How fresh should IP risk evidence be? Decay, re-querying and caching

IP risk evidence should be no older than the churn of the network it describes, so query at decision time and never cache a verdict. Rotating residential exits and dial-up pools change hands in minutes to hours, datacenter and VPN infrastructure in days. An observation without a timestamp cannot be acted on, and one older than the churn window is a false positive waiting to happen — it now describes whoever inherited the address.

Three timestamps in every lookup

A real response, captured 2026-09-13 for an address that was being sold as a residential exit at the time:

{
  "ip": "122.99.101.50",
  "evidence_state": "active",
  "risk": { "score": 78, "level": "high", "tags": ["proxy"],
            "tag_details": [{ "tag": "proxy", "last_seen": "2026-09-13T11:47:58Z" }] },
  "network": { "asn": 17471, "usage_type": "DYN" },
  "computed_at": "2026-09-13T15:41:18Z",
  "meta": { "data_version": "risk:20260913234106 geo:20260913" }
}

risk.tag_details[].last_seen — when the behaviour behind each tag was last observed. Here the address was last seen as a proxy exit 3 h 53 min before the lookup.
computed_at — when this verdict was computed from that evidence. The score (78, not 100) already reflects those four hours of decay.
meta.data_version — which build of the risk and geolocation data produced it; the risk build carries a timestamp because it changes continuously.

How the score decays

Fresh observation — evidence_state: "active", score near the top of the range for that kind of evidence.
Ageing observation — still active, score falling with the age of last_seen. A four-hour-old residential exit already scores lower than a fresh one.
Beyond the churn window — evidence_state: "stale", score 0. The address was seen; it is probably somebody else's now. A weak prior, not a verdict.
Never seen — evidence_state: "none", score 0. No information — which is not the same as safe. See what an IP risk score means.

Datacenter and VPN infrastructure ages more slowly than residential exits because it changes hands more slowly; the response does not need a different contract for it, because the tag's last_seen and the decayed score already carry that difference.

Caching: what is safe and what is not

Safe: reusing one response within a single decision (a signup flow, a checkout) for the seconds it takes to complete it.
Not safe: caching verdicts across decisions or across users, feeding yesterday's lookups into today's rules, or storing "this address is a proxy" without the time it was observed. Every one of these turns a true statement into a false one on a timer you cannot see.
Store the time, not the label. Keep computed_at, evidence_state and source_url with the decision. A disputed block can then be traced back to what was observed and when, and a rule can be tested against evidence age instead of against a boolean.

How fresh the data behind the lookup is

The risk evidence is refreshed continuously and its build version carries a timestamp; the geolocation database is rebuilt daily; IP99's own observation of proxy supply runs every hour, and the weekly aggregate is published on Residential proxy exits observed this week. The detection page states the current data window in absolute dates.

FAQ

How old is too old for IP risk evidence?

Older than the churn of the network it describes. For rotating residential exits and dial-up pools that is minutes to hours; for datacenter and VPN infrastructure, days. IP99 encodes this as a decaying score and an evidence_state that turns stale once the last observation is beyond the window.

Can I cache IP risk lookups?

Only within a single decision, for the seconds it takes to complete it. Caching across decisions or users, or storing a label without its observation time, turns a true statement into a false one on a timer you cannot see. Store computed_at and evidence_state with the decision instead.

What does evidence_state stale mean?

The address was observed in risk infrastructure before and that observation is now older than the decay window, so the score is 0. It is a weak prior — the address probably belongs to someone else now — not a clean bill of health and not a verdict.

Why does every tag carry a last_seen time?

Because a verdict without an observation time cannot be acted on: it cannot be told apart from a verdict that expired last week. The time lets you apply your own freshness rule and lets a disputed decision be traced back to what was seen and when.

How often is the data behind IP99 updated?

Risk evidence continuously, with the build timestamp in meta.data_version; geolocation daily; IP99's own observation of proxy supply every hour, aggregated weekly on the proxy exits page.