{
  "status": "success",
  "version": "9.0.0-professional-no-datacenter-penalty",
  "generatedAt": "2026-05-28T19:15:09.490Z",
  "ip": {
    "address": "216.73.216.248",
    "version": "IPv4"
  },
  "network": {
    "asn": 16509,
    "isp": "Anthropic, PBC",
    "localClassification": {
      "type": "Hosting / Datacenter",
      "flags": {
        "knownHostingAsn": true,
        "hostingName": false,
        "vpnProxyName": false,
        "mobileName": false,
        "residentialName": false,
        "educationName": false,
        "corporateName": false,
        "abuseDatacenterUsage": false,
        "abuseTor": false
      },
      "evidenceText": "Anthropic, PBC 16509"
    }
  },
  "location": {
    "country": "US",
    "countryCode": "US",
    "region": "Ohio",
    "city": "Columbus",
    "timezone": "America/New_York",
    "latitude": "39.96118",
    "longitude": "-82.99879",
    "colo": "CMH",
    "continent": "",
    "continentCode": ""
  },
  "connection": {
    "tlsVersion": "TLSv1.3",
    "tlsCipher": "AEAD-AES256-GCM-SHA384",
    "httpProtocol": "HTTP/2",
    "rayId": "a02f962049f54b67",
    "userAgent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)",
    "acceptLanguage": "",
    "accept": "*/*",
    "secChUa": "",
    "secChUaMobile": "",
    "secChUaPlatform": "",
    "secFetchSite": "",
    "secFetchMode": "",
    "secFetchDest": "",
    "ja3Hash": null,
    "ja4": null,
    "referer": ""
  },
  "cloudflareSignals": {
    "botScore": null,
    "verifiedBot": null,
    "staticResource": null,
    "corporateProxy": null
  },
  "externalIntel": {
    "ipinfoLite": {
      "enabled": false,
      "ok": false,
      "parsed": null,
      "raw": null,
      "error": "IPINFO_TOKEN not configured",
      "attribution": "IP address data powered by IPinfo Lite"
    },
    "abuseipdb": {
      "enabled": false,
      "ok": false,
      "parsed": null,
      "raw": null,
      "error": "ABUSEIPDB_KEY not configured"
    }
  },
  "risk": {
    "score": 57,
    "verdict": "High Risk",
    "tags": [
      "Hosting/Datacenter"
    ],
    "findings": [
      {
        "id": "automation_user_agent",
        "severity": "medium",
        "points": 25,
        "message": "User-Agent looks automated, headless, or scripted.",
        "evidence": {
          "userAgent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)"
        }
      },
      {
        "id": "browser_header_mismatch",
        "severity": "low",
        "points": 10,
        "message": "User-Agent looks like a browser but common modern browser headers are missing.",
        "evidence": {}
      },
      {
        "id": "missing_accept_language",
        "severity": "low",
        "points": 8,
        "message": "Browser-like request has no Accept-Language header.",
        "evidence": {}
      },
      {
        "id": "known_hosting_asn",
        "severity": "info",
        "points": 0,
        "message": "ASN is in the built-in hosting/cloud/datacenter ASN list. Hosting ASN alone is not treated as risky.",
        "evidence": {
          "asn": 16509
        }
      }
    ]
  },
  "limitations": {
    "datacenterPolicy": "Datacenter/hosting classification is informational only. It does not reduce score by itself.",
    "ipinfoLite": "IPinfo Lite does not provide direct is_vpn/is_proxy/is_tor/is_hosting fields. This Worker uses Lite ASN/name/domain enrichment plus heuristics.",
    "abuseipdb": "AbuseIPDB is used for reputation, Tor flag, reports, and usageType. UsageType alone does not reduce score.",
    "realIpBehindVpn": "No website can reliably know the real ISP IP behind a properly configured VPN unless the browser leaks it through WebRTC or another client-side channel.",
    "dnsLeak": "A normal Cloudflare Worker cannot see the visitor DNS resolver. Real DNS leak detection needs authoritative DNS logging for unique test subdomains."
  }
}