Data study · IP reputation transparency
One IP, six sources, six different votes
Most IP checkers hand you one black-box score — 87, “high risk.” But behind that number, the “authoritative” reputation sources routinely disagree about the same IP. We ran a set of verifiable IPs through 6 independent sources and surfaced every vote. Disagreement is more common than you’d think — and a single-source verdict is not reliable.
Exhibit A · A single source mislabels a legit datacenter
An AWS IP, tagged “proxy” by one source
Take 3.5.140.1 (AWS us-east). Of 6 sources, 3 just call it a datacenter — but one insists it’s a proxy, another says vpn. A checker wired to only that one source would tell you this legitimate AWS IP is a proxy and high-risk — which is wrong. IPOK’s consensus gate (a datacenter IP needs ≥2 dedicated sources to agree before it’s called a proxy) suppresses the lone vote, so the score lands at 35 (datacenter), not 65 (proxy).
The lone vote gets suppressed: proxy and vpn have just 1 vote each — short of the ≥2-dedicated-source consensus a datacenter IP needs. Swap in a single-source tool and the verdict could be the opposite.
Why a threshold · real VPN vs mislabeled datacenter
Same vote pattern, different verdict
NordVPN exit 45.83.91.1 and AWS’s 52.94.236.248 look almost identical — both are “3 sources say datacenter + some proxy votes.” Yet one scores 65 (proxy, a real VPN) and the other 35 (datacenter, mislabel suppressed). The difference isn’t which source wins — it’s whether the consensus threshold is met.
The flip side · when sources agree, the signal is strong
When 4 sources all say “Tor”
Disagreement doesn’t mean every signal is noise — the opposite. On the known Tor exit 185.220.101.1, 4 of 6 sources call it Tor outright, plus 3 report abuse history. When multiple independent sources converge, that’s a genuinely trustworthy high-risk call — score 90. That’s the whole point of transparency: you can see at a glance whether a verdict is unanimous or one source’s solo opinion.
Full data · votes for all 14 IPs
Everything, laid bare
Each IP shows its votes per risk category (count / online sources). The denominator is how many sources actually voted that run — free sources occasionally hit quota and drop out, and a dropped source honestly leaves the denominator rather than casting a phantom abstention. A colored border marks a category with disagreement (some voted, some didn’t).
| IP | Category | Risk | Votes (count / online sources) |
|---|---|---|---|
| 8.8.8.8 | Google DNS | 2 | hosting 1/5 |
| 1.1.1.1 | Cloudflare DNS | 11 | hosting 1/6 |
| 9.9.9.9 | Quad9 DNS | 6 | — no risk votes — |
| 208.67.222.222 | OpenDNS · Cisco | 3 | hosting 1/6 |
| 94.140.14.14 | AdGuard DNS | 35 | hosting 2/6 |
| 77.88.8.8 | Yandex DNS | 6 | hosting 1/5 |
| 114.114.114.114 | 114 DNS · China Telecom | 35 | proxy 1/6hosting 1/6 |
| 104.16.132.229 | Cloudflare CDN | 2 | hosting 1/5 |
| 3.5.140.1 | AWS us-east | 35 | proxy 1/6vpn 1/6hosting 3/6 |
| 52.94.236.248 | AWS | 35 | proxy 2/6vpn 1/6hosting 3/6 |
| 34.117.59.81 | Google Cloud | 55 | proxy 1/6vpn 1/6hosting 2/6abuser 1/6 |
| 45.83.91.1 | NordVPN exit · M247 | 65 | proxy 2/6vpn 2/6hosting 3/6 |
| 185.220.101.1 | Known Tor exit | 90 | Tor 4/6proxy 2/6vpn 1/6abuser 3/6 |
| 128.101.101.101 | Univ. of Minnesota | 1 | — no risk votes — |
One line: don’t trust a single black-box score — demand to see the votes.
Whether an IP is clean is never one vendor’s call. Lay several independent sources side by side, let the disagreement show itself, and only then can you tell a trustworthy consensus from a lone misfire.
Data collected with ipok.io’s live multi-source detection — it shows this “who voted” breakdown on every IP check. All sample IPs are publicly verifiable infrastructure / DNS / datacenter / VPN / Tor addresses.
Note: IP reputation is inherently noisy and changes over time; a risk score is a signal, not a verdict — thresholds differ across platforms, so cross-verify. Snapshot 2026-07, reproducible with the same IPs.