How is the IP fraud score calculated?

The fraud score combines several signals into a single 0–100 risk value: whether the IP belongs to a known VPN, proxy or Tor exit node; whether the ASN is classified as hosting or datacenter (rather than a residential ISP); reverse-DNS patterns associated with anonymization services; and matches against threat-intelligence blocklists. Each signal contributes weighted points so a clean residential IP scores low while a Tor exit on a hosting ASN with active blocklist hits scores high.

What do the score ranges mean?

Scores are grouped into four bands. 0–24 is Low risk, typical of residential or mobile IPs with no anonymization or abuse signals. 25–54 is Medium, often shared hosting, mobile gateways, or IPs with minor signals. 55–79 is High, common for datacenter ranges, commercial VPNs, and IPs with one or more blocklist hits. 80–100 is Critical and usually indicates Tor exits, abusive proxies, or IPs with multiple active threat-intel matches.

How does the VPN, proxy, and Tor detection work?

VPN detection relies on curated lists of commercial VPN provider IP ranges and ASNs, plus heuristics on reverse DNS and network ownership. Proxy detection looks for open and commercial proxy ranges. Tor detection uses continuously refreshed exit-node data. When an IP matches, the page shows which provider or network it was identified with.

What is an ASN and why does it affect the score?

An ASN (Autonomous System Number) identifies the network that announces an IP range on the public internet — typically an ISP, hosting provider, or large company. The ASN’s classification (residential ISP, mobile carrier, hosting, business) is one of the strongest signals for fraud scoring because legitimate end users almost always connect from residential or mobile ASNs, while bots, scrapers, and VPN exits cluster on hosting and datacenter ASNs.

How often are the blocklists and VPN lists updated?

The threat-intelligence blocklists, Tor exit list, and VPN/proxy ranges are refreshed regularly from their upstream sources so the score reflects the current state of an IP rather than a stale snapshot. Because reputation can change quickly, a result reflects the data available at the time of the lookup.

Can I check the risk score of my own IP, or only other IPs?

Yes. Use the "My IP" quick link or visit /score/my to score the IP address you are currently connecting from. This "visitor check" mode is useful for confirming whether your home, office, or VPN connection looks clean to other sites, or for testing how a customer’s connection would be evaluated.

Live/Fraud & risk signals

IP Fraud Score

Score an IP address as a visitor (VPN/proxy, datacenter, threat intel) — or a domain to rate the website behind it.

Try: My IP Random VPN Random Proxy Random Tor

Risk score0–100 across threat, anonymity, infrastructure, reputation and bot signals.

VPN & proxyTor exits, open and commercial proxies, consumer VPNs and privacy relays, each weighted differently.

Datacenter & botsHosting ASNs, reverse-DNS patterns and verified crawlers such as Googlebot.

Threat intelligence96 curated feeds, weighted by reliability and de-duplicated by family.

329,706 scores in the last 30 days 1,308,100 flagged addresses tracked Verified crawler detection Free JSON API

Fraud Score

—

/ 100

Waiting

IP Address

—

Country

—

City

—

Hostname

—

Reverse DNS

—

ISP

—

VPN Provider

—

ASN

—

Low 0–24 Medium 25–54 High 55–79 Critical 80–100

Security Checks

Risk Factors

Raw JSON

// Run an analysis to see results

Welcome backCreate your account

IP Fraud Score

Fraud Score

Popularity

Security Checks

Risk Factors

Raw JSON