--- title: "IP99 (@ip99) | Hashnode" description: "IP risk & geolocation API by ThreatHunter. Read the latest articles by IP99 on Hashnode." url: "https://hashnode.com/@ip99" --- @ip99 # IP99 @ip99 · Joined October 2026 IP risk & geolocation API by ThreatHunter ### [Reading usage\_type: 20 Network Scene Codes That Aren't a Risk Verdict](https://ip99.hashnode.dev/reading-usage-type-20-network-scene-codes-that-aren-t-a-risk-verdict?utm_source=hashnode&utm_medium=feed) A usage\_type of IDC is not a reason to refuse a customer, and DYN is not a reason to trust one. On IP99 by ThreatHunter, network.usage\_type is a network scene code: what kind of network the address si 6 min read · [ip99.hashnode.dev](https://ip99.hashnode.dev/reading-usage-type-20-network-scene-codes-that-aren-t-a-risk-verdict?utm_source=hashnode&utm_medium=feed) [44m ago](https://hashnode.com/posts/reading-usage-type-20-network-scene-codes-that-aren-t-a-risk-verdict/6af46ceef50d6138ae3ad5c9) ### [Is This IP a Proxy? Reading the proxy Signal Without Blanket Blocks](https://ip99.hashnode.dev/is-this-ip-a-proxy-reading-the-proxy-signal-without-blanket-blocks?utm_source=hashnode&utm_medium=feed) Blanket-blocking every address tagged proxy treats an exit observation as a person-level verdict. On IP99 by ThreatHunter, proxy means something narrower: this address is currently being used as a pro 6 min read · [ip99.hashnode.dev](https://ip99.hashnode.dev/is-this-ip-a-proxy-reading-the-proxy-signal-without-blanket-blocks?utm_source=hashnode&utm_medium=feed) [3h ago](https://hashnode.com/posts/is-this-ip-a-proxy-reading-the-proxy-signal-without-blanket-blocks/6af445f1d72a1249e0664df8) ### [This Week's Proxy Exits: 10.6M New Addresses, Still Almost All Off Datacenter Space](https://ip99.hashnode.dev/this-week-s-proxy-exits-10-6m-new-addresses-still-almost-all-off-datacenter-space-4-10-nov?utm_source=hashnode&utm_medium=feed) Datacenter blocklists still look like the default proxy defence in a lot of fraud stacks. The addresses showing up in proxy supply this week were still mostly not in datacenters. The datacenter slice 6 min read · [ip99.hashnode.dev](https://ip99.hashnode.dev/this-week-s-proxy-exits-10-6m-new-addresses-still-almost-all-off-datacenter-space-4-10-nov?utm_source=hashnode&utm_medium=feed) [3h ago](https://hashnode.com/posts/this-week-s-proxy-exits-10-6m-new-addresses-still-almost-all-off-datacenter-space-4-10-nov/6af43f5dfeb1aee66dcc774f) ### [Don't Ban on a Public List Alone: Reading osint on IP99](https://ip99.hashnode.dev/don-t-ban-on-a-public-list-alone-reading-osint-on-ip99?utm_source=hashnode&utm_medium=feed) Public IP blocklists feel definitive: if an address showed up in open-source intelligence, refuse it. That treats a listing as a permanent identity. Addresses change hands; community lists refresh on 8 min read · [ip99.hashnode.dev](https://ip99.hashnode.dev/don-t-ban-on-a-public-list-alone-reading-osint-on-ip99?utm_source=hashnode&utm_medium=feed) [3d ago](https://hashnode.com/posts/don-t-ban-on-a-public-list-alone-reading-osint-on-ip99/6af07642b9adf6151e0d32d5) ### [Serverless Exits Still Leave Fingerprints: Reading cloud\_service on IP99](https://ip99.hashnode.dev/serverless-exits-still-leave-fingerprints-reading-cloud-service-on-ip99?utm_source=hashnode&utm_medium=feed) Serverless and cloud-function platforms share egress. Your webhook, cron, or Lambda-style worker can look identical on the wire to someone else's — same ASN, same hosting NAT. Blanket-blocking every I 6 min read · [ip99.hashnode.dev](https://ip99.hashnode.dev/serverless-exits-still-leave-fingerprints-reading-cloud-service-on-ip99?utm_source=hashnode&utm_medium=feed) [4d ago](https://hashnode.com/posts/serverless-exits-still-leave-fingerprints-reading-cloud-service-on-ip99/6aef256e3a3d9a6476c6845f)