Public IP blocklists feel definitive: if an address showed up in open-source intelligence, refuse it. That treats a listing as a permanent identity. Addresses change hands; community lists refresh on a slower clock. On IP99 by ThreatHunter, osint names something narrower: the address was listed by a public intelligence source. It is a risk tag, not a probability that the person behind the IP is an attacker, and not a reason to skip the rest of the triage.
This walkthrough stays on free, no-key GET /v1/ip/{ip}. JSON samples below are documented product shapes from IP99 docs and prior verified captures — run the curls yourself for a live snapshot. We use a documented capture that already carries osint alongside other slugs; we do not invent a sample IP that carries osint alone. Notes: IP99, API, detect proxy / VPN, IP risk score.
What osint is (and what it is not)
IP99's free lookup returns a 0–100 risk.score for freshness and strength of verifiable risk evidence, not attacker probability. risk.level follows the score (0 → none, 1–29 → low, 30–69 → medium, 70–100 → high). Signals appear only when they hit. Always branch on evidence_state (active / stale / none) before the score: score 0 + none is a coverage gap, not a clean bill of health.
Tags that matter here:
| slug | Meaning | Typical disposition |
|---|---|---|
osint | Listed by a public intelligence source (risk tag) | Step-up; do not hard-ban on a listing alone |
proxy | Address currently used as a proxy exit | Step-up or block by business cost |
vpn | Static commercial VPN exit | Product decision; often step-up, not refuse |
dialup_pool | Dial-up / redial rotation pool | Supply-side rotation (often DYN/MOB) |
hijacked_proxy | Malware-hijacked egress; owner is the victim | Challenge, do not ban the account |
hosting / mobile | Network attributes | Not risk verdicts alone |
crawler | Search crawler egress | Benign; does not score |
Official API wording: osint = listed by a public intelligence source (open-source intelligence). It can appear in risk.signals and, on Pulse, as an evidence[].risk_type row. The docs do not name upstream list vendors, and this article does not invent them.
False equivalents:
-
osint≠ "this user is an attacker." The score measures evidence freshness and strength. A listing is an observation about an address, not attribution of a person. Shared exits put many unrelated users behind one IP. -
osint≠proxy/vpn/dialup_pool. Those tags come from observed proxy-class use or commercial VPN infrastructure.osintmeans a public source listed the address. They can appear together; they are not synonyms. -
hostingon IDC ≠osint. Public DNS and ordinary cloud servers sit in hosting space every day with score0and no public-intel hit. -
crawleris benign and does not score — do not fold a search crawler into an OSINT block.
Free /v1/ip does not return share_tier (Pulse only). On free tier, lean on evidence_state, score/level, signal type, usage_type, plus your own velocity / device checks.
Why public listings go stale
IP99's detect-proxy/VPN guide puts it plainly: two clocks run at different speeds. The address changes hands in minutes; the list that describes it is refreshed in days. The gap is where false positives live — a real customer gets the address a list still describes as yesterday's exit.
That is why IP99 treats every answer as a judgement that expires, not a permanent label. When osint is present, read evidence_state and computed_at with it. active means fresh scoring evidence; stale means it was seen but has aged out (score 0, weak feature only); none means never seen — unknown, not safe.
Official corollary from the same page: no source is complete. Proxy supply is a market; every vendor sees a slice of it. Treat any single feed, IP99 included, as one input among several. A public listing is useful context, not a substitute for first-party proxy / dialup_pool evidence.
Documented contrast: hosting without a listing vs listing plus proxy vs proxy without osint
curl https://ip99.com/v1/ip/8.8.8.8?utm_source=devto&utm_medium=article&utm_campaign=ip99 Documented product sample (IP99 docs / prior verified capture):
{ "ip": "8.8.8.8", "computed_at": "2026-10-09T10:22:26Z", "evidence_state": "none", "geo": { "continent": "NA", "country": "US", "region": "California", "city": "Mountain View", "tz": "America/Los_Angeles" }, "network": { "asn": 15169, "usage_type": "IDC" }, "risk": { "score": 0, "level": "none", "signals": ["hosting"] } } hosting here is a network attribute on public DNS. evidence_state: none with score 0 means no verifiable proxy-class or public-intel evidence on file — not "safe," and not osint. Blocking every address that "looks listed" or "looks like a datacenter" would refuse this one for the wrong reason.
Now a Paris datacenter address whose documented capture included osint together with proxy and hosting:
curl https://ip99.com/v1/ip/178.20.30.146?utm_source=devto&utm_medium=article&utm_campaign=ip99 Documented product sample (IP99 docs / prior verified capture):
{ "ip": "178.20.30.146", "computed_at": "2026-10-09T10:23:02Z", "evidence_state": "active", "geo": { "continent": "EU", "country": "FR", "region": "Île-de-France", "city": "Paris", "tz": "Europe/Paris" }, "network": { "asn": 46475, "usage_type": "IDC" }, "risk": { "score": 99, "level": "high", "signals": ["hosting", "osint", "proxy"] } } This is the documented shape we can show: osint matched, and so did proxy. Branch on each matched slug. proxy means observed proxy egress; osint means a public intelligence source listed it; hosting is only the network attribute. Do not collapse the three into "bad IP, ban." We are not inventing a solo-osint address — if a live lookup later drops a slug, that is expected, because scores decay.
Most new proxy supply is not in that IDC slice. API docs demo for a residential proxy egress without osint:
curl https://ip99.com/v1/ip/86.111.136.23?utm_source=devto&utm_medium=article&utm_campaign=ip99 Documented product sample (API docs demo): score 86, level high, signals ["proxy"], usage_type DYN, ASN 15547, geo CH / Valais / Sitten. Re-curl for a live snapshot — scores decay with evidence age. First-party proxy observation can exist without a public listing, just as a listing can linger after the address changed hands.
What the weekly capture mix says
Between 1–7 November 2026 (UTC), IP99 captured 10,728,498 new proxy-class exit addresses (+3% WoW). By usage type: 79.2% residential (8,498,288), 12.3% mobile (1,316,500), 4.0% gateway/NAT (425,657), 3.7% datacenter (391,719). 58 upstream sources. Figures generated 8 November 2026 UTC. Source: proxy-exits. Aggregates only; no address lists.
That weekly count is first-party proxy-class observation (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) — not a count of osint listings. The mix still matters: most new exits sit in residential space. Trusting only public lists, or only blocking IDC, under-covers that majority and over-punishes leftover listings after an address changed hands.
A practical branch (evidence_state first)
Official triage order: evidence_state → score/level → signal type → usage_type. Generic guidance (not a contract): score 0 → do not stamp "clean"; 1–29 → observe; 30–69 → captcha / throttle / second factor; 70–100 → block only when business cost allows. Score meaning: IP risk score.
1. Read evidence_state (active / stale / none). 2. Read risk.signals and network.usage_type. 3. If osint is present and evidence_state is active: - Treat as "listed by a public intelligence source." - Do NOT treat the listing as attacker probability or as a person-level verdict. - Prefer step-up + velocity / device / session checks over a hard ban on the listing alone. - If proxy / vpn / dialup_pool are also present, branch on those slugs too — they are different observations. 4. If osint is present and evidence_state is stale: - Weak, expired feature only (score 0). Do not apply an old list hit as a fresh ban. 5. Else if hosting on IDC WITHOUT osint / proxy / vpn: - Network attribute only — do not invent a public-intel verdict. 6. Else if proxy on DYN or MOB without osint: - First-party proxy supply, not a public listing — different from osint-only reasoning. 7. If hijacked_proxy is also present: challenge; do not ban the account (owner is the victim). 8. Never mark score 0 + evidence_state none as "trusted clean." 9. Re-query at decision time; do not cache an osint verdict for days. Anonymous quota is 500 lookups/day per client IP (60/min); a free logged-in key raises the daily cap to 5,000/day. Check remaining with GET https://ip99.com/v1/me?utm_source=devto&utm_medium=article&utm_campaign=ip99 or the X-Daily-* headers. OpenAPI: https://ip99.com/openapi.json?utm_source=devto&utm_medium=article&utm_campaign=ip99. Pricing: https://ip99.com/en/pricing?utm_source=devto&utm_medium=article&utm_campaign=ip99.
Do not treat IP99 scores as identical to other ThreatHunter datasets — this article only claims what free /v1/ip and the cited English product pages / OpenAPI document.
Try it
curl https://ip99.com/v1/ip?utm_source=devto&utm_medium=article&utm_campaign=ip99 curl https://ip99.com/v1/ip/8.8.8.8?utm_source=devto&utm_medium=article&utm_campaign=ip99 curl https://ip99.com/v1/ip/178.20.30.146?utm_source=devto&utm_medium=article&utm_campaign=ip99 curl https://ip99.com/v1/ip/86.111.136.23?utm_source=devto&utm_medium=article&utm_campaign=ip99 curl https://ip99.com/v1/me?utm_source=devto&utm_medium=article&utm_campaign=ip99 IP99 is a ThreatHunter product. Use the free lookup to separate a public intelligence listing (osint) from first-party proxy observation, commercial VPN exits, ordinary hosting, and leftover labels after an address changed hands — before a stale list hit bans a customer who just received the IP. Start at https://ip99.com?utm_source=devto&utm_medium=article&utm_campaign=ip99; read detect proxy / VPN, proxy-exits, and https://ip99.com/api?utm_source=devto&utm_medium=article&utm_campaign=ip99.
