I have a couple of questions:

- Why can there be only one risk type per IP? What if an IP is a honeypot and botnet. It would make sense to me to have a list of threats or a different value for each.

- Why is the threat level a string? Is it meant to be compared for equality only?

Also your docs need a lot of work. I would like to know specifically what threat types there are currently, what their slug is and what specifically they mean.