ip-purity-checklisted

# IP Purity Check Judge how "clean" an IP address is and what it is safe to use for. **Purity is about who is behind the IP, not whether the IP is malicious right now.** A residential broadband IP with no abuse history is *clean*; a datacenter, VPN, proxy, or Tor exit is *impure* even when it has never attacked anyone, because it hides the real user and gets treated as high-risk by risk-control systems. Two numbers drive every verdict: - **clean_score** (0–100, higher = cleaner) — how residential / person-owned the IP looks. - **risk_score** (0–100, higher = worse) — how much active abuse / threat signal it carries. They are independent. A clean home IP can still be risky if it is on a spam blocklist; a datacenter IP can be low-risk yet still impure. Always report both. ## The toolset IP purity is the core, but the same data foundation answers four entity types. The three companions exist because a good purity verdict often needs the context around the IP: | Ask about… | Lookup | Adds | |------------|--------|------| | an **IP** | purity verdict | the core clean/risk assessment | | an **ASN** | network reputation (`isp_type`, `reputation_tier`, `ioc_density`) | *what network is this IP in?* — a hosting/high-IOC ASN drags purity down | | a **MAC** | OUI vendor (device maker, IEEE registry) | *what device is this?* — identifies the NIC vendor; flags randomized/private MACs | | a **domain** | WHOIS + age + reputation | *is a hosted domain trustworthy?* — young, low-rep