---
title: "What Is an IP Fraud Score and How Do You Read It?"
description: "An IP fraud score rates the fraud risk of traffic from an address, usually from 0 to 100. Here is what it looks at and how to read the result."
url: https://proxynet.io/blog/ip-fraud-score
date: 2026-09-19
author: "Acar Diveroli"
category: "Proxies"
lang: en
---

# What Is an IP Fraud Score and How Do You Read It?

You type your newly bought proxy address into an IP lookup site and a red gauge appears: "Fraud Score: 64, High Risk". You type the same address into a second service and this time the score is 0. Another day you look up your own home address and, although you have done nothing, it says "medium risk". The result screen does not tell you what this number actually measures.

In this post we explain what an IP fraud score is, which data it is built from and why it measures the address rather than the person. We take the scales of Scamalytics, IPQualityScore (IPQS), MaxMind minFraud and AbuseIPDB from their own documentation and read the Scamalytics and IPQS result screens line by line. The final sections show how to check your proxy address before you use it and which order to follow when the score comes back high.

> **Note: Short answer**
>
> An IP fraud score (IP risk score) is a value that expresses, usually as a number between 0 and 100, how likely traffic from an IP address is to be linked to fraud. IP intelligence services produce the score; websites use it at payment, sign-up and login steps to decide whether to ask for extra verification. The score looks at the history of the address, the type of network it belongs to, proxy, VPN and Tor flags, and abuse reports. Because every service uses its own data and its own scale, the same address can get different scores from two services; you need to read the reason lines next to the number.

## What is an IP fraud score?

An IP fraud score is the risk value an IP intelligence service calculates for a single address. People also search for it as "IP risk score", "IP reputation score" or "IP spam score". The users of the score are mostly sites that take payments or open accounts: at the payment step or on the sign-up form, the site asks the service about the address the connection comes from and acts on the number returned. With a low score the transaction goes through, with a medium score an SMS verification or a CAPTCHA appears, and with a high score the transaction is rejected or sent to manual review.

The score is often confused with a blacklist. A blacklist answers the question "is this address on the list" with yes or no. A fraud score gathers similar information, blacklist entries included, into a single graded number. We covered how lists work and the order of a delisting request in [What Is an IP Blacklist and How Do You Get Delisted?](/blog/ip-blacklist); this post focuses on the score itself.

A fraud score is not an official record; it is an estimate that private companies produce from their own observations. Scamalytics writes this at the bottom of every result page: the company states that it does not see the entire internet and that the statements on the page are an opinion based on the limited information it has.

## How is an IP risk score calculated?

The services keep their formulas closed, but their documentation describes the kinds of data they use. The flow looks roughly like this:

1. **Feedback is collected.** The sites that are customers of the service report confirmed abuse events to it. The IPQS documentation lists chargebacks, account takeover, fake sign-ups and bot attacks. Scamalytics also bases its score on a network of sites that report confirmed fraud.
2. **The identity of the address is established.** The service looks at which network (ASN) and organization the address belongs to, and whether the connection type is labelled as residential, mobile, corporate or data center. We explained the ASN record and how these labels are produced in [ISP vs Residential Proxies: Which One Should You Choose?](/blog/isp-vs-residential-proxy).
3. **Anonymizer flags are checked.** Is the address the exit of a known VPN service, a Tor exit node, has it been seen on public proxy lists or in a residential proxy network? Each one is a separate yes-or-no field.
4. **The neighbours are examined.** Scamalytics states that it applies the intelligence it gathers to the surroundings of the address as well: addresses in the same subnet, the same ASN and the same hosting block. An address close to known malicious addresses can get a high score even if it has never been reported itself.
5. **External lists are added.** Whether the address is recorded on open-source lists such as Spamhaus and Firehol is factored into the result.
6. **Everything is reduced to one number.** The service weights these inputs and produces a single score. The site decides how to use it; the threshold is the site's own choice.

The sixth step is why you can complete a transaction on one site and hit extra verification on another with the same score. Sites look at other signals besides the IP score; you can find those layers in [How Bot Detection Works](/blog/how-bot-detection-works).

## Why does the score measure the address and not the person?

The service does not know you. The data it holds is how the traffic that came from that address earlier behaved. The link between an address and a person is looser than most people assume.

On home internet, addresses change hands. The address you were given today belonged to another subscriber last week, and the score may still carry traces of those days. On mobile lines and on some home subscriptions, the operator places many subscribers behind a single public address at the same time. In this situation, which is common in Türkiye, the behaviour of one of them is reflected in the score of everyone sharing that address. This is the most ordinary explanation for a home address showing medium or high risk when you have done nothing. The mechanism is detailed in [What Is CGNAT?](/blog/what-is-cgnat), and why addresses change in [Static IP vs Dynamic IP](/blog/static-ip-vs-dynamic-ip).

The services are aware of this looseness too. IPQS separately flags addresses that are likely to have more than one user at the same time (mobile networks, corporate exit points, library, café and hotel networks) with the `shared_connection` field, and connections whose user will soon move to another address with the `dynamic_connection` field. Scamalytics, for an address whose traffic it has never seen, assigns the score from the overall risk of its provider; the number on the screen is sometimes the average of your operator, not of your address.

## How do the services scale the score?

Below are the scales and thresholds of four common services. Every piece of information in the table comes from the service's own documentation.

| Service | Scale | What is the score based on? | Thresholds in the documentation |
|---|---|---|---|
| [Scamalytics](https://scamalytics.com/products/) | 0-100 | Fraud reports from a network of sites; subnet, ASN and hosting block neighbourhood | 0-19 low, 20-59 medium, 60-89 high, 90-100 very high |
| [IPQS](https://www.ipqualityscore.com/documentation/proxy-detection-api/response-parameters) | 0-100 | The IP plus the user agent, language and other details sent with the request | 75 and above suspicious, 90 and above high risk |
| [MaxMind minFraud](https://support.maxmind.com/knowledge-base/articles/minfraud-ip-risk-score) (IP risk score) | 0.01-99 | The current risk of the address; read together with a separate "snapshot" value covering the past seven days | No fixed threshold in the documentation; the score is defined directly as a percentage probability |
| [AbuseIPDB](https://www.abuseipdb.com/faq.html) | 0-100 | Abuse reports submitted by users; the weight of a report decays over time and the score is recalculated daily | No threshold; the score shows "how confident" the service is that the address is malicious |

The scales look alike, but the numbers do not say the same thing. According to Scamalytics, a score of 70 means that roughly seven out of ten users seen from that address have been linked to fraud. At MaxMind, a score of 20 means the transaction has a 20 percent chance of being fraudulent based on the IP address alone. At IPQS, 75 says something different: the connection most likely comes through a proxy, a VPN or Tor, but the user does not have to be a fraudster; they may simply be protecting their privacy. The documentation recommends blocking at 90 and above.

The thresholds are recommendations as well. Scamalytics presents its ranges as a "starting point"; IPQS likewise writes that sites may find a higher or a lower threshold beneficial. What AbuseIPDB measures is not fraud but the abusive traffic its users report; it is in the table because lookup sites show it to you as an "IP score".

## How do you read the Scamalytics result screen line by line?

When you look up an address on Scamalytics, the page opens with these sections from top to bottom:

- **Gauge and label.** The score between 0 and 100 and the matching risk label (low, medium, high, very high).
- **Description paragraph.** The most skipped and the most informative part of the page. It tells you which provider operates the address, how much traffic the service sees from that provider, and whether the address is a domestic connection or a commercial server. If you see the sentence that begins with "We have no visibility into the web traffic directly from...", the score belongs to your provider, not to your address.
- **Operator.** Hostname, ASN, ISP name, organization name and connection type. For a proxy buyer these are the first lines to check: is the address registered to an access provider or to a hosting company?
- **Location and Datacenter.** Country, city and whether the device sits in a data center. We covered why location data differs from service to service in [Why Is My IP Location Wrong?](/blog/ip-geolocation-accuracy).
- **External Blacklists.** Whether the address is recorded on the Firehol, IP2ProxyLite, IPsum, Spamhaus and X4Bnet lists.
- **Proxies and Residential Proxy.** The anonymizing VPN, Tor exit node, public proxy, web proxy and search engine robot lines, plus whether the address has been seen in a residential proxy network.

Look at the description paragraph first, then at the Operator and Proxies sections. If the score is high but every line says "No", the height most likely comes from the neighbourhood or the provider average. If the "Public Proxy" or "Tor Exit Node" line says "Yes", the reason lies in the address itself.

## Which fields matter in an IPQS result?

IPQS returns the result as fields rather than a single number, and its documentation recommends not leaving the decision to the score alone. The fields that are useful to a proxy buyer are:

- `fraud_score`: the overall score. It is based not only on the IP but also on the user agent and language sent with the request.
- `proxy`, `vpn`, `tor`: whether the address is recognized as a proxy, VPN or Tor connection. The `vpn` field can also cover data center ranges that may become active VPNs at any time.
- `connection_type`: "Residential", "Corporate", "Education", "Mobile" or "Data Center".
- `recent_abuse` and `abuse_velocity`: whether verified abuse was seen in the past few days, and how frequent it is ("high", "medium", "low", "none").
- `bot_status`: whether the address was recently used for automated traffic.
- `frequent_abuser`: addresses with abuse seen over six months or longer. Returned only on the enterprise plan.

The fields make sense when read together. An address with `proxy: true` and `recent_abuse: false` means "recognized as a proxy but not abused recently". `recent_abuse: true` with `abuse_velocity: high` shows that the address has been worn out in those days; this is the picture you see on shared addresses.

## Why does the same IP get different scores from two services?

- **Every service sees a different part of the internet.** The score rests on reports from the sites that are customers of the service. If the service has never seen traffic from your address, it assigns the score from the provider average or the neighbourhood.
- **The inputs differ.** The IPQS score also changes with the user agent; the same address can return a different result in the web form and in a script.
- **The time windows differ.** MaxMind keeps a seven-day value next to the current score and recommends comparing the two: if the current score is high and the seven-day value is low, the address has just become risky; if both are high, it has been that way for a while. AbuseIPDB recalculates the score every day and reduces the weight of old reports.
- **The neighbourhood calculation is specific to the service.** A service that penalizes the block and a service that looks only at the single address reach different results for the same address. We explained the block-level logic in the /24 section of our blacklist post.

Most of the time you cannot tell from the outside which service the site you will work with uses. That is why the score is a preliminary check, and the final word belongs to a small trial on the target site.

## Why do data center, ISP and residential IPs score differently?

One of the heavy inputs of the score is the type of network. A connection coming from the ASN of a hosting company means, from the service's point of view, "there is a server behind this, not a person". Scamalytics says so openly in its result paragraph: the address is not a standard domestic connection but a commercial server that could be proxying traffic from another location. On shared data center addresses a neighbourhood effect is added on top: the traffic of other customers using the same block is reflected in the score.

For addresses registered to an access provider (ISP, residential, mobile) the starting point is different, because the network type does not raise suspicion on its own. This is not a guarantee: residential addresses can be flagged as "residential proxy", some databases can reclassify ISP addresses as hosting over time, and shared mobile addresses can carry someone else's traces. You can find the difference between the types in [Residential vs. Datacenter Proxy: The Difference](/blog/residential-vs-datacenter-proxy), and the distinction between shared and dedicated addresses in [What is Private Proxy?](/blog/private-proxy).

No provider, us included, can guarantee the score a third-party service will give an address. The service produces the score, not the provider, and the service may reach a different result tomorrow. What a provider can promise is something else: that the address is reserved for you alone, which network it is registered to, and that an address that turns out to be problematic gets replaced.

## How do you check your proxy address before using it?

The four steps in [Is My Proxy Working? How to Test a Proxy](/blog/how-to-test-a-proxy) (address, location, speed, leaks) show that the proxy works. The reputation check is the fifth step of that sequence and needs no code: with the proxy on, find your exit address on an IP display site, then type that address into the lookup pages of Scamalytics and IPQS. For static addresses it is enough to do this once on delivery day. In rotating pools the address changes with every request, so checking scores one by one makes no sense; there you look at the success rate on the target site.

If you have many static addresses, you can run the same check with a script. The example below finds the exit address through the proxy, prints the network the address is registered to, and adds the score and the reason fields if an IPQS key is present in the environment variable:

```python
import os

import requests

PROXY = "http://user:pass@pr.proxynet.io:8000"
IPQS_KEY = os.environ.get("IPQS_KEY", "")  # the key is never hard-coded, it is read from the environment

def get_exit_ip(proxy):
    # Go out through the proxy and learn the address the site sees
    r = requests.get("https://api.ipify.org", proxies={"http": proxy, "https": proxy}, timeout=15)
    r.raise_for_status()
    return r.text.strip()

def get_owner(ip):
    # ASN and organization name: the first line to check before the score (this lookup runs without the proxy)
    r = requests.get(f"https://ipinfo.io/{ip}/json", timeout=15)
    r.raise_for_status()
    return r.json().get("org", "unknown")

def get_ipqs_report(ip, key):
    r = requests.get(f"https://ipqualityscore.com/api/json/ip/{key}/{ip}", timeout=15)
    report = r.json()
    if not report.get("success"):
        raise RuntimeError(report.get("message", "lookup failed"))
    return report

def read_score(score):
    # Thresholds from the IPQS documentation: 75 and above suspicious, 90 and above high risk
    if score >= 90:
        return "high risk"
    if score >= 75:
        return "suspicious"
    return "below the suspicious threshold"

if __name__ == "__main__":
    ip = get_exit_ip(PROXY)
    print("exit ip :", ip)
    print("owner   :", get_owner(ip))

    if not IPQS_KEY:
        print("IPQS_KEY is not set, skipping the score lookup")
    else:
        try:
            report = get_ipqs_report(ip, IPQS_KEY)
        except RuntimeError as err:
            print("lookup  :", err)
        else:
            print("score   :", report["fraud_score"], "->", read_score(report["fraud_score"]))
            # The reasons behind the score live in these fields
            for field in ("proxy", "vpn", "tor", "recent_abuse", "bot_status"):
                print(f"{field:<8}:", report.get(field))
```

Without a key the output is two lines, for example `exit ip : 203.0.113.25` and `owner : AS64500 Example Net`. With an invalid key the service returns `success: false` and an error message; the script prints the message and exits. The score lookup is made directly, not through the proxy, because what you are asking the service about is the proxy address itself.

## What do you do when the score comes back high?

A fraud score has no application form and cannot be "reset" from the outside. The score follows the traffic seen from the address. When the problematic traffic stops, the weight of the reports drops over time; AbuseIPDB states this openly in its documentation, and IPQS keeps recent abuse (`recent_abuse`) separate from long-running abuse (`frequent_abuser`).

What to do depends on the situation.

**If it is a newly delivered proxy address:**

1. **Read the reason.** Which line raises the score: the network type, an external list entry or recent abuse?
2. **Check a second service.** A high score on a single service can come from the neighbourhood or the provider average. If both show a height with a reason, the problem is in the address.
3. **Run a small trial on the target site.** If the site accepts the address without trouble, the score has no practical meaning for your work.
4. **Report it to the provider.** Send the address, a screenshot of the lookup result and the behaviour on the target site, and ask for a replacement. We gathered the questions to ask before buying in [What to Look for When Buying a Proxy: 10 Questions](/blog/proxy-buying-guide).

**If the score of an address you have used for a while has gone up**, look at your own traffic first. A high request rate and requests that continue despite error responses wear the address out in your own hands. In that case changing the address only postpones the problem. We explained the ways to reduce the load in [How to Scrape Websites Without Getting Blocked](/blog/web-scraping-without-getting-blocked).

**If it is your own home address**, most of the time you do not need to do anything. If a site really turns you away, switch off any active VPN, try on mobile data, and restart the modem to see whether the address changes; the methods are in [How to Change Your IP Address](/blog/how-to-change-ip-address). If the score rises on the new address as well, a device on your network may be producing problematic traffic.

## Where is an IP risk score useful?

- **Ad verification.** Ad networks may show different ads, or none at all, to addresses they find suspicious. When you check how your campaign looks to a real user, you need an address registered to a residential or mobile network. The scenarios are on our [ad verification](/ad-verification) page.
- **Price and stock monitoring.** For a crawler that reads public product pages, the deciding factor is the request rate, not the score. If the target site turns away hosting networks wholesale, the network type comes to the fore. Details are on the [price monitoring](/price-monitoring) page.
- **Managing your own store and social media accounts.** Login and payment steps are the most score-sensitive places. What you want here is an address that does not change during the month and is reserved for you alone: [ISP Proxy](https://proxynet.io/static-isp-residential-proxy). For the marketplace side, see the [e-commerce proxy](/e-commerce-proxy) page.
- **Protecting your own site.** If you are the one using the score, a strict threshold also turns away legitimate customers: a real buyer coming from a shared mobile address can look like medium risk. We covered the click-side equivalent in [What Is Google Ads Click Fraud?](/blog/google-ads-click-fraud).

## Common mistakes

- **Deciding on a single number from a single service.** What raised the score is written in the reason lines.
- **Treating a score of zero as assurance.** The service may simply never have seen the address.
- **Changing the address right away because the score is high.** If your own traffic produces the height, the new address ends up in the same place.
- **Thinking of the score apart from browser signals.** If the address is clean and you still hit verification, one of the reasons may be the [browser fingerprint](/blog/browser-fingerprinting).
- **Paying for a "score cleaning" service.** The documentation of these services defines no such application route.

## Decision guide

| Your work | Sensitivity to the score | Recommended address type |
|---|---|---|
| Login, payment and panel operations with your own accounts | High; extra verification and rejection appear at these steps | A static ISP address reserved for you; reason check on delivery day |
| Ad verification, local content checks | High; the network type should not be "hosting" | [Residential Proxy](https://proxynet.io/residential-proxy) or mobile |
| Price and stock monitoring on public pages | Medium; the rate limit comes before the score | Rotating residential; data center if the site accepts it |
| API and panel access that requires an IP allowlist | Low; the other side already knows the address | [Datacenter Proxy](https://proxynet.io/datacenter-proxy) or static ISP |
| Mobile app testing | Medium; on a shared address the score can change during the day | [Mobile Proxy](https://proxynet.io/mobile-proxy) |
| Fake sign-up and payment protection on your own site | The threshold is your decision | Start with the threshold the service recommends and adjust it to your own data |

## Frequently asked questions

### What should a fraud score be?

There is no single right number; the site using the score sets the threshold. The services' recommendations give an idea: Scamalytics counts 0-19 as low risk, IPQS finds 75 and above suspicious and recommends blocking at 90 and above.

### What does a fraud score of 0 mean?

It means the service has seen no problematic traffic from that address or from the network it belongs to; it does not mean the address will work without trouble on every site. For addresses it cannot see directly, Scamalytics assigns the score from the overall risk of the provider; in that case zero is a value that belongs to your operator.

### How do I find out my IP score?

Find your public address on an IP display site, then type it into the lookup page of Scamalytics or IPQS. For a proxy address, do the same with the proxy switched on.

### Why does my home internet get a high score?

The two most common reasons are the previous user of the address and the other subscribers sharing it at the same time. As long as a site does not turn you away, this is not a fault. If a VPN or a proxy extension is active, switch it off before the lookup; otherwise you measure the VPN exit.

### Does using a proxy raise the fraud score?

Using a proxy does not change the score of your home address; the site sees the proxy's address and looks at the score of that address. That score is determined by the type of network, whether the services recognize the address as a proxy, and who used the address before you or together with you, and how.

### Can a fraud score be lowered?

Not through an application from the outside. When the problematic traffic stops, the effect of the reports fades over time. What you can do is remove the cause: review your request rate, find the problematic device on your network, or ask the provider to replace a proxy address that was delivered with a problem.

## Summary

An IP fraud score is a risk estimate that IP intelligence services produce for an address. Because it measures the address and not the person, on shared and reassigned addresses it can reflect a history that has nothing to do with you. The services' scales and thresholds differ; instead of comparing the numbers with each other, read the reason lines, check static addresses on delivery day and leave the final decision to a small trial on the target site. Nobody can guarantee the score; what you can choose is the type of address and whether it is reserved for you alone. You can see the options side by side on our [proxy services](/proxy) page.