IPv4 / IPv6 pool

The CIDR intelligence pool behind routing and fraud scoring — classifications, sources, sync, tenant ranges and IPv6 normalisation.

Updated 2026-09-02

What it is#

IpRange is a Postgres table of CIDR blocks (cidr type with a GiST index) with a classification, ASN / organisation, optional geo, a risk weight and a source. Every click does one longest-prefix lookup (cidr >>= inet) — typically under a millisecond — and the result feeds both routing (ipType, asn) and the fraud score.

Classifications#

`ipType`	Examples
`RESIDENTIAL`	ISP ranges (default when no other source matches)
`MOBILE`	Carrier ranges
`DATACENTER`	AWS, GCP, Azure, Oracle, DigitalOcean, Linode, Hetzner, OVH …
`CDN`	Cloudflare, Fastly, Akamai
`VPN`	Commercial VPN egress aggregates
`PROXY`	Open / rotating proxy lists
`TOR`	Tor exit nodes
`SEARCH_BOT`	Verified Googlebot, Bingbot, Applebot ranges (allowlisted)
`TENANT_ALLOW` / `TENANT_BLOCK`	Your own ranges (office IPs, known-bad partners)

Sources and sync#

pnpm ippool:sync (or POST /api/admin/ippool/sync, scheduled daily) pulls the public feeds: cloud-provider JSON ranges, Tor exit list, VPN / datacenter aggregates, Cloudflare and Fastly ranges, Googlebot / Bingbot allowlists. Each source is replaced atomically; IpSourceSync records counts and timestamps.

Optional MaxMind GeoLite2 CSVs add country / region / city blocks: pnpm ippool:geolite <dir> (requires a MaxMind licence).

Tenant ranges#

Protect → IP pool → Your ranges: add CIDRs with allow or block and a note. Tenant ranges take precedence over public sources in lookups and are exported to Google Ads exclusions when blocked.

IPv6#

Addresses are normalised (expanded, IPv4-mapped ::ffff:a.b.c.d → IPv4).
Rate limits, frequency signals and blocklist entries aggregate at /64 (rateKey).
Google Ads exclusions use the /64 form (exclusionForm).
Household matching uses /48.

Lookup API#

Dashboard: Protect → IP pool → Lookup, or GET /api/dashboard/ippool/lookup?ip=…. Agents: MCP lookup_ip.

lookup_ip result (abridged)

{ "ip": "2a06:98c0:3600::103", "version": 6, "rate_limit_key": "2a06:98c0:3600::/64", "google_ads_exclusion_form": "2a06:98c0:3600::/64",
  "pool": { "classification": { "category": "CDN", "source": "cloudflare", "asn": "13335", "org": "Cloudflare" }, "geo": null, "matches": 1 },
  "intel": { "type": "CDN", "isHosting": true, "isVpn": false, "isProxy": false, "isTor": false, "provider": "pool" } }