Common Instructions

What are CheckIP's core capabilities?

CheckIP focuses on restoring the IP’s actual usage scenario and provides:

Scenario classification (residential / IDC / proxy pool, etc.)
Risk score (higher = more historical suspicious activity)
Native IP / Roaming IP determination
History (e.g., ASN and scenario changes)

What is a “residential IP”?

Access provided by ISPs in non–data-center environments. Beyond home broadband, it can include business broadband, campus networks, and small-business egress. Typical traits: higher share of native IPs, fewer open ports, generally more stable.

What is a “data center IP” (IDC IP)?

Egress concentrated in data centers, cloud providers, colocation, or proxy pools. Often used for batch operations (account farming, traffic manipulation, scraping), so the potential abuse risk is higher.

Why emphasize the actual usage scenario rather than only the IP/ASN owner?

Ownership tells you who owns it, not who uses it or how. The same subnet may have ISP resources used in a data-center scenario. CheckIP anchors on real-world usage, reducing false positives on residential IPs.

Why do other sites say “residential” while CheckIP shows IDC?

Many sites infer from corporate entity or ASN; CheckIP relies on actual usage. Owner/ASN-only labels can miss:

ISP subleasing or mixing with data-center resources
Cross-border BGP announcements
Multiple purposes coexisting on the same subnet

Where does the data come from? How accurate is it?

Large-scale human labeling with continuous updates. Labeled segments are highly accurate, but IP usage changes constantly; newly changed IPs not yet synced may be misclassified. Feedback is welcome to speed up corrections.

Does “residential” always mean a home user?

Not necessarily. Here, “residential” means non-IDC scenarios; it can include business broadband, campus networks, and small businesses. ISPs often mix home/business/campus egress, making precise type separation difficult.

What is the risk score and what is it for?

A measure of an IP’s historical suspicious activity (higher = riskier), sourced from scanning, brute force, scraping, attacks, spam, CC attack, etc.

Why do some home-broadband IPs also have high risk?

Common reasons:

Compromised devices (bots)
Shared networks (CGNAT/campus/business) and their pooled history
Use as proxies/scrapers
Abnormal concurrency and large-scale fetching
Residual traces from past abuse

We recommend combining recent behavior and business context before deciding.

What’s the difference between a “native IP” and a “Roaming IP”?

Native IP: the registered country matches the country of actual use—typical for local residential broadband or local IDCs.
Roaming IP: some cross-border IDCs buy large blocks and announce the same subnet via BGP in multiple countries/regions.

Why check ASN history?

ASN is a network affiliation marker. Residential broadband IPs typically remain under a single ASN with infrequent changes. Frequent ASN changes suggest instability and are often treated as potentially unclean and worth closer review. Note: IPs and ASNs are not strictly one-to-one; a single IP may be associated with multiple ASNs. Historical records make all associations and changes clear.