Detect · IP allocation age

How old is the range behind that IP?

Q: Where does IP allocation age come from?

From the delegated statistics the five RIRs (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) publish daily — the authoritative record of when each range was allocated or assigned and to which country. That's why evidence.allocation reads authoritative. We refresh the dataset daily; see attributions.

Q: Does allocation age change the risk score?

No — it carries zero risk weight. A young range is not evidence of abuse on its own; plenty of legitimate networks stand up new space. We return allocation_age_days as context for your rules, and we'd rather under-claim than bake a guess into the score. The published weights are in the risk-score methodology.

Q: What's registration_country — is it the user's location?

No. registration_country is where the range is registered with the RIR, which can differ from where traffic actually originates (the geo object). A mismatch between the two is itself useful context for your rules.

Q: Is this on the free tier?

Yes. allocation_date, allocation_age_days and registration_country are in every /v1/check response on every plan, free included — signal quality is never tiered.

Abusive infrastructure often runs on recently delegated space, before reputation lists catch up. GeoQ returns allocation_date, allocation_age_days and registration_country straight from the RIRs' delegated statistics — refreshed daily.

Fact + limit: allocation age is context with zero risk weight. A young range isn't abuse evidence by itself — it tells you where a second look is worth it.

What the dataset is

The five regional internet registries — ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC — publish delegated statistics daily: every allocated range, the delegation date and the registration country. It's the authoritative public record of address space, which is why these fields carry the authoritative evidence label.

We parse all five files each day and compute allocation_age_days at lookup time. No probing, no guessing — derived in the open, like every GeoQ dataset. Sources and cadence: methodology.

In your code

const res = await fetch("https://api.geoq.io/v1/check?ip=203.0.113.10", {
  headers: { "x-api-key": process.env.GEOQ_KEY },
});
const { network, geo } = await res.json();

// Freshly allocated range + hosting IP: context for a step-up, not a block.
if (network.allocation_age_days < 90 && network.is_announced) {
  requireEmailVerification(); // your rule, your threshold
}

// Registered country differs from observed geo? Another look-twice input.
if (network.registration_country !== geo.country_code) {
  flagForReview();
}

What you get back

Field	Meaning
`allocation_date`	The date the RIR delegated the range (e.g. `2026-04-18`).
`allocation_age_days`	Days since delegation, computed at lookup time.
`registration_country`	Where the range is registered with the RIR — not where traffic comes from.
`evidence.allocation`	`authoritative` — from the RIRs' own delegated statistics.

FAQ

IP allocation age — FAQ

Where does IP allocation age come from?

From the delegated statistics the five RIRs (ARIN, RIPE NCC, APNIC, LACNIC, AFRINIC) publish daily — the authoritative record of when each range was allocated or assigned and to which country. That's why evidence.allocation reads authoritative. We refresh the dataset daily; see attributions.

Does allocation age change the risk score?

No — it carries zero risk weight. A young range is not evidence of abuse on its own; plenty of legitimate networks stand up new space. We return allocation_age_days as context for your rules, and we'd rather under-claim than bake a guess into the score. The published weights are in the risk-score methodology.

Why would I look at allocation age at all?

Abusive infrastructure is often stood up on recently delegated or re-delegated space, before reputation lists catch up. A signup burst from ranges allocated in the last 30–90 days is a pattern worth a second look — combined with connection_type, rpki and your own velocity rules. One input, not a verdict.

What's registration_country — is it the user's location?

No. registration_country is where the range is registered with the RIR, which can differ from where traffic actually originates (the geo object). A mismatch between the two is itself useful context for your rules.

What does allocation_date mean for very old ranges?

Exactly what it says: the RIR delegated the range on that date — some IPv4 space dates to the 1980s. Old space can still be abused (it gets resold and re-leased), so age is context in both directions, never a verdict.

Is this on the free tier?

Yes. allocation_date, allocation_age_days and registration_country are in every /v1/check response on every plan, free included — signal quality is never tiered.