How IP Fraud Scores Work: What the Number Means Before You Block Anyone
· 8 min read
A number from 0 to 100 next to an IP address looks authoritative. It is also easy to misuse: block everything above 50 and you will turn away paying customers on corporate VPNs; ignore it and you will approve the same bot farm for the fortieth time. This article walks through what actually goes into an IP fraud score, how the pieces are combined into one number, and what each risk band should — and should not — trigger in your application.
What an IP fraud score is (and isn't)
An IP risk score estimates how likely it is that a connection from this address is not an ordinary person on an ordinary consumer connection. That is a narrower claim than it sounds. The score knows nothing about the human behind the keyboard, whether the account is real, or what they intend to do. What it does know is the network: who owns the address block, whether the address shows up in abuse reports, whether it is an anonymizer endpoint, and whether it lives in a datacenter where browsers are rare and scripts are common.
Treat it as one signal among several. It is strongest when combined with what you already know — the age of the account, the reputation of the email address used at signup, velocity of requests, and whether the action being attempted is sensitive.
The five families of signals
Our IP fraud score groups everything it checks into five categories. Each produces its own sub-score, which is why the result page shows a breakdown rather than a single opaque number.
1. Threat intelligence
Dozens of public feeds publish addresses seen brute-forcing SSH, scanning for vulnerable services, sending spam or hosting command-and-control infrastructure. Being listed on one low-quality feed means little; being listed on several independent, well-curated ones means a lot. The scoring reflects that: each feed carries a reliability weight, and feeds that are really the same data republished (a "level 3" list that is a strict subset of "level 1", or a union list and its own sub-lists) are grouped into families so one underlying report cannot masquerade as consensus. The contribution grows quickly with independent confirmations and then flattens — three strong feeds already put you near the ceiling.
2. Anonymity
This is where most scoring products get lazy, treating "VPN" as a single bad thing. It isn't. The anonymity family distinguishes:
- Tor exit nodes: traffic origin is fully anonymized and Tor is heavily over-represented in credential stuffing and carding. High impact.
- Open proxies: addresses listed on SOCKS/SSL proxy lists, or where a proxy service actually answers on a known port when probed. High impact — these are shared by anyone who finds the list.
- Commercial proxy networks: paid rotating-proxy infrastructure sold for scraping and account creation. High impact.
- VPN endpoints: generic VPN exit servers. Medium impact.
- Consumer privacy VPNs: the well-known subscription services. Medium-low impact, because privacy-conscious real users are a large share of this traffic.
- Privacy relays: services like iCloud Private Relay, where the user is demonstrably a real person on a real device behind a proxy. Deliberately scored below the medium band.
When several anonymity signals coincide (a Tor exit that is also on proxy lists), the score takes the strongest one and adds a small bonus rather than stacking them.
3. Infrastructure
Real people rarely browse from a server rack. If the address belongs to an autonomous system (ASN) classified as hosting or cloud, or appears on datacenter range lists, that adds a medium penalty. Reverse DNS refines it: no PTR record at all is a mild negative, and a hostname that follows datacenter naming conventions (static.203.0.113.4.clients.example-host.net) is another. Infrastructure is capped well below the high band on its own and is skipped entirely when an anonymity signal is present — a VPN endpoint is by definition a datacenter IP, so charging both would count the same fact twice.
4. Network reputation
Some hosting providers tolerate abuse as a business model. Addresses inside networks known as bulletproof or abuse-tolerant carry a high reputation penalty regardless of what the individual IP has done. So does bogon space: addresses in unallocated or reserved ranges that should never appear as a source on the public internet. Traffic claiming to come from a bogon is either spoofed or badly misconfigured.
5. Bots and crawlers
Googlebot, Bingbot, Ahrefs and the AI crawlers are not fraud, but they are not human visitors either, and a score that gives them a perfect 0 is telling you something false. Verified crawlers are identified two ways: forward-confirmed reverse DNS (the PTR record points to the crawler's domain and that hostname resolves back to the same IP, which a spoofer cannot fake) or a match against the IP ranges the vendor publishes. Verified bots land squarely in the medium band so they are visible without being treated as attackers.
Combining signals: why adding them up is wrong
The intuitive approach — assign points to each signal and sum them — fails in both directions. Three weak signals (no reverse DNS, a mildly suspicious ASN, a cheap feed listing) should not add up to the same verdict as one Tor exit node. And a confirmed open proxy should not need "help" from other signals to reach the high band.
Our score instead uses a probabilistic OR. Each category sub-score is treated as an independent probability that the connection is risky, and the combined score is the probability that at least one of them is right. In practice that means a single strong signal dominates, additional strong signals push the total toward but never past 100, and a pile of weak signals stays weak. The breakdown on the result page shows each category so you can see which family is driving the number.
Caps and overrides
Two overrides sit on top of the combination step, and they matter more than any single signal:
- Clean residential traffic is capped at 15. If the ASN is a residential or mobile ISP and there are no threat-feed, anonymizer or reputation hits, the score cannot leave the low band no matter what the infrastructure heuristics say. This protects against the most common false positive: an ISP whose reverse DNS happens to look "hosting-like".
- Trusted organizations are capped at 3. Google's own address space, for example, hosts crawlers that scanners occasionally report; it is not a threat.
Country is never a standalone penalty. A handful of countries are statistically over-represented in fraud, but an address with no risk signals gets a 0 regardless of where it is. Country acts only as a small multiplier on risk that already exists, so it can nudge a borderline case across a band boundary without ever manufacturing risk from geography alone.
Visitor scores versus website scores
One subtlety trips people up. If you score a domain name, you are scoring the web server behind it, and a server is expected to live in a datacenter with a hosting ASN and no VPN. Those visitor-side signals are simply not evaluated for domain queries; only threat-intelligence and network-reputation signals apply. The API marks those categories as null rather than 0 so you can tell "not checked" from "checked and clean".
Reading the bands
The score maps to four risk levels. Here is what each one should mean operationally:
- Low (0–24): allow. This covers clean residential and mobile traffic, privacy relays and trusted infrastructure. Do nothing different.
- Medium (25–54): step up, don't block. Consumer VPNs, datacenter addresses and verified crawlers live here. Reasonable responses are an email verification step, a CAPTCHA on account creation, or a tighter rate limit. A blanket block at this level costs you real users.
- High (55–79): restrict sensitive actions. Tor exits, open and commercial proxies, and multi-feed threat listings. Allow browsing, but hold payouts, referrals, bulk exports and password changes behind a manual review or a stronger identity check.
- Critical (80–100): block or challenge hard. Several independent strong signals agree. Legitimate traffic at this level is rare enough that a hard challenge is justified.
Mistakes to avoid
- Blocking all VPNs. Corporate VPNs, privacy-minded users and entire countries with restricted internet access will disappear from your funnel. Use the medium band for friction, not denial.
- Treating the score as permanent. Mobile carriers and ISPs behind carrier-grade NAT share one public address among thousands of subscribers, and that address may be clean today and on a feed tomorrow. Re-score at the moment of the sensitive action, not once at signup.
- Ignoring the breakdown. A 40 from "verified crawler" and a 40 from "consumer VPN" call for completely different handling. Read the risk factors, not just the total.
- Using it alone. The strongest fraud signal is usually a combination: a datacenter IP plus a disposable email plus a brand-new account. Each is explainable on its own; together they are not.
Try it on a real address
Paste any IP or domain into the fraud score tool to see the five-category breakdown, the specific risk factors, and the raw JSON. The same endpoint is available through the API for use inside a signup or checkout flow. If you are curious what else an address gives away beyond risk, our post on what someone can do with your IP address covers the geolocation and ownership side.