All source feeds are updated on a daily basis (depending on source feeds update frequency) on a MISP backend. Geolocation databases are also updated daily.

Risk score is computed depending on multiple factors including but not limited to: country, matching feeds, proxy, last observed malicious activity.