v2.3-GOLD Base-Zero Engine

MaxMind ships a CSV.
We ship a refinery.

MaxMind GeoIP2 is a static snapshot, refreshed weekly. CandycornDB scores live: /24 CIDR neighbor density, ASN landlord identification, and a signed scoreReasons audit receipt on every response. p99 under 50ms cached.

No Credit Card Required
Get API Key Read the Docs first

100 calls per day on the Developer tier. Free forever.

JSON RECEIPT
$

curl candycorndb.com/api/public/lookup?ip=216.183.115.43

// p99 cached < 50ms. Clouvider, AS62240. MaxMind: no flag.
{
"ip": "216.183.115.43",
"score": 35,
"scoreVersion": "v2.3-base-zero",
"asnType": "hosting",
"isProxy": true,
"isp": "Clouvider Limited",
"scoreReasons": [
{ "component": "asnHosting", "delta": 15 },
{ "component": "proxyInferred", "delta": 20 }
]
}

Feature parity, side by side

A static GeoIP CSV cannot answer the questions a v2.3 receipt does.

Capability CandycornDB v2.3 MaxMind GeoIP2
Data Freshness Live (write-behind cache) CSV refresh, weekly
Subnet-Aware Scoring /24 CIDR clusters, +25 Per-IP only
Wholesale Landlord ID Clouvider, M247, Tesonet Org name string only
Base-Zero Transparency scoreReasons[] on every call Opaque score
Tor and VPN Detection Included on Developer tier Paid add-on (Anonymous IP DB)
Cached Lookup p99 < 50ms Local DB lookup, varies
Integration Time One HTTP call DB sync, parser, cron

Static database vs live refinery pipeline

Two architectures, two different answers to the same lookup. The architecture decides what the receipt can say.

Static · Stale

MaxMind GeoIP2

Snapshot model. The data is frozen at the moment the CSV was published.

Step 1
CSV published weekly
GeoIP2-City, GeoIP2-ISP, GeoIP2-Anonymous-IP. Each is a separate file, separately licensed.
Step 2
You sync the file
Cron pulls the .mmdb. Your app restarts or hot-reloads the parser.
Step 3
Lookup against snapshot
The fresh AS62240 prefix that landed yesterday is not in your file yet.
Step 4
Country, region, ISP string
No cluster math. No landlord keyword scan. No receipt.
Live · Auditable

CandycornDB v2.3 Refinery

Pipeline model. The data is refined on every read, with a self-healing cache.

Step 1
Collect, BGP feeds and honeypots
FireHOL, Tor consensus, internal honeypot lattice, abuse reports. Real-time ingestion, firstSeen stamped.
Step 2
P1 /24 CIDR scan
Multi-key index on asns.prefixes, ipLong range query. O(log N). networkCluster +25 when dirty.
Step 3
P3 ASN landlord identification
Keyword scan against HOSTING_KEYWORDS and VPN_KEYWORDS. Sets asnType, isProxy, normalized isp.
Step 4
v2.3 Base-Zero score and receipt
Score starts at 0. Bonuses and penalties applied additively. scoreReasons[] built per delta. Cached for the next call.

The audit receipt MaxMind cannot return

An IP MaxMind would label "AS62240, Clouvider Limited, GB" with no risk flag. CandycornDB returns the math.

// GET /api/public/lookup?ip=216.183.115.43 // p99 cached < 50ms. First-contact JIT path: 200 to 400ms. { "ip": "216.183.115.43", "score": 35, "scoreVersion": "v2.3-base-zero", "country": "GB", "asn": "AS62240", "asnName": "Clouvider Limited", "asnType": "hosting", "isProxy": true, "isp": "Clouvider Limited", "scoreReasons": [ { "component": "asnHosting", "delta": 15, "detail": "clouvider matched HOSTING_KEYWORDS" }, { "component": "proxyInferred", "delta": 20, "detail": "clouvider matched VPN_KEYWORDS, infra penalty" } ], "firstSeen": "2026-04-28T13:11:08.412Z", "lastSeen": "2026-04-28T13:11:08.412Z" } // Math: 0 (base) + 15 (hosting) + 20 (infra penalty) = 35. Risk band: Medium.

Paste this into a support ticket. Defend the block. No black box, no "the model said so." Every delta is signed by a component name.

No Credit Card Required

Stop trusting stale databases.
Start auditing your traffic.

100 calls per day on the Developer tier. v2.3 Base-Zero engine. scoreReasons on every call.

Get API Key Read the Docs first