Question 1

How is the IP fraud score calculated?

Accepted Answer

The fraud score combines several signals into a single 0–100 risk value: whether the IP belongs to a known VPN, proxy or Tor exit node; whether the ASN is classified as hosting or datacenter (rather than a residential ISP); reverse-DNS patterns associated with anonymization services; and matches against threat-intelligence blocklists. Each signal contributes weighted points so a clean residential IP scores low while a Tor exit on a hosting ASN with active blocklist hits scores high.

Question 2

What do the score ranges mean?

Accepted Answer

Scores are grouped into four bands. 0–24 is Low risk, typical of residential or mobile IPs with no anonymization or abuse signals. 25–54 is Medium, often shared hosting, mobile gateways, or IPs with minor signals. 55–79 is High, common for datacenter ranges, commercial VPNs, and IPs with one or more blocklist hits. 80–100 is Critical and usually indicates Tor exits, abusive proxies, or IPs with multiple active threat-intel matches.

Question 3

How does the VPN, proxy, and Tor detection work?

Accepted Answer

VPN detection relies on curated lists of commercial VPN provider IP ranges and ASNs, plus heuristics on reverse DNS and network ownership. Proxy detection looks for open and commercial proxy ranges. Tor detection uses the public Tor exit node list maintained by the Tor Project. When an IP matches, the page shows which provider or network it was identified with.

Question 4

What is an ASN and why does it affect the score?

Accepted Answer

An ASN (Autonomous System Number) identifies the network that announces an IP range on the public internet — typically an ISP, hosting provider, or large company. The ASN’s classification (residential ISP, mobile carrier, hosting, business) is one of the strongest signals for fraud scoring because legitimate end users almost always connect from residential or mobile ASNs, while bots, scrapers, and VPN exits cluster on hosting and datacenter ASNs.

Question 5

How often are the blocklists and VPN lists updated?

Accepted Answer

The threat-intelligence blocklists, Tor exit list, and VPN/proxy ranges are refreshed regularly from their upstream sources so the score reflects the current state of an IP rather than a stale snapshot. Because reputation can change quickly, a result reflects the data available at the time of the lookup.

Question 6

Can I check the risk score of my own IP, or only other IPs?

Accepted Answer

Yes. Use the "My IP" quick link or visit /score/my to score the IP address you are currently connecting from. This "visitor check" mode is useful for confirming whether your home, office, or VPN connection looks clean to other sites, or for testing how a customer’s connection would be evaluated.

IP Fraud Score

Fraud Score

Popularity

Security Checks

Risk Factors

Raw JSON