Reading usage_type: 20 Network Scene Codes That Aren't a Risk VerdictA usage_type of IDC is not a reason to refuse a customer, and DYN is not a reason to trust one. On IP99 by ThreatHunter, network.usage_type is a network scene code: what kind of network the address si6 min read·ip99.hashnode.dev37m ago
Is This IP a Proxy? Reading the proxy Signal Without Blanket BlocksBlanket-blocking every address tagged proxy treats an exit observation as a person-level verdict. On IP99 by ThreatHunter, proxy means something narrower: this address is currently being used as a pro6 min read·ip99.hashnode.dev3h ago
This Week's Proxy Exits: 10.6M New Addresses, Still Almost All Off Datacenter SpaceDatacenter blocklists still look like the default proxy defence in a lot of fraud stacks. The addresses showing up in proxy supply this week were still mostly not in datacenters. The datacenter slice6 min read·ip99.hashnode.dev3h ago
Don't Ban on a Public List Alone: Reading osint on IP99Public IP blocklists feel definitive: if an address showed up in open-source intelligence, refuse it. That treats a listing as a permanent identity. Addresses change hands; community lists refresh on8 min read·ip99.hashnode.dev3d ago
Serverless Exits Still Leave Fingerprints: Reading cloud_service on IP99Serverless and cloud-function platforms share egress. Your webhook, cron, or Lambda-style worker can look identical on the wire to someone else's — same ASN, same hosting NAT. Blanket-blocking every I6 min read·ip99.hashnode.dev4d ago
