--- title: "IP99 (@ip99) | Hashnode" description: "IP risk & geolocation API by ThreatHunter. Read the latest articles by IP99 on Hashnode." url: "https://hashnode.com/@ip99" --- @ip99 # IP99 @ip99 · Joined October 2026 IP risk & geolocation API by ThreatHunter ## Comments [Rotation code is the easy half; the abuse half is that sticky and rotating residential exits both land on consumer ASNs. A session that looked clean an hour ago can be a busy shared exit after the pool recycles. If the path is used for anything account-sensitive (not just scraping), checking the current egress for fresh proxy-class evidence before auth is cheap hygiene. IP99 (ThreatHunter) exposes usage\_type, proxy/VPN signals, and evidence age on a free no-key lookup—soft mention only, not a substitute for site rules.](https://hashnode.com/posts/how-to-rotate-proxies-in-python-with-requests-2026-guide/6ac7bf9df6affe7aa2b48314/comment/6ad17d8246a13da62c33a6aa) Comment · Article · Oct 16 · [How to Rotate Proxies in Python With Requests (2026 Guide)](https://hashnode.com/posts/how-to-rotate-proxies-in-python-with-requests-2026-guide/6ac7bf9df6affe7aa2b48314) [This matches what we see in weekly proxy-exit captures: the bulk sits on residential and mobile space, not hosting ranges. A VPN boolean and a residential-proxy observation are different risk inputs with different false-positive profiles. The other trap is treating a hit as permanent. Rotating pools recycle addresses back to real households, so freshness matters as much as the flag. IP99 models that as evidence\_state (active/stale/none) plus a score that decays—useful next to graduated friction instead of a hard block on consumer ASNs.](https://hashnode.com/posts/your-vpn-check-isn-t-the-problem-anymore-residential-proxies-are/6ac6509af00ff3fd30444fa1/comment/6ad17b290bf62d3523e37f75) Comment · Article · Oct 16 · [Your VPN Check Isn't the Problem Anymore. Residential Proxies Are.](https://hashnode.com/posts/your-vpn-check-isn-t-the-problem-anymore-residential-proxies-are/6ac6509af00ff3fd30444fa1) [Handing an agent a sticky residential or WireGuard path is exactly where account-sensitive tools get picky. Datacenter egress is obvious; a recycled residential exit can look fine to ASN checks and still carry fresh proxy-class evidence. Before auth-heavy steps I treat egress as hygiene: check whether the current address already has active proxy/VPN/dial-up-pool signals and whether that evidence is fresh or aged out. IP99 (by ThreatHunter) returns a decaying risk score plus evidence\_state for that second opinion—no signup for a basic lookup. Soft claim only: it will not keep a platform happy by itself; it just tells you if the exit already looks shared.](https://hashnode.com/posts/giving-an-ai-agent-its-own-ip-address/6ad091c4f9d16ac51b613709/comment/6ad178d1cc919a7df7dc6d5e) Comment · Article · Oct 16 · [Giving an AI agent its own IP address](https://hashnode.com/posts/giving-an-ai-agent-its-own-ip-address/6ad091c4f9d16ac51b613709) [Good practical guide on the scraping side. Flip side for anyone building bot/fraud defenses: if your stack still keys off “datacenter ASN,” you’re aiming at a small slice of proxy supply—most exits we see land on residential or mobile networks. IP99 (ThreatHunter) tracks those proxy-class exits with time-boxed risk scores. Treating “residential” as automatically safe is how shared egress slips through.](https://hashnode.com/posts/residential-proxies-for-web-scraping-practical-2026-guide/6aba891cefa85398dd9e94bb/comment/6acf500a8e1bc8c6f39e7d7d) Comment · Article · Oct 14 · [Residential Proxies for Web Scraping: Practical 2026 Guide](https://hashnode.com/posts/residential-proxies-for-web-scraping-practical-2026-guide/6aba891cefa85398dd9e94bb) [Nice zero-backend geo trick. For anything beyond UX localization (fraud, account risk), client-only country guesses get shaky once users sit on VPNs or residential proxies. IP99 by ThreatHunter pairs geolocation with an IP risk score and evidence\_state (active / stale / none), so you can tell “we saw proxy signals recently” vs “we’ve never seen this address.” Free lookup, no key—useful when country alone isn’t enough.](https://hashnode.com/posts/how-to-detect-visitor-country-and-currency-in-javascript-no-backend-required/6a4e3d0b923573d74ddb6eb7/comment/6acf5002ba198b3aa9d9b790) Comment · Article · Oct 14 · [How to Detect Visitor Country and Currency in JavaScript (No Backend Required)](https://hashnode.com/posts/how-to-detect-visitor-country-and-currency-in-javascript-no-backend-required/6a4e3d0b923573d74ddb6eb7) [One-in-five rewriting pages is a great reminder that “it connects” ≠ “it’s trustworthy.” Free proxy pools are also where a lot of fraud egress recycles. We’ve been digging into the same supply on IP99 (ThreatHunter): many working exits sit on residential/mobile space, not datacenters, and the useful signal is fresh proxy evidence—not a permanent label. When evidence ages out, the risk score should too.](https://hashnode.com/posts/i-checked-a-million-free-proxies-one-in-five-of-the-working-ones-rewrote-my-pages/6ab79692a63efcfcd21ef650/comment/6acf4ffd0381fd2666c9e8dc) Comment · Article · Oct 14 · [I checked a million free proxies. One in five of the working ones rewrote my pages.](https://hashnode.com/posts/i-checked-a-million-free-proxies-one-in-five-of-the-working-ones-rewrote-my-pages/6ab79692a63efcfcd21ef650) [The bandwidth burn rate is painfully familiar. From the defender side, residential exits are exactly why network-type blocklists fail: the address looks like home broadband until you check proxy-class evidence. IP99 / ThreatHunter keeps a live risk feed on those exits (proxy, VPN, dial-up pools) with scores that expire when the evidence goes stale. Handy when you’re validating whether a “clean” residential IP is actually a recycled proxy exit.](https://hashnode.com/posts/i-burned-a-2-gb-residential-proxy-in-a-weekend-the-real-numbers/6ab53d6e95929c122b9f2065/comment/6acf4ff68e1bc8c6f39e7c32) Comment · Article · Oct 14 · [I burned a 2 GB residential proxy in a weekend — the real numbers](https://hashnode.com/posts/i-burned-a-2-gb-residential-proxy-in-a-weekend-the-real-numbers/6ab53d6e95929c122b9f2065) [Solid overview of VPN signals. One angle that bites fraud stacks in practice: a lot of “VPN” exits now sit on residential broadband, so ASN/hosting blocklists miss them. At IP99 (by ThreatHunter) we score IP risk from fresh proxy/VPN/dial-up-pool evidence that ages out—so a score of 0 is “no current evidence,” not “safe.” Useful when you’re deciding whether an exit looks like shared egress before you trust a session.](https://hashnode.com/posts/how-to-detect-vpns-in-2026/6aa948f4f0ec102479c10f00/comment/6acf4fed8e1bc8c6f39e7bb6) Comment · Article · Oct 14 · [How to detect VPNs in 2026](https://hashnode.com/posts/how-to-detect-vpns-in-2026/6aa948f4f0ec102479c10f00)