Attributions & licenses
IPBGP verdicts come from our own measurement nodes and our own scoring. Some public and licensed reference data supports parts of that work, and those licenses require us to say so. Each entry below is published from our compliance registry and read at request time, so this page is always the current list.
IPBGP verdicts are our own classifications, produced by our own pipelines and measurement nodes from many inputs. This page is the single aggregated disclosure of the third-party datasets that feed those pipelines, published to satisfy the attribution terms of the licences listed below. It is not a per-query provenance record: individual API responses never name a source.
abuse.ch (Feodo Tracker, URLhaus, ThreatFox, SSLBL, MalwareBazaar)
CC0-1.0Malware command-and-control and botnet indicator feeds behind our threat verdicts.
Terms and detailsIn use since 2026-06bgp.tools
public-serviceAutonomous-system names, operator tags and public routing-table snapshots used for AS metadata.
Terms and detailsIn use since 2026-06CISA Known Exploited Vulnerabilities Catalog
CC0-1.0Marks vulnerabilities that are known to be exploited in the wild.
Terms and detailsIn use since 2026-06Cloudflare public RPKI validated ROA payloads
public-serviceRoute-origin validation state for announced prefixes.
Terms and detailsIn use since 2026-06Internet Routing Registry route objects (RADB, RIPE NCC, APNIC, ARIN)
registry-termsRegistered route and route6 objects cross-checked against observed origins.
Terms and detailsIn use since 2026-06iptoasn.com
PDDL-1.0Offline IP-to-ASN reference table used to bootstrap routing lookups.
Terms and detailsIn use since 2026-06ipverse asn-ip
CC0-1.0ASN-to-prefix expansion for AS metadata.
Terms and detailsIn use since 2026-06Measurement Lab (M-Lab)
CC0-1.0Open network measurement data used as ground truth when calibrating throughput and latency.
Terms and detailsIn use since 2026-06NIST National Vulnerability Database
public-domainCVE, CPE and CVSS reference records behind vulnerability matching.
Terms and detailsIn use since 2026-06PeeringDB
CC0-1.0Network type, facility and exchange-point presence records used for AS metadata.
Terms and detailsIn use since 2026-06Regional Internet Registry delegated statistics and bulk registry data
registry-termsAuthoritative address and ASN allocation, holder and country records.
Terms and detailsIn use since 2026-06Tor Project onionoo
public-domainTor relay and exit directory used for Tor exit detection.
Terms and detailsIn use since 2026-06APNIC Labs per-AS user population estimates
public-serviceEyeball-population estimates that gate residential-ISP classification.
Per-AS user population estimates published by APNIC Labs.
CAIDA AS Relationships and AS Rank
CAIDA-AUPAutonomous-system relationships and customer-cone sizes behind topology facts.
AS Relationships and AS Rank datasets provided by the Center for Applied Internet Data Analysis (CAIDA), UC San Diego.
CAIDA IP Leasing Inference
CC-BY-4.0Seed set for address-lease and secondary-market detection.
IP leasing inference data from CAIDA, "Sublet Your Subnet" (IMC 2024), licensed CC BY 4.0.
DB-IP Lite
CC-BY-4.0Baseline IP geolocation.
IP geolocation data contributed by DB-IP, licensed CC BY 4.0 — https://db-ip.com
FIRST Exploit Prediction Scoring System (EPSS)
FIRST-EPSS-TermsExploit-likelihood scores and percentiles attached to vulnerability records.
Exploit Prediction Scoring System (EPSS) data provided by FIRST.org.
GeoNames
CC-BY-4.0Place-name and administrative-region normalisation for geolocation output.
Geographical place names from GeoNames, licensed CC BY 4.0.
IPFire Location Database (libloc)
CC-BY-SA-4.0Autonomous-system and country metadata cross-check.
Location data from the IPFire Location Database, licensed CC BY-SA 4.0; redistribution of derived location data keeps the same licence.
IPLocate free ASN database
CC-BY-SA-4.0Autonomous-system metadata cross-check.
ASN data by IPLocate.io, licensed CC BY-SA 4.0 — https://www.iplocate.io
Majestic Million
CC-BY-3.0Domain-popularity cross-check separating eyeball from content networks.
Majestic Million data by Majestic, licensed CC BY 3.0.
MaxMind GeoLite2
CC-BY-SA-4.0Optional geolocation and ASN baseline; loaded only when a deployment configures its own GeoLite2 licence key.
This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
Rapid7 Recog
BSD-2-ClauseService-banner fingerprint rules used to infer product and version.
Recog fingerprint database, Copyright (c) Rapid7 LLC, used under the BSD 2-Clause License.
RIPE NCC Routing Information Service (RIS)
RIPE-NCC-TermsBGP collector archives behind prefix, origin and path facts.
Contains information from the RIPE NCC Routing Information Service (RIS), used under the RIPE NCC Terms and Conditions.
RouteViews
CC-BY-4.0BGP RIB and update archives behind prefix, origin and path facts.
Routing data provided by the University of Oregon RouteViews Project, licensed CC BY 4.0.
Spamhaus DROP and ASN-DROP
Spamhaus-Fair-UseDo-not-route reference lists used as a weak negative reputation signal.
DROP and ASN-DROP lists published by The Spamhaus Project.
Team Cymru IP-to-ASN and Bogon reference
public-serviceIP-to-ASN mapping and bogon / fullbogon reference lists.
IP-to-ASN mapping and bogon reference data provided as a community service by Team Cymru.
Tranco
MITDomain-popularity ranking used to cross-check eyeball versus content networks.
Tranco list, used under the MIT License.
X4BNet lists_vpn
MITVPN and datacenter range seeds for anonymisation signals.
X4BNet lists_vpn, used under the MIT License.
ZLint
Apache-2.0Certificate lint rules behind certificate-hygiene conclusions.
ZLint, used under the Apache License 2.0.