Telling a rack apart from a living room

What it is

A hosted address is a machine in a rack rather than a connection in a home. That is a statement about where the traffic originates and nothing more: it is not a statement about intent, and most hosted traffic on the internet is perfectly legitimate.

Whether it matters depends entirely on what you are protecting. For an API it means nothing. For a game client it is close to conclusive, because nobody plays from a rack.

How we actually know

Seven providers publish their ranges as a file and we refetch all seven on every nightly rebuild: Amazon AWS, Google Cloud, Oracle Cloud, Vultr, Cloudflare, DigitalOcean and Linode. Where a range belongs to one of them, its name comes back in network.cloud, so you can act on the provider rather than only on the category.

Those seven are the ones we can attribute. A broader datacentre range list covers the hosts that publish nothing, and those addresses come back flagged as hosting with network.cloud left null. Null there means we could not name the provider, never that the range is not hosted.

What to read in the response

What this flag does not mean

Hosting contributes 30 out of 100 to the score, the lowest weight of any signal we publish, and that is deliberate. A VPN or a Tor address weighs 100 because it exists to hide someone. A datacentre address usually exists because somebody deployed a server.

So the score will rarely condemn an address on hosting alone, and if your product needs it to, read the boolean rather than the number. The flag answers "is this a home connection". It does not answer "is this abuse", and no honest signal built from a published range list ever could.

Wiring it up

// Act on the provider, not only on the category. Blocking every hosted address
// is a policy; blocking the three providers your abuse actually comes from is
// usually the one you meant.
const WATCHED = new Set(["Amazon AWS", "DigitalOcean", "Vultr"]);

if (check.hosting && WATCHED.has(check.network.cloud)) return challenge();

// cloud is null for hosted ranges we cannot attribute, so this stays a separate
// question from "is it hosted at all".
if (check.hosting) return flagForReview();

What happens on an address nobody has seen

An address the database holds nothing on answers 404, not a low score. That is deliberate: there is no country, no operator and no ASN to return either, so a result would be a row of nulls dressed up as an answer. Treat it as no opinion rather than as clean, and decide for your own case whether to let the request through. The address goes into the scan queue and usually resolves within minutes, and the call is free on a paid plan.

Every field, every error code and the exact billing rules are in the documentation. Endpoints

The other detections, explained the same way

• Tor
• Residential proxies