IPLogs vs Microsoft Security Response Center (MSRC)

IPLogs scores an IP address's likelihood of being a VPN, proxy, Tor exit node, or datacenter host by combining 25+ signals -- ASN/PeeringDB classification, TCP/IP and TLS fingerprinting, RTT timing, and active probing -- into a single verdict and confidence score. A single keyless POST to /v1/check (optionally enriched with client-side signals like user-agent, timezone, and WebRTC IP) returns the verdict, a 0-1 risk score, and the matched signals with their weights, run by DigitalD.tech. There's no signup and no enforced rate limit today -- the public endpoint is explicitly fair-use, with dedicated deployments available on request for high-volume callers.

MSRC's CVRF API serves Microsoft's own machine-readable security-update bulletins: list every bulletin's ID and dates from `/updates`, then pull one full document by ID (e.g. "2026-Jan") from `/cvrf/{id}` -- as CVRF XML by default, or the same CVRF document serialised to JSON under an `Accept: application/json` header. It's a fully public, unauthenticated REST endpoint with no signup or key required, backing tools like the community MsrcSecurityUpdates PowerShell module. Two traps confirmed live: the OData-shaped response envelope is misleading (most `$filter`/`$top` syntax 500s, and there's no CVE-to-bulletin lookup at all), and the separately documented `/csaf/{id}` route rejected all 17 id formats probed with "Invalid ID format" -- so despite the CSAF branding, the JSON this API actually returns is CVRF, not CSAF. The old stored URL pointed at the unrelated Report Abuse API's developer page; the live developer portal for this security-updates API now redirects straight to its published OpenAPI/Swagger definition.