Changelog

Product updates

New: granular privacy-network detection. privacy_network_type tells apart commercial VPNs, privacy relays (iCloud Private Relay, Chrome IP Protection), residential proxies and Tor, each with a named operator and a confidence score.
Fixed: iCloud Private Relay addresses were being reported as is_vpn: true with an elevated risk score. Private Relay carries ordinary consumer traffic and egresses through Cloudflare and Akamai, so it was being scored against both the VPN and the datacenter signals. Relay traffic now scores low unless the address is independently known-bad.
Fixed: usage_type and is_datacenter are now backed by published hosting-provider ranges instead of inferred from the network name, correcting well-known addresses that were reported as residential.
Changed: is_vpn now means commercial VPN only, so privacy-relay addresses report false. is_proxy is unchanged and still covers every intermediary. If you depend on the old behaviour, add &compat=v1 to your requests; that parameter will be supported until 1 February 2027.
Changed: risk scoring, reverse DNS, BGP routing and the new privacy-detection fields are now plan-based. The 15 day trial returns everything; see which fields each plan includes. Withheld fields are omitted and listed in gated_fields — never returned as null.
Datasets now refresh on a continuous schedule rather than only at service start.

Added POST bulk lookups with JSON, plain-text, and CSV-style bodies.
Added fields response filtering and a documented 1,000-IP batch cap.
Added API key labels, key rotation, origin/referrer/client-IP restrictions, and a working per-IP rate-limit toggle.
Added public status, support, SLA, security, DPA, subprocessors, data-correction, and changelog pages.

Added risk scoring, risk levels, and explainable risk factors.
Expanded data coverage pages for core geo, network, routing, and threat sources.