Don't Ban on a Public List Alone: Reading osint on IP99

Public IP blocklists feel definitive: if an address showed up in open-source intelligence, refuse it. That treats a listing as a permanent identity. Addresses change hands; community lists refresh on a slower clock. On IP99 by ThreatHunter, osint names something narrower: the address was listed by a public intelligence source. It is a risk tag, not a probability that the person behind the IP is an attacker, and not a reason to skip the rest of the triage.

This walkthrough stays on free, no-key GET /v1/ip/{ip}. JSON samples below are documented product shapes from IP99 docs and prior verified captures — run the curls yourself for a live snapshot. We use a documented capture that already carries osint alongside other slugs; we do not invent a sample IP that carries osint alone. Notes: IP99, API, detect proxy / VPN, IP risk score.

What osint is (and what it is not)

IP99's free lookup returns a 0–100 risk.score for freshness and strength of verifiable risk evidence, not attacker probability. risk.level follows the score (0 → none, 1–29 → low, 30–69 → medium, 70–100 → high). Signals appear only when they hit. Always branch on evidence_state (active / stale / none) before the score: score 0 + none is a coverage gap, not a clean bill of health.

Tags that matter here:

Official API wording: osint = listed by a public intelligence source (open-source intelligence). It can appear in risk.signals and, on Pulse, as an evidence[].risk_type row. The docs do not name upstream list vendors, and this article does not invent them.

False equivalents:

1. osint ≠ "this user is an attacker." The score measures evidence freshness and strength. A listing is an observation about an address, not attribution of a person. Shared exits put many unrelated users behind one IP.
2. osint ≠ proxy / vpn / dialup_pool. Those tags come from observed proxy-class use or commercial VPN infrastructure. osint means a public source listed the address. They can appear together; they are not synonyms.
3. hosting on IDC ≠ osint. Public DNS and ordinary cloud servers sit in hosting space every day with score 0 and no public-intel hit.
4. crawler is benign and does not score — do not fold a search crawler into an OSINT block.

Free /v1/ip does not return share_tier (Pulse only). On free tier, lean on evidence_state, score/level, signal type, usage_type, plus your own velocity / device checks.

Why public listings go stale

IP99's detect-proxy/VPN guide puts it plainly: two clocks run at different speeds. The address changes hands in minutes; the list that describes it is refreshed in days. The gap is where false positives live — a real customer gets the address a list still describes as yesterday's exit.

That is why IP99 treats every answer as a judgement that expires, not a permanent label. When osint is present, read evidence_state and computed_at with it. active means fresh scoring evidence; stale means it was seen but has aged out (score 0, weak feature only); none means never seen — unknown, not safe.

Official corollary from the same page: no source is complete. Proxy supply is a market; every vendor sees a slice of it. Treat any single feed, IP99 included, as one input among several. A public listing is useful context, not a substitute for first-party proxy / dialup_pool evidence.

Documented contrast: hosting without a listing vs listing plus proxy vs proxy without osint

curl https://ip99.com/v1/ip/8.8.8.8?utm_source=devto&utm_medium=article&utm_campaign=ip99

Documented product sample (IP99 docs / prior verified capture):

{
  "ip": "8.8.8.8",
  "computed_at": "2026-10-09T10:22:26Z",
  "evidence_state": "none",
  "geo": {
    "continent": "NA",
    "country": "US",
    "region": "California",
    "city": "Mountain View",
    "tz": "America/Los_Angeles"
  },
  "network": { "asn": 15169, "usage_type": "IDC" },
  "risk": {
    "score": 0,
    "level": "none",
    "signals": ["hosting"]
  }
}

hosting here is a network attribute on public DNS. evidence_state: none with score 0 means no verifiable proxy-class or public-intel evidence on file — not "safe," and not osint. Blocking every address that "looks listed" or "looks like a datacenter" would refuse this one for the wrong reason.

Now a Paris datacenter address whose documented capture included osint together with proxy and hosting:

curl https://ip99.com/v1/ip/178.20.30.146?utm_source=devto&utm_medium=article&utm_campaign=ip99

Documented product sample (IP99 docs / prior verified capture):

{
  "ip": "178.20.30.146",
  "computed_at": "2026-10-09T10:23:02Z",
  "evidence_state": "active",
  "geo": {
    "continent": "EU",
    "country": "FR",
    "region": "Île-de-France",
    "city": "Paris",
    "tz": "Europe/Paris"
  },
  "network": { "asn": 46475, "usage_type": "IDC" },
  "risk": {
    "score": 99,
    "level": "high",
    "signals": ["hosting", "osint", "proxy"]
  }
}

This is the documented shape we can show: osint matched, and so did proxy. Branch on each matched slug. proxy means observed proxy egress; osint means a public intelligence source listed it; hosting is only the network attribute. Do not collapse the three into "bad IP, ban." We are not inventing a solo-osint address — if a live lookup later drops a slug, that is expected, because scores decay.

Most new proxy supply is not in that IDC slice. API docs demo for a residential proxy egress without osint:

curl https://ip99.com/v1/ip/86.111.136.23?utm_source=devto&utm_medium=article&utm_campaign=ip99

Documented product sample (API docs demo): score 86, level high, signals ["proxy"], usage_type DYN, ASN 15547, geo CH / Valais / Sitten. Re-curl for a live snapshot — scores decay with evidence age. First-party proxy observation can exist without a public listing, just as a listing can linger after the address changed hands.

What the weekly capture mix says

Between 1–7 November 2026 (UTC), IP99 captured 10,728,498 new proxy-class exit addresses (+3% WoW). By usage type: 79.2% residential (8,498,288), 12.3% mobile (1,316,500), 4.0% gateway/NAT (425,657), 3.7% datacenter (391,719). 58 upstream sources. Figures generated 8 November 2026 UTC. Source: proxy-exits. Aggregates only; no address lists.

That weekly count is first-party proxy-class observation (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy) — not a count of osint listings. The mix still matters: most new exits sit in residential space. Trusting only public lists, or only blocking IDC, under-covers that majority and over-punishes leftover listings after an address changed hands.

A practical branch (evidence_state first)

Official triage order: evidence_state → score/level → signal type → usage_type. Generic guidance (not a contract): score 0 → do not stamp "clean"; 1–29 → observe; 30–69 → captcha / throttle / second factor; 70–100 → block only when business cost allows. Score meaning: IP risk score.

1. Read evidence_state (active / stale / none).
2. Read risk.signals and network.usage_type.
3. If osint is present and evidence_state is active:
     - Treat as "listed by a public intelligence source."
     - Do NOT treat the listing as attacker probability or as a person-level verdict.
     - Prefer step-up + velocity / device / session checks over a hard ban on the listing alone.
     - If proxy / vpn / dialup_pool are also present, branch on those slugs too — they are different observations.
4. If osint is present and evidence_state is stale:
     - Weak, expired feature only (score 0). Do not apply an old list hit as a fresh ban.
5. Else if hosting on IDC WITHOUT osint / proxy / vpn:
     - Network attribute only — do not invent a public-intel verdict.
6. Else if proxy on DYN or MOB without osint:
     - First-party proxy supply, not a public listing — different from osint-only reasoning.
7. If hijacked_proxy is also present: challenge; do not ban the account (owner is the victim).
8. Never mark score 0 + evidence_state none as "trusted clean."
9. Re-query at decision time; do not cache an osint verdict for days.

Anonymous quota is 500 lookups/day per client IP (60/min); a free logged-in key raises the daily cap to 5,000/day. Check remaining with GET https://ip99.com/v1/me?utm_source=devto&utm_medium=article&utm_campaign=ip99 or the X-Daily-* headers. OpenAPI: https://ip99.com/openapi.json?utm_source=devto&utm_medium=article&utm_campaign=ip99. Pricing: https://ip99.com/en/pricing?utm_source=devto&utm_medium=article&utm_campaign=ip99.

Do not treat IP99 scores as identical to other ThreatHunter datasets — this article only claims what free /v1/ip and the cited English product pages / OpenAPI document.

Try it

curl https://ip99.com/v1/ip?utm_source=devto&utm_medium=article&utm_campaign=ip99
curl https://ip99.com/v1/ip/8.8.8.8?utm_source=devto&utm_medium=article&utm_campaign=ip99
curl https://ip99.com/v1/ip/178.20.30.146?utm_source=devto&utm_medium=article&utm_campaign=ip99
curl https://ip99.com/v1/ip/86.111.136.23?utm_source=devto&utm_medium=article&utm_campaign=ip99
curl https://ip99.com/v1/me?utm_source=devto&utm_medium=article&utm_campaign=ip99

IP99 is a ThreatHunter product. Use the free lookup to separate a public intelligence listing (osint) from first-party proxy observation, commercial VPN exits, ordinary hosting, and leftover labels after an address changed hands — before a stale list hit bans a customer who just received the IP. Start at https://ip99.com?utm_source=devto&utm_medium=article&utm_campaign=ip99; read detect proxy / VPN, proxy-exits, and https://ip99.com/api?utm_source=devto&utm_medium=article&utm_campaign=ip99.