Data Sources and Accuracy

Every result panel names its source, and the same map is here in one place. Two providers can disagree about the same address; when they do, the result says so instead of picking a winner.

ip-api (primary geolocation and network ownership). Fields: Country, region, city, postal code, coordinates, time zone, ISP, organization, ASN, and the hosting, mobile and proxy flags shown in the network and signal panels. Freshness: Queried live for every lookup; Crafzo does not cache the answer. ip-api maintains its own database and does not publish a per-record date, so the result reflects its data at the moment of the lookup. It receives: The looked-up IP address only.

MaxMind GeoLite2 (fallback geolocation when ip-api does not answer). Fields: Country, region, city, postal code, coordinates and time zone. No ownership, ASN or risk fields. Freshness: A database file bundled with the site, built 2025-06-03. It only changes when the site is deployed with a newer file, so fallback results can be older than the live providers. It receives: Nothing: the lookup runs against the local file on Crafzo's server.

Scamalytics (fraud score and anonymizer signals). Fields: The 0-100 fraud score and its risk band, VPN, Tor, datacenter and Apple Private Relay flags, external blacklist and bot-list signals, and the readable reputation signals. The blacklist, bot and Tor signals come from open-source lists Scamalytics aggregates (FireHOL, IP2Proxy LITE, x4bnet). Freshness: Queried live for every lookup and shown with the time of the check. The score is recomputed by Scamalytics from ongoing fraud reports; the aggregated lists refresh on their publishers' schedules, which Crafzo does not control. It receives: The looked-up IP address only.

NVIDIA NIM (optional intelligence summary). Fields: The summary text, the list of potential risks and the things to weigh. It restates the fields above and adds no data of its own. Freshness: Generated per lookup, with a bounded timeout. When it does not answer, a summary written from the provider fields is shown instead. It receives: The looked-up IP address plus the score and signals returned by Scamalytics.

ipify and icanhazip (detecting your own public ipv4 and ipv6 address). Fields: Your public address, as seen from the browser, for the 'Use my IP' flow. Freshness: Live. It receives: Your browser's request, the same way any website you open does.

"Not detected" means the provider returned an explicit negative for that field. "Not listed" on the blacklist signal means the address is absent from the lists that provider consults; other lists exist and were not checked. "Not reported" means the provider answered but did not include that field for this address, which is common on aggregated open-source data. "Not checked" means the provider did not answer at all. Only the first two are negatives; the last two are gaps.

"Sources disagree" on the proxy signal means ip-api flags a proxy, VPN or Tor exit while Scamalytics reports none. Treat it as an unconfirmed anonymizer signal and weigh it with the rest of the result.

IP geolocation maps network ranges to approximate locations. Country-level results are often stronger than city-level results, while mobile networks, VPNs, proxies, cloud providers, and ISP routing can make location appear different from the user's physical location.

Latitude and longitude should be treated as an approximate network point, not a precise device location.

ISP, organization, ASN, proxy, hosting, and mobile indicators depend on the available enrichment source for the checked IP address. These values can be unavailable, outdated, or interpreted differently by different providers.

Fraud score and reputation signals should be used as triage aids. A high-risk result deserves review, but it is not proof by itself.

Use Crafzo results together with account history, request logs, device signals, rate limits, payment signals, and user behavior.

For formal ownership or abuse reporting, use RDAP or WHOIS records from the appropriate internet registry in addition to lookup enrichment.

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.