The public signals AUGI reads
Mail routing (MX): which servers accept email for a domain. Missing or broken MX means mail may fail — a real operational problem, visible to anyone.
Sender policy (SPF) and abuse reporting (DMARC): published rules that tell receiving servers which senders are authorized and what to do with fakes. Together they stop a large share of email spoofing.
IP registry data (ASN, organization, registered location): who an address block belongs to, per the public routing registry. Useful for understanding infrastructure — not for identifying people.
Abuse reports: communities like AbuseIPDB collect reports of hostile behavior from specific addresses. A high abuse confidence score is a useful triage signal, but reports can be wrong, outdated, or gamed.
What the public layer cannot tell you
It cannot identify the person using an address. Behind one IP there may be thousands of people behind carrier-grade NAT, a VPN exit, or a cloud server. A registered city is often just where a company's equipment sits.
It cannot prove intent. A misconfigured server is not an attack; an abuse report is not a conviction. Signals raise questions — your own logs and official channels answer them.
How to combine signals responsibly
Treat every signal as one line of testimony. Cross-check the same question from a second source before acting, and prefer defensive responses — tightening your own configuration, blocking at your edge, reporting through official channels — over any action that reaches toward a person.
Educational information about public internet data. An IP address is not a person.
