IP intelligence

What it is

The scale

The 360+ billion covers the whole public IPv4 space, about 3.3 billion addresses, plus about 358 billion IPv6 networks, where each /64 block counts as one network because that is how IPv6 is handed out.

How the database is built

A pipeline pulls in public sources, scores each range, and refreshes every few hours:

Each range carries a confidence. A VPN provider's own list counts for more than a community list. Addresses that look high risk in live lookups are reported back into the engine, so it learns from the traffic it sees.

How a lookup works

1. A session reaches DataCops with the visitor's IP.
2. DataCops asks its own IP service. The answer is cached for 24 hours, so a returning address costs nothing.
3. The lookup has a two-second limit, so a slow answer never holds up processing.
4. The session is stamped with VPN, proxy, Tor and datacenter flags, the network owner and the location.
5. Those flags travel with every conversion from that session.

What a lookup returns

{
  "status": "ok",
  "ip": "203.0.113.7",
  "risk_score": 72,
  "risk_label": "critical",
  "action": "BLOCK",
  "type": "vpn",
  "threats": {
    "is_vpn": true,
    "is_proxy": false,
    "is_tor": false,
    "is_datacenter": false,
    "is_crawler": false
  },
  "geo": { "country": "NL", "region": "North Holland", "city": "Amsterdam" },
  "network": { "asn": 64500, "org": "Example VPN Ltd", "provider": "Example VPN" },
  "detection_sources": []
}

This is an internal service. You see its results on sessions, signed-up users and leads in your dashboard, not as a separate API.

Crawlers and good bots

Not every non-human visit is bad. Search engines, AI crawlers, SEO tools and social link previews visit your site for good reasons. DataCops keeps a list of about 80 known helpful crawlers, like Googlebot, Bingbot, GPTBot and ClaudeBot, and labels them as good bots. They never count as visitors, never count toward your plan usage, and never land in a fraud report.

The bad-bot list is checked first. A headless browser that claims to be Googlebot is still treated as a bad bot. Good bots are matched by their browser name, so the IP verdict and the session's own bot checks still apply to everything else.

Good to know

Why we run our own

IP ownership changes constantly and VPN providers add servers all the time. A licensed list that is cached and rarely refreshed quietly lets bad traffic through. Running our own service means we refresh on our schedule, add sources when fraud moves, and learn from what our customers' sites see.

It also means one fewer company on your data. Visitor IPs are checked inside DataCops, not sent to a separate IP-lookup vendor, which keeps your list of processors short and your answer simple when your own customers ask where their data goes.

What it powers