IP Purity Check

A common misconception is that "IP purity" is a value some API returns directly. It isn't — no standards body ever defined the term. It's a concept the fraud-prevention industry grew out of practice: collapsing how suspicious an IP looks across several dimensions into a single 0-100 score, where lower is cleaner. Those dimensions roughly cover whether the IP belongs to residential broadband or a datacenter/hosting provider, whether it has recently been used as a proxy/VPN/Tor exit, whether it appears in spam blocklists and abuse-report databases, and how the surrounding network block is regarded.

Because there is no unified standard, two tools can score the same IP more than 20 points apart — and that's normal. They use different data sources, different weights, and different tolerance for datacenter ranges. So a bare number tells you little; what matters is why it got that score — which specific signal dragged it down.

IPOK aligns its purity scale with the bands most common in the industry: below 15 is extremely clean (typical residential broadband with no risk flags), below 50 is broadly safe, and above 70 is high risk (usually a datacenter IP compounded by a proxy flag or blocklist hit). The checker at the top of this page returns the composite score for your current exit IP and lays out every deduction reason, rather than handing you a single red number.

A purity score is rarely a plain average — it's two steps: weighted aggregation, then a hard-signal floor. Step one sums each source's risk judgment by trust weight: a geo/ASN baseline, dedicated proxy-detection databases, abuse-report databases, and fraud-scoring services each contribute a different share, producing a continuous value. This separates "mildly suspicious" from "clearly dangerous."

But weighted averaging has a fatal flaw. If an IP hits one decisive signal — say it's a known Tor exit node, or listed on an authoritative blocklist like Spamhaus — while every other source stays quiet, the average can still land low and give a false sense of safety. So step two imposes a hard-signal floor: once such a decisive signal fires, the score is forced into the high-risk band regardless of what the other sources say. This is the litmus test for whether a purity tool is trustworthy — a tool that only averages will miss genuinely dangerous IPs.

IPOK aggregates 8 risk sources — ip-api, ipapi.is, proxycheck, AbuseIPDB, Scamalytics, StopForumSpam, IPQS — plus a self-built IPOK-DB that folds in Tor exit lists, X4BNet's VPN/datacenter ranges, Spamhaus, and more. Showing sources side by side keeps it explainable: you can see whether proxycheck flagged a proxy, whether AbuseIPDB has reports on file, or whether it's simply a datacenter range — instead of staring at a black-box number with no recourse.

Of all the signals, "native residential vs datacenter hosting" tends to move purity the most. The reason is that every IP sits behind an ASN (autonomous system number), and ASNs have types: broadband carriers like Comcast or China Telecom are classified residential/ISP, while Alibaba Cloud, AWS, DigitalOcean and Zenlayer are classified hosting/datacenter. Risk systems are inherently wary of the latter, because legitimate users don't shop, log into Facebook, or stream Netflix from a server — that behavioral profile itself looks like a bot or proxy.

This is why two IPs with identical clean histories — no blocklist entries, no abuse reports — can score very differently: a home connection drops below 5 while a brand-new cloud server is stuck at 50-55. The datacenter attribute is a score floor. If you run cross-border e-commerce, self-host a proxy on a VPS, or log into sensitive accounts through a VPS node, this single line decides whether risk systems will single you out.

Classifying residential vs datacenter takes more than the ASN name — it also weighs rDNS (reverse-resolved hostnames often carry residential hints like pool/dyn/dsl or datacenter hints like server/vps/cloud) and the registered purpose of the IP range. IPOK labels the native/datacenter verdict directly in the results and surfaces it as its own tag in the checker, so you can tell at a glance whether a high score is just the IP being a datacenter, or something worse like a blocklist hit.

Start with the uncomfortable truth: purity is largely an inherent property of the IP, not something you wash clean with a local setting. The most effective — and most fundamental — fix is to switch to an IP that is clean by nature: prefer a native residential IP (home broadband, residential proxy) over a datacenter IP. Datacenter IPs are all but destined to hover around 50 no matter what you do locally. If your workload truly needs a server, pick hosts and ranges with better reputation that aren't in large abuse-flagged blocks — but the ceiling is fixed.

Next, don't leak your own real IP. Even with a clean exit IP, the browser's WebRTC can expose your real local/public IP directly to a site via ICE candidates, and DNS requests that bypass the proxy will reveal your real resolver's location — either leak undoes the clean IP you just acquired. This page's checker includes WebRTC and DNS leak checks that tell you whether your exit IP matches what the browser actually exposes.

Then check your neighbors. Risk systems weigh the overall reputation of your /24 block — if many IPs in the same block are reported or used as proxies, you get penalized by association even with a spotless personal record. Looking at neighbor quality with a /24 profile before switching IPs is far cheaper than discovering the whole block is dirty after the fact. Finally, blocklists decay over time: if an IP entered AbuseIPDB or Spamhaus for past abuse, some lists drop it weeks after the abuse stops — but that timeline is out of your hands.