Reference

IP intelligence glossary

The vocabulary of IP geolocation and abuse detection, explained the way an engineer would explain it to a colleague rather than the way a datasheet would. If a term you need is missing, send it over and we will add it.

Accuracy radius

The distance around the returned coordinates within which the host probably sits. If the radius is wider than the area your rule cares about, the coordinates are not usable for that rule.

Allocation

A block of addresses handed out by a regional internet registry to an operator. The unit most geolocation data is described at.

Anycast

One address announced from many locations at once, so packets reach the nearest instance. Geolocating an anycast address is meaningless by design — 1.1.1.1 is everywhere.

ASN

Autonomous system number. Identifies the network operating an address — an ISP, hosting company, university or large enterprise. Usually a stronger fraud signal than city.

BGP

The routing protocol networks use to announce which prefixes they carry. Announcement tells you who actually transports the traffic, which can differ from who registered the block.

Bogon

An address that should never appear on the public internet — private, reserved or unallocated. Seeing one in a request header usually means spoofing or a misconfigured proxy.

CGNAT

Carrier-grade NAT. Thousands of subscribers share one public address at a carrier gateway. It is the main reason mobile city results are wrong and why per-IP rate limits punish innocent users.

CIDR

The prefix notation for address ranges, such as 203.0.113.0/24. The number after the slash is how many leading bits are fixed.

Connection type

Whether an address serves residential broadband, mobile, business or hosting. Ownership rather than estimation, so it is far more dependable than city.

Datacenter IP

An address belonging to cloud or hosting infrastructure. Its location is factually correct and behaviourally meaningless: there is no person sitting there.

Dual stack

A host reachable over both IPv4 and IPv6. The two addresses can resolve differently, so decide which one your rules use and be consistent.

Exit node

The last relay in an anonymising network, and the address your server sees. On TOR the exit list is published, which is why TOR is the easiest anonymiser to detect.

Geofeed

A CSV file an operator publishes declaring where its own prefixes are used, standardised in RFC 8805. Self-reported, but authoritative when the operator maintains it.

GeoIP

The general practice of inferring location from an IP address, and a common shorthand for the datasets that do it.

Hostname (rDNS)

The reverse DNS name of an address. Often encodes a city, facility code or product line, which makes it a useful supporting hint.

IP reputation

An aggregate judgement about an address based on past behaviour. Valuable when it decays over time and dangerous when it does not, because addresses are recycled constantly.

IPv4 exhaustion

There are no free IPv4 blocks left, which is why address space is leased, transferred and re-purposed so often — and why stale datasets go wrong.

IPv6 prefix

Devices usually receive a /64 or a /56 rather than a single address. Rate limit and score on the prefix, not the individual address, or rotation defeats you instantly.

Latency geolocation

Using round-trip times from known vantage points to bound where a host can physically be. The measurement layer that keeps registry data honest.

Open proxy

A relay that will forward traffic for anyone, usually unintentionally. Rarely associated with legitimate use on a paid product.

Prefix

A contiguous block of addresses announced as one routing unit. The granularity at which most network data is published.

Residential proxy

Traffic relayed through real consumer connections, typically sold by the gigabyte. The hardest anonymiser class to detect, because the exit genuinely is a household.

Risk score

A composite number derived from several signals. Only useful if the reasons travel with it — an unexplainable score cannot be defended in a dispute.

RIR

Regional internet registry: ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC. They allocate address space and publish the records everything else is built on.

Search bot verification

Confirming a claimed crawler by forward-confirmed reverse DNS instead of trusting the user agent. Prevents blanket rules from blocking your own indexing.

Sticky session proxy

A relay that keeps one exit address for a period rather than rotating per request, specifically to look like a normal user session.

TOR

An anonymity network routing traffic through volunteer relays. Legitimate for privacy-conscious reading, rarely appropriate for payments or account creation.

VPN

An encrypted tunnel to a remote exit. Extremely common and largely benign on its own; interesting when it appears alongside a country mismatch at checkout.

WHOIS / RDAP

The registry lookup protocols. RDAP is the modern JSON replacement for WHOIS and is what most registries now prefer.

X-Forwarded-For

The header proxies use to pass the original client address. Trust only the portion added by infrastructure you control; anything a client sends can be fabricated.