How fresh should IP risk evidence be? Decay, re-querying and caching

IP risk evidence should be no older than the churn of the network it describes, so query at decision time and never cache a verdict. Rotating residential exits and dial-up pools change hands in minutes to hours, datacenter and VPN infrastructure in days. An observation without a timestamp cannot be acted on, and one older than the churn window is a false positive waiting to happen — it now describes whoever inherited the address.

How current a lookup is

A real response, captured 2026-09-13 for an address that was being sold as a residential exit at the time:

{
  "ip": "122.99.101.50",
  "evidence_state": "active",
  "risk": { "score": 78, "level": "high", "signals": ["proxy"] },
  "network": { "asn": 17471, "usage_type": "DYN" },
  "computed_at": "2026-09-13T15:41:18Z"
}

risk.signals — the signals that matched, as slugs (["proxy"] here): the address was observed in proxy supply. The old per-tag last_seen timestamp is gone with the rest of the tag block — signals are in risk.signals, and the seconds-level time belongs to the professional Pulse tier's evidence rows (captured_at / age_min), not to the free lookup.
computed_at — when this verdict was computed from that evidence. The score (78, not 100) already reflects the decay since that observation.
evidence_state — active / stale / none: how far the evidence behind the score has aged.

How the score decays

Fresh observation — evidence_state: "active", score near the top of the range for that kind of evidence.
Ageing observation — still active, score falling with the age of the observation. A four-hour-old residential exit already scores lower than a fresh one.
Beyond the churn window — evidence_state: "stale", score 0. The address was seen; it is probably somebody else's now. A weak prior, not a verdict.
Never seen — evidence_state: "none", score 0. No information — which is not the same as safe. See what an IP risk score means.

Datacenter and VPN infrastructure ages more slowly than residential exits because it changes hands more slowly; the response does not need a different contract for it, because evidence_state and the decayed score already carry that difference.

Caching: what is safe and what is not

Safe: reusing one response within a single decision (a signup flow, a checkout) for the seconds it takes to complete it.
Not safe: caching verdicts across decisions or across users, feeding yesterday's lookups into today's rules, or storing "this address is a proxy" without the time it was observed. Every one of these turns a true statement into a false one on a timer you cannot see.
Store the time, not the label. Keep computed_at and evidence_state with the decision. A disputed block can then be traced back to when it was observed, and a rule can be tested against evidence age instead of against a boolean.

How fresh the data behind the lookup is

The risk evidence is refreshed continuously and its build version carries a timestamp; the geolocation database is rebuilt daily; newly captured proxy exit addresses are aggregated hourly, and the weekly figures are published on Proxy exit addresses captured this week. The detection page states the current data window in absolute dates.

FAQ

How old is too old for IP risk evidence?

Older than the churn of the network it describes. For rotating residential exits and dial-up pools that is minutes to hours; for datacenter and VPN infrastructure, days. IP99 encodes this as a decaying score and an evidence_state that turns stale once the last observation is beyond the window.

Can I cache IP risk lookups?

Only within a single decision, for the seconds it takes to complete it. Caching across decisions or users, or storing a label without its observation time, turns a true statement into a false one on a timer you cannot see. Store computed_at and evidence_state with the decision instead.

What does evidence_state stale mean?

The address was observed in risk infrastructure before and that observation is now older than the decay window, so the score is 0. It is a weak prior — the address probably belongs to someone else now — not a clean bill of health and not a verdict.

Where is the observation time of each signal?

Seconds-level times are on the professional tier: each Pulse evidence row carries captured_at and age_min. The free lookup returns evidence_state and computed_at instead — a verdict without any observation time cannot be acted on, because it cannot be told apart from one that expired last week, and those two fields let you apply your own freshness rule and trace a disputed decision back to when it was observed.

How often is the data behind IP99 updated?

Risk evidence continuously, each observation carrying the time it was made; geolocation daily; IP99's own observation of proxy supply every hour, aggregated weekly on the proxy exits page.