ip.not_public
The address is private, loopback, link-local, carrier-grade NAT, documentation/benchmarking, or reserved — not publicly routable.
What it looks at#
Checks the address against the IANA special-purpose address registries for IPv4 and
IPv6: RFC 1918 private-use space (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16),
loopback, link-local, carrier-grade NAT (100.64.0.0/10), the documentation and
benchmarking ranges, and multicast/reserved space — plus the IPv6 equivalents (unique
local addresses, link-local, the documentation prefix 2001:db8::/32, and so on).
These ranges are fixed by RFC, not fetched from anywhere, so this check has no reference data to go stale.
Why it matters#
A signup or contact-form IP field should hold a real, publicly routable client address. Seeing a private or reserved one usually means the caller is forwarding its own proxy, load balancer, or internal network’s address instead of the actual visitor’s — a configuration issue on the caller’s side, not evidence of anything adversarial.
What to do#
Low severity — this is almost always benign. If it fires on every call, check how the
caller is extracting the client IP (a missing or misconfigured X-Forwarded-For read is
the most common cause) rather than treating individual occurrences as suspicious.