Common Instructions
CheckIP focuses on restoring the IP's actual usage scenario and provides:
- Scenario classification (residential / IDC / proxy pool, etc.)
- Risk score (higher = more historical suspicious activity)
- Native IP / Roaming IP determination
- History (e.g., ASN and scenario changes)
Access provided by ISPs in non–data-center environments. Beyond home broadband, it can include business broadband, campus networks, and small-business egress. Typical traits: higher share of native IPs, fewer open ports, generally more stable.
Egress concentrated in data centers, cloud providers, colocation, or proxy pools. Often used for batch operations (account farming, traffic manipulation, scraping), so the potential abuse risk is higher.
Ownership tells you who owns it, not who uses it or how. The same subnet may have ISP resources used in a data-center scenario. CheckIP anchors on real-world usage, reducing false positives on residential IPs.
Many sites infer from corporate entity or ASN; CheckIP relies on actual usage. Owner/ASN-only labels can miss:
- ISP subleasing or mixing with data-center resources
- Cross-border BGP announcements
- Multiple purposes coexisting on the same subnet
Large-scale human labeling with continuous updates. Labeled segments are highly accurate, but IP usage changes constantly; newly changed IPs not yet synced may be misclassified. Feedback is welcome to speed up corrections.
Not necessarily. Here, "residential" means non-IDC scenarios; it can include business broadband, campus networks, and small businesses. ISPs often mix home/business/campus egress, making precise type separation difficult.
A measure of an IP's historical suspicious activity (higher = riskier), sourced from scanning, brute force, scraping, attacks, spam, CC attack, etc.
Common reasons:
- Compromised devices (bots)
- Shared networks (CGNAT/campus/business) and their pooled history
- Use as proxies/scrapers
- Abnormal concurrency and large-scale fetching
- Residual traces from past abuse
Native IP: the registered country matches the country of actual use—typical for local residential broadband or local IDCs.
Roaming IP: some cross-border IDCs buy large blocks and announce the same subnet via BGP in multiple countries/regions.
Roaming IP: some cross-border IDCs buy large blocks and announce the same subnet via BGP in multiple countries/regions.
ASN is a network affiliation marker. Residential broadband IPs typically remain under a single ASN with infrequent changes. Frequent ASN changes suggest instability and are often treated as potentially unclean and worth closer review. Note: IPs and ASNs are not strictly one-to-one; a single IP may be associated with multiple ASNs. Historical records make all associations and changes clear.
If you see an IP address that has empty AS details, it means that no AS has announced a suitable prefix and the IP address is not routable. Not all IPs are routable on the internet, but only those for which some AS announced a prefix over BGP, containing that IP address.
