Authoritative
RIR allocation, BGP/RPKI state, official Tor exit data and vendor-published ranges.
A verdict should show its receipts
IPOK keeps facts, observations and inference separate. The score is a reading aid, not a substitute for the evidence.
Observed
Time-stamped abuse, proxy or infrastructure observations from named external sources.
Inferred
ASN type, reverse-DNS patterns, neighbour density and other heuristics that require context.
How the score is used
Each matched signal contributes a bounded adjustment. Strong evidence such as a current Tor exit can impose a risk floor; weak inferences cannot override authoritative facts. Missing or failed sources do not vote clean.
Conflicts and stale data
Conflicting providers remain visible. IPOK does not silently turn disagreement into a confident label. Time-sensitive observations carry timestamps, datasets are versioned, and corrections are reviewed against source evidence.
What IPOK does not claim
A network verdict does not identify a person, prove malicious intent, or predict a platform's private risk model. Use it to investigate and add proportionate friction—not as the sole reason to accuse or permanently block someone.