satellite operators, your own allow and deny lists, a velocity count, a fields option and bulk summaries.

is_corporate_proxy and corporate_proxy name the egress of a corporate secure web gateway from the cloud enforcement node ranges Zscaler publishes for its eight clouds. An employee behind one reaches the Internet from the gateway's address, so the answer now says workplace rather than datacenter: no weight, the datacenter weight is skipped for it like relay egress and verified crawlers, and the consistency endpoint withholds its country comparisons for it.
Three more named VPN lists — IVPN, AirVPN and the VPN Gate volunteer relays — join Mullvad, NordVPN and Private Internet Access, and Cloudflare WARP is answered by inference as Cloudflare's own network outside the CDN ranges it publishes, with privacy_service reading Cloudflare WARP (inferred) so nobody mistakes an inference for a list. GitHub's hosted runner ranges join the datacenter feeds as hosting_provider GitHub Actions.
The Tor feeds sync hourly now, and each sync rebuilds a thirty-day exit history: tor_last_seen dates the address's last sighting as an exit, and an address that left the list inside the last seven days carries a recently_tor weight of 40, because exits rotate daily and yesterday's exit is still the same machine.
sanctions names the OFAC country programmes that name the country, comprehensive ones marked apart, and fatf_list says whether the FATF lists it under a call for action or increased monitoring as of its June 2026 plenary. Both come from a curated file that names its sources and dates, carry no weight, and are facts about a place rather than a verdict about a person.
timezone now resolves for split countries and regions — Texas, Canada, Australia, Brazil, Russia, Indonesia — from the nearest place in the GeoNames list inside the located country, and timezone_source says whether the region, the country or the nearest city settled it. Send browser_timezone with a lookup, from the server endpoints or the browser endpoint, and timezone_matches says whether the visitor's clock agrees with the network's.
connection_type names what positive evidence says the address is attached to — corporate_proxy, hosting, satellite, mobile, or residential from a dynamic reverse-DNS name — and is_mobile and is_satellite come from curated positive-only operator lists (Starlink, Viasat and HughesNet; T-Mobile, Verizon Wireless, AT&T Mobility, EE, Three, Jio, Airtel, China Mobile, Telcel and more). Null never means residential. With hostname: true, hostname_kind and hostname_domain say what the naming convention says and which registrable domain the name belongs to.
Your own lists: /api/v1/ip/lists and the dashboard's new Lists tab keep up to 20 allow or deny lists of up to 5,000 addresses or prefixes each, applied to every lookup the account is billed for. An allow-list hit zeroes the score with a single allowlisted signal saying why, a deny-list hit tops it at 100, deny is checked first, and account_list names the list and the entry that matched.
seen_by_you counts how many times your account looked the address up in the last seven days and when it first did — velocity, kept under the same keyed hash as the repeat marker, never the address — and privacy: true skips it along with the marker.
A fields option on the single-address endpoints keeps only the keys you name, so a page that wants a country and a currency receives two keys rather than sixty; the two GET endpoints answer with Cache-Control: private, max-age=300. Monitored lists accept CIDRs of up to 256 addresses and expand them under the 500 cap.
Bulk result files carry the new columns at their response positions, and a finished run's payload adds a summary: rows, reserved addresses, the top countries and networks, how many rows carried each signal, how many hit one of your lists, and the risk split, added up from the same cells the CSV holds.

markdown version: /changelog/2026-09-12-ip-intelligence-round-four.md · atom feed: /changelog.atom

All releases