{"status":"ok","service":"ifport.io","observed_source":{"ip":"216.73.216.183","address_family":"ipv4","scope":"public","attribution_confidence":"high"},"observed_source_ip":"216.73.216.183","observed_ip_scope":"public","ip_source":"x_forwarded_for_trusted_proxy","transport_remote_ip":"172.16.1.1","trusted_header_candidates":{"cf_connecting_ip":null,"forwarded":null,"x_forwarded_for_first_public":"216.73.216.183","x_real_ip":"216.73.216.183"},"edge_header_integrity":{"verified":true,"status":"verified_sanitized_edge","header":"x-ifport-edge-verified","reason":"The request came from a trusted proxy hop, X-IfPort-Edge-Verified was set by the edge, and X-Real-IP/X-Forwarded-For matched the observed public source."},"attribution":{"verdict":"trusted_edge_header_path","confidence":"high","representation":"verified_edge_header","message":"IfPort sees a public IP through a verified sanitized IfPort edge header path. The edge stripped inbound forwarding headers and set x_forwarded_for_trusted_proxy for this request path: 216.73.216.183.","risks":["If this public IP is shared by NAT, the result describes the shared edge, not every private host behind it.","Changing HAProxy, Cloudflare, VPN, or load-balancer behavior can change which public IP IfPort scans."]},"accuracy":{"representation":"verified_edge_header","confidence":"high","observed_ip_scope":"public","reasons":["Observed source IP was taken from x_forwarded_for_trusted_proxy.","Public source IP came from verified sanitized IfPort edge headers.","The request came from a trusted proxy hop, X-IfPort-Edge-Verified was set by the edge, and X-Real-IP/X-Forwarded-For matched the observed public source."],"next_steps":["Run the same check from the exact network path you want to validate (same host, same egress).","Keep the edge sanitizer marker and spoofed-header smoke tests in the production rollout path."]},"fix_playbook":["Keep HAProxy stripping inbound client-IP forwarding headers before setting the verified edge marker.","Keep spoofed-header probes in production smoke checks so clients cannot influence the request-source IP.","Re-run `/` and `/evidence` from the same runtime after firewall, VPN, DNS, or edge changes.","Transport remote IP differs from observed source IP; audit the proxy/header hop that changed attribution."],"verify_commands":["curl -fsS https://ifport.io/network-path | jq .","curl -fsS 'https://ifport.io/json?profile=default&policy=strict&speed=balanced&expand=evidence' | jq '{observed_source, accuracy, decision}'","curl -fsS 'https://ifport.io/evidence?profile=default&policy=strict&speed=balanced&format=markdown'","# expected observed_source_ip for this request path right now: 216.73.216.183"],"copy_paste":{"markdown":"# IfPort Network Path\n\n**Observed source IP:** 216.73.216.183\n**Observed IP scope:** public\n**IP source:** x_forwarded_for_trusted_proxy\n**Transport remote IP:** 172.16.1.1\n**Attribution verdict:** trusted_edge_header_path\n**Confidence:** high\n**Representation:** verified_edge_header\n\nIfPort sees a public IP through a verified sanitized IfPort edge header path. The edge stripped inbound forwarding headers and set x_forwarded_for_trusted_proxy for this request path: 216.73.216.183.\n\n## Fix Playbook\n- Keep HAProxy stripping inbound client-IP forwarding headers before setting the verified edge marker.\n- Keep spoofed-header probes in production smoke checks so clients cannot influence the request-source IP.\n- Re-run `/` and `/evidence` from the same runtime after firewall, VPN, DNS, or edge changes.\n- Transport remote IP differs from observed source IP; audit the proxy/header hop that changed attribution.\n\n## Verify Commands\n- `curl -fsS https://ifport.io/network-path | jq .`\n- `curl -fsS 'https://ifport.io/json?profile=default&policy=strict&speed=balanced&expand=evidence' | jq '{observed_source, accuracy, decision}'`\n- `curl -fsS 'https://ifport.io/evidence?profile=default&policy=strict&speed=balanced&format=markdown'`\n- `# expected observed_source_ip for this request path right now: 216.73.216.183`\n\nBoundary: request-source-only; no arbitrary target scanning; no CIDR sweeps; no exploitation.\n","curl_commands":["curl -fsS https://ifport.io/network-path | jq .","curl -fsS 'https://ifport.io/json?profile=default&policy=strict&speed=balanced&expand=evidence' | jq '{observed_source, accuracy, decision}'","curl -fsS 'https://ifport.io/evidence?profile=default&policy=strict&speed=balanced&format=markdown'","# expected observed_source_ip for this request path right now: 216.73.216.183"]},"links":{"run_check":"https://ifport.io/","json":"https://ifport.io/json","evidence":"https://ifport.io/evidence?profile=default&policy=strict&speed=balanced","docs":"https://ifport.io/docs","support":"https://ifport.io/support"},"limitations":["This result describes the public request-source path IfPort observed.","The result may not describe the end-user's local machine if the request passed through NAT, VPN, proxy, cloud runtime, CI/CD runner, or LLM sandbox.","Service names are inferred from common port mappings unless explicit service detection is enabled.","An open port does not automatically mean the service is vulnerable.","A closed or filtered port may be affected by firewall rules, network routing, or scan timeout."],"notes":["This endpoint does not run a scan; it explains how source IP attribution was derived.","request-source-only scans are most reliable when observed_ip_scope is public."]}