IP Lens
Tags Docs

Tools

Bot IP rangesProvider IP rangesASN lookupCIDR lookupIP subnet calculatorReverse DNS lookupBrowser Info
Theme System Light Dark

IP intelligence

IP address tags

IP Lens uses tags to describe network roles, services, and observed risk indicators. Tags provide context about an address or network. intent, or behavior.

Threats

Malicious activity and serious security risk signals.

Threats

Phishing

Associated with phishing or credential-theft activity.

View tag

Threats

Spam

Associated with unsolicited or abusive email, forum, or form submissions.

View tag

Threats

Email Spam

Associated with unsolicited or abusive email sending or related infrastructure.

View tag

Threats

Form Spam

Associated with unsolicited or abusive form, forum, comment, or registration submissions.

View tag

Privacy and proxying

Infrastructure that relays, proxies, or obscures network traffic.

Privacy and proxying

Tor Exit

Tor relay that can originate traffic onto the public internet. A service sees the exit address, not the original client, and Tor use alone does not prove abuse.

View tag

Privacy and proxying

VPN

VPN infrastructure used by privacy or corporate VPNs and provider-operated gateways to relay traffic. Its exit location may not be the user's physical location.

View tag

Privacy and proxying

Public Proxy

Free or publicly accessible proxy infrastructure. This tag does not cover every commercial or residential proxy service.

View tag

Privacy and proxying

Tor

Infrastructure participating in the Tor network. The tag describes a network role, not the person behind traffic or their intent.

View tag

Privacy and proxying

Private Relay

Provider-operated privacy relay that separates users from destination services.

View tag

Privacy and proxying

Secure Web Gateway

Managed gateway that filters or brokers web traffic for users.

View tag

Privacy and proxying

Tor Relay

Tor relay, including non-exit relays within the Tor network.

View tag

Bots and crawlers

Automated agents, crawlers, and fetchers that retrieve or interact with online content.

Bots and crawlers

Bot

Known crawler or automated agent infrastructure.

View tag

Bots and crawlers

Search Crawler

Crawler operated to discover or index content for a search service.

View tag

Bots and crawlers

AI Crawler

Crawler operated to collect or retrieve content for an AI service.

View tag

Bots and crawlers

SEO Crawler

Crawler operated for site auditing, link analysis, or search performance research.

View tag

Bots and crawlers

Advertising Crawler

Crawler operated to fetch, validate, or evaluate content for advertising services.

View tag

Bots and crawlers

Web Crawler

General-purpose crawler or automated page-fetching infrastructure.

View tag

Bots and crawlers

User-Triggered Agent

Agent infrastructure used to retrieve or interact with content in response to a user action.

View tag

Bots and crawlers

User-Triggered Fetcher

Fetcher infrastructure used to retrieve a URL in response to a user or application action.

View tag

Scanners

Infrastructure that probes internet hosts, ports, and services for research, measurement, or other purposes.

Scanners

Port Scanning

Infrastructure that scans internet hosts for open ports or exposed services.

View tag

Scanners

Research Scanner

Scanning infrastructure operated for security research or internet-wide measurement.

View tag

Lists and interventions

External restrictions, security lists, and defensive interventions.

Lists and interventions

Sanctions

Listed by a source that identifies targets subject to economic or legal sanctions.

View tag

Domain infrastructure

Infrastructure associated with how domains are operated or used.

Domain infrastructure

Domain Parking

IP address or network associated with infrastructure used to host parked domains.

View tag

Address and routing

Address-space and routing characteristics.

Address and routing

Bogon

Reserved, unallocated, or otherwise not globally routable IP address space.

View tag

Address and routing

Anycast

IP prefix announced from multiple network locations at the same time.

View tag

Services

Recognized infrastructure roles and network services.

Services

Public DNS

Public DNS resolver or authoritative name-server infrastructure.

View tag

Services

Mail Server

Infrastructure used to send or receive email.

View tag

Services

Network Time Protocol

Public server or pool used to synchronize clocks over a network.

View tag

Services

Monitoring

Uptime, network-monitoring, or probe infrastructure.

View tag

Services

Webhook

Infrastructure used to send webhook callbacks.

View tag

Services

Continuous Integration

Infrastructure used to build and test software changes automatically.

View tag

Services

Game Server

Infrastructure used to host or support online games.

View tag

Network and hosting

Network placement and hosting characteristics.

Network and hosting

Cellular

IP address associated with a cellular or mobile access network.

View tag

Network and hosting

Content Delivery Network

Network infrastructure that delivers cached content or reverse-proxies traffic.

View tag

Network and hosting

Hosting

Cloud, hosting, or provider infrastructure that may run servers, gateways, monitoring systems, or VPN endpoints. It does not imply suspicious traffic or a user in the provider's registered city.

View tag

Network and hosting

Cloud Service

Cloud or online-service infrastructure without a narrower public role.

View tag

Content and use

The content, service, or activity associated with a target.

Content and use

Tracking

Advertising, analytics, or tracking infrastructure.

View tag

Content and use

Cryptocurrency Related

Associated with a cryptocurrency project, exchange, protocol, infrastructure, or activity. A source listing is not a safety endorsement.

View tag

Can one IP address have several tags?

Yes. Tags can describe compatible aspects of one endpoint. The 9.9.9.9 result can show Public DNS for its service role and Anycast for how that service is delivered.

Multiple tags are not multiple verdicts. A tag can also come from a containing range, so check the real client IP, event time, and observed behavior before acting.

How should I use IP address tags?

Treat tags as clues, not legal or operational proof. Read them alongside the Registered Owner, observed origin Autonomous System Number (ASN), reverse DNS, and location sections.

Bot, hosting, VPN, proxy, Tor, scanner, and Bogon tags can identify traffic that deserves a closer look. They do not prove that a request is abusive, and one tag should not automatically block an entire range. For crawler traffic, follow the operator checks in Search bot verification.

What should I verify before acting on a tag?

Check the event timestamp, request and account behavior, source port where relevant, real client IP, registration context, and whether the address was shared or reassigned. Prefer narrow, reversible controls such as a challenge or short rate limit over a permanent block based only on a tag.

How do I report a correction?

Record the result URL, address, tag, event time, and evidence showing the address or range's current role. Then send the request through the IP Lens Contact page. A correction may require verification and may not appear immediately.