Field values

Every value the Intel API returns for address types, risk reasons, network types, RPKI, location confidence, sharing, crawlers, connection and routing.

The fixed values the Intel API returns, by field. Values for kind, group and role are in Operators and lessors.

Address types

In type, classes[].type and prefixes[].type.

Value	Description
`residential`	A home internet connection (cable, DSL, fiber, fixed wireless).
`business`	An organization's own network: a company, a university, a public body.
`mobile`	A mobile carrier's network: phones and hotspots, usually many users behind one address.
`isp`	An internet provider's own space, where its home, business and infrastructure lines can't be told apart.
`hosting`	Servers in a data center or cloud: machines, not people.
`unknown`	Announced on the internet, but its use is unknown.
`not_announced`	No network announces a route to it, so no connection can come from it. A visitor shown with such an address has a forged or mistyped address. Not used in `classes`, which count announced space; see `not_announced_addresses`.
`isp_proxy`	Anonymizer. Proxy endpoints sold on space announced by an internet provider, or by a network presenting itself as one, so the traffic looks like an ordinary home or office connection.
`datacenter_proxy`	Anonymizer. Proxy endpoints sold on a hosting provider's, data center's or proxy company's own network.
`vpn`	Anonymizer. A commercial VPN service's server.
`tor`	Anonymizer. A Tor exit relay.
`relay`	A privacy relay built into a browser or OS (iCloud Private Relay, Cloudflare WARP): ordinary users, address hidden. Not an anonymizer.
`corporate_proxy`	A company's secure web gateway (Zscaler, Netskope and others): employees browse through it. Not an anonymizer.

A residential proxy exit keeps its line's type (residential, mobile and so on). The paid API marks it with flags.residential_proxy.

Risk reasons

In risk.reasons, most significant first.

Value	Description
`isp_proxy`	Sold as a proxy on an internet provider's space, or on a network posing as one.
`datacenter_proxy`	Sold as a proxy on hosting or a proxy company's own space.
`residential_proxy`	Paid only. A subscriber's device in use as a residential proxy exit.
`vpn`	A commercial VPN server.
`tor`	A Tor exit relay.
`relay`	A real person behind a privacy relay, address hidden.
`corporate_proxy`	Employees browsing through their company's secure web gateway.
`hosting`	A server, not a person.
`drop_listed`	The announcing network is on Spamhaus's ASN-DROP list.
`not_announced`	No network announces the address, so a connection can't come from it.
`recent_reassignment`	The block moved to a different network in the last 180 days.
`leased_unattributed`	Leased from an IP broker or lessor, with no named user: the kind of space proxies are often placed on.
`nearby_vpn`	VPN servers share this /24; this address isn't one of them.
`open_proxy_port`	A proxy service is reachable on this address.
`shared_address`	Many people use the address at once (carrier NAT or mobile).
`known_crawler`	A known crawler, monitor or scanner (see `crawler`). Informational: it never raises the score.

Network types

In network.type, announcement.type and the ASN answer's type.

Value	Description
`access`	An internet provider serving homes and businesses.
`mobile`	A mobile carrier.
`business`	A company's or organization's own network.
`education`	A university, school or research network.
`government`	A public body's network.
`hosting`	A hosting, cloud or data center provider.
`transit`	A backbone carrying other networks' traffic.
`cdn`	A content delivery network.
`ixp`	An internet exchange point.
`proxy_network`	A network built to carry proxy services.
`vpn`	A VPN service's own network.
`ip_lessor`	A network leasing its address space to others.
`ip_broker`	An IP broker's network.

The field is absent when the type is unknown. A network typed hosting may still carry proxy or VPN services: the address's own type and flags say what an address is.

RPKI

In network.rpki, announcement.rpki and prefixes[].rpki.

Value	Description
`valid`	The address holder has signed that this network may announce the block.
`invalid-asn`	The holder signed for a different network than the one announcing it: a misconfiguration or a hijack.
`invalid-length`	The holder signed for this network, but not for a block this small.
`not-found`	The holder has signed nothing for this block (common).

Location confidence

In location.confidence.

Value	Description
`high`	Country and city very likely right.
`medium`	The country very likely right, the city a best guess.
`low`	A best guess; even the country may be wrong.

The coordinates are the city's, not the device's.

In sharing.

Value	Description
`cgnat`	Many of a provider's subscribers share the address at once, so blocking it blocks all of them.
`mobile`	A mobile network address, shared by many phones and changing hands often.

In crawler.purposes: search, ai-search (indexing for an AI assistant), ai-training, ai-user (a page a person asked an AI assistant for), user-fetch (a page fetched on a person's request), ads, seo, monitoring (uptime and performance), social-preview (link previews), archive, scanner (internet-wide scanning).

Connection

In connection.

access: satellite, maritime (internet on ships), in-flight (internet on aircraft).
tcp_termination: network means a middlebox on the whole network terminates TCP connections, so connection timing reflects the network, not the device. partial means a middlebox does so on part of the network.

Routing shape

In routing.shape.

Value	Description
`stable`	Has stayed with the same network, or the same company's networks, for years.
`rotating`	Has moved between unrelated networks recently, the pattern of leased space.
`reactivated`	Announced again after more than a year unused: a block that was sold or put back into use.