Reading usage_type: 20 Network Scene Codes That Aren't a Risk Verdict

A usage_type of IDC is not a reason to refuse a customer, and DYN is not a reason to trust one. On IP99 by ThreatHunter, network.usage_type is a network scene code: what kind of network the address sits on. It is not a risk verdict, not attacker probability, and not a synonym for hosting or proxy.

This walkthrough stays on free, no-key GET /v1/ip/{ip}. JSON samples were verified on 11 November 2026 UTC. Notes: IP99, API, IP location, IP risk score.

What usage_type is (and what it is not)

The free lookup returns a 0–100 risk.score for freshness and strength of verifiable risk evidence, not attacker probability. risk.level follows the score (0 → none, 1–29 → low, 30–69 → medium, 70–100 → high). Signals appear only when they hit. Branch on evidence_state (active / stale / none) before the score: 0 + none is a coverage gap, not a clean bill of health.

network.usage_type is passed through unchanged when the scene database covers the block. Official docs list 20 codes they have a localised name for. That table is not closed: an unrecognised code is not an error — treat it as unknown rather than dropping the record. A missing usage_type key means unknown, not a zero. Operator names are never returned; the machine identity is network.asn.

Group	Official codes
Access	DYN residential broadband · MOB mobile · GTW enterprise gateway / NAT · WLA WLAN hotspot · DDT dedicated egress
Hosting / infra	IDC datacenter · CDN content delivery · DNS DNS service · ANY anycast · IXP internet exchange · NET network infrastructure
Institution	EDU education · GOV government · ORG organisation
Special / unrouted	SAT satellite · BOGON reserved / bogon · AUR allocated but unrouted · RNU routed but unused · UND unallocated · USE in use

False equivalents:

1. usage_type ≠ a risk score. Scene is the network; risk.signals and evidence_state are the observations. Official triage: evidence_state → score/level → signal type → usage_type (then share_tier on Pulse).
2. IDC ≠ DNS ≠ CDN. A famous resolver may still be labelled IDC; another resolver or a CDN edge may carry a more specific code.
3. IDC ≠ proxy. Public DNS and ordinary cloud sit on IDC with score 0 every day. The same scene can also host an observed proxy exit.
4. DYN / MOB ≠ clean. Most newly seen proxy-class exits sit in residential or mobile space, so a residential allowlist has no precision against that supply.
5. hosting / mobile are attributes derived from usage type, not risk verdicts. Do not ban on those slugs alone.

Free /v1/ip does not return share_tier or evidence[] (Pulse / professional only). Gauge network shape from usage_type: treat MOB / GTW as likely shared and prefer step-up over a hard IP ban.

A famous resolver is IDC, not DNS

curl https://ip99.com/v1/ip/8.8.8.8

Verified 11 November 2026 UTC:

{
  "ip": "8.8.8.8",
  "computed_at": "2026-11-11T13:13:09Z",
  "evidence_state": "none",
  "geo": { "continent": "NA", "country": "US", "region": "California", "city": "Mountain View", "tz": "America/Los_Angeles" },
  "network": { "asn": 15169, "usage_type": "IDC" },
  "risk": { "score": 0, "level": "none", "signals": ["hosting"] }
}

Google Public DNS is a resolver, but the scene code here is IDC, with hosting as a network attribute. Score 0 and evidence_state: none mean no current verifiable proxy-class evidence — not "safe," and not a reason to refuse the address.

A different public resolver, 4.2.2.1 (ASN 3356, Los Angeles), carries DNS in the same snapshot: score 0, evidence_state: none, and no risk.signals key — same job, two scene codes. Also in this snapshot (all score 0, none): 104.16.132.229 is CDN with hosting (ASN 13335); 18.26.0.1 is EDU (ASN 3, Cambridge, Massachusetts). 192.0.2.1 (TEST-NET-1) returns usage_type: BOGON and no ASN; 192.168.1.1 returns HTTP 400 reserved_ip ("private or reserved address has no public risk profile").

Same IDC scene, opposite evidence

curl https://ip99.com/v1/ip/178.20.30.146

Verified 11 November 2026 UTC:

{
  "ip": "178.20.30.146",
  "computed_at": "2026-11-11T13:13:21Z",
  "evidence_state": "active",
  "geo": { "continent": "EU", "country": "FR", "region": "Île-de-France", "city": "Paris", "tz": "Europe/Paris" },
  "network": { "asn": 46475, "usage_type": "IDC" },
  "risk": { "score": 80, "level": "high", "signals": ["hosting", "osint", "proxy"] }
}

Same IDC + hosting space as the public resolver above, but the slugs here include proxy and osint. Branch on each matched signal, not on the scene. Scores decay — this address scored 84 earlier the same UTC day — so re-curl for a live snapshot.

Most new proxy supply is not in that IDC slice. Official API docs include a residential (DYN) demo whose 17 September 2026 capture carried proxy alone (last octet masked: 86.111.136.x, ASN 15547). An IDC-only blocklist under-covers that majority.

What the weekly capture mix says

Between 4–10 November 2026 (UTC), IP99 captured 10,561,845 new proxy-class exit addresses (+2% vs the previous 7 days). By usage type: 80.0% residential, 12.1% mobile, 3.9% gateway/NAT, 3.2% datacenter, 0.5% education. 59 upstream sources. Figures generated 11 November 2026, 12:36 UTC. Source: proxy-exits. Aggregates only; no address lists.

That is first-party proxy-class observation (proxy, VPN, dial-up pool, cloud phone, or hijacked shared proxy), newly seen in the window, not a global census. More than 92% sit in residential or mobile space. usage_type tells you where the address lives, and how wide a ban would reach, not whether the session is abusive.

A practical branch (evidence_state first)

Generic guidance (not a contract): score 0 → do not stamp "clean"; 1–29 → observe; 30–69 → captcha / throttle / second factor; 70–100 → block only when business cost allows, and not at building scale. Score meaning: IP risk score.

1. Read evidence_state, then risk.signals, then network.usage_type and network.asn.
2. On MOB or GTW, assume a wide NAT. Prefer CAPTCHA, rate limits, or a lower weight — one IP ban can be one building or a carrier pool.
3. On DYN, do not allowlist the scene. Check whether proxy, dialup_pool, vpn, or hijacked_proxy is active.
4. On IDC, CDN, or DNS with only hosting (or no signals) and evidence_state: none or stale, do not treat the scene as guilt. IDC plus active proxy / vpn is a different playbook.
5. If hijacked_proxy is present: challenge; do not ban the account (the owner is the victim).
6. Never mark score 0 + evidence_state: none as "trusted clean." Re-query at decision time and store computed_at. Treat an unrecognised or missing usage_type as unknown.

Anonymous quota is 500 lookups/day per client IP (60/min); a free logged-in key raises the daily cap to 5,000/day. Check remaining with GET https://ip99.com/v1/me or the X-Daily-* headers. OpenAPI: https://ip99.com/openapi.json. Pricing: https://ip99.com/en/pricing.

Do not treat IP99 scores as identical to other ThreatHunter datasets — this article only claims what free /v1/ip and the cited product pages document.

Try it

curl https://ip99.com/v1/ip
curl https://ip99.com/v1/ip/8.8.8.8
curl https://ip99.com/v1/ip/4.2.2.1
curl https://ip99.com/v1/ip/178.20.30.146
curl https://ip99.com/v1/me

IP99 is a ThreatHunter product. Use the free lookup to read network scene (usage_type) separately from current risk evidence — before an IDC blocklist drops a public resolver or a residential allowlist waves through proxy supply. Start at https://ip99.com; read IP location, proxy-exits, and https://ip99.com/api.