How IP risk is assessed

Learn how CHA.LA combines network attributes, registration data, public intelligence and observations to assess IP risk.

Current version: Risk assessment rules v1

How we assess an IP

CHA.LA organizes verifiable network signals into a risk value and a native IP assessment, helping you understand an IP's network context and public risk indicators. Results reflect the evidence available now and may change as data is updated.

How the risk value is formed

The risk value combines independent signals. Public intelligence, hosting characteristics, and registration or geolocation inconsistencies can increase risk; a lack of observations is not automatically treated as safe. Confidence increases as evidence coverage improves.

Risk value levels

Low risk：No clear adverse signal was found in the available evidence.
Neutral：A small number of network characteristics need to be interpreted in context.
Needs attention：Several signals suggest that the source and use case should be verified.
High risk：Strong anomalous, hosting, or public risk evidence is present.
Very high risk：Observations or public intelligence show concentrated and clear risk signals.

Main assessment factors

Network type：Identifies residential, enterprise, cloud, data-center and other network attributes.
Registration and geolocation consistency：Compares registry, announcement and geolocation signals to identify regional or resale characteristics.
Hosting and data-center signals：Uses ASN, prefix and infrastructure signals to determine whether an IP belongs to a hosted or cloud network.
Public threat intelligence：References validated public security intelligence and historical risk events.
/24 subnet risk density：Adds network context by observing risk distribution within the same address segment.
First-party observations：Uses observations from CHA.LA sensors and honeypots as direct supporting evidence.

Assessment confidence

Confidence describes evidence completeness, not the risk value itself. When evidence is limited, the report marks the result as unobserved or low confidence. Unknown does not mean safe.

Native IP assessment

“Native” means the main registration, announcement, geolocation and network signals are consistent, without clear hosting, resale or cross-region anomalies. It describes network ownership consistency and does not mean absolute safety.