IP fraud score
An IP fraud score is one vendor’s guess at how risky an address looks. The trouble is that every vendor guesses differently, and a single number hides why. IPOK asks the sources below in one free lookup, combines them with weights and rules that are published in full, and shows every source’s own answer next to the final 0–100 score. When the sources disagree, you see the disagreement.
Every source that returns a numeric score enters a weighted average. Sources that are dormant, fail or give no score are left out of that average rather than counted as clean. If no source returns a score, the base is 10.
| Source | Weight | What it contributes |
|---|---|---|
| Scamalytics | 0.90 | Fraud score with proxy / VPN / datacenter coverage |
| proxycheck.io | 0.85 | Proxy and VPN detection |
| AbuseIPDB | 0.80 | Community abuse reports, plus whitelist flag |
| IPOK-DB (offline) | 0.80 | Official Tor exits, X4BNet VPN ranges, Spamhaus DROP, tested open proxies; refreshed weekly |
| ipapi.is | 0.70 | Calibrated abuse score and network attribution |
| IPHub | 0.70 | Explicit proxy / Tor / hosting verdicts only (iCloud Relay kept separate) |
| vpnapi.io | 0.70 | Explicit VPN / proxy / Tor booleans; iCloud Private Relay kept separate |
| IPQS | 0.70 | Fraud score; currently dormant (no API key), never called |
| StopForumSpam | 0.65 | Forum / sign-up spam reports |
| ip-api | 0.50 | Boolean flags only; lowest weight |
Weights are read from the same constants the scoring code uses; the full method is on /en/methodology.
Some evidence is strong enough that averaging should not wash it out. If a signal fires, the final score is at least its floor, whatever the average says. The final score is the highest of the average and every floor that fired, rounded and kept within 0–100.
| Signal | Floor |
|---|---|
| Tor exit node | 90 |
| Listed on a spam / abuse DNS blocklist | 70 |
| Confirmed proxy / VPN (enough independent votes) | 65 |
| Recent abuse reports above threshold | 55 |
| ≥ 50% of the /24 flagged (share ≥ 0.5, not a blanket range) | 50 |
| ≥ 25% of the /24 flagged (share ≥ 0.25, not a blanket range) | 40 |
| Datacenter / hosting | 35 |
Two details matter. A datacenter address only gets a floor of 35, because hosting is a use, not fraud. A trusted whitelist suppresses only that floor, so 8.8.8.8 below keeps the weighted average instead of being lifted. The band is separate: a hosting address whose score would be Low observed risk is still labelled Lower observed risk · datacenter. The score itself does not change.
Hosting classification checks the operator-published ranges below. The build supports IPv4 and IPv6 from AWS, GCP, Cloudflare, DigitalOcean, and Linode; actual coverage depends on each source and the retained snapshot. Both families are not guaranteed for every source or build. Oracle and AzureCloud are IPv4-only in this implementation.
Failed refreshes retain older snapshots and their original fetch times; a rebuild does not mean every source was updated. Freshness follows the actual fetch time and upstream expiry. Missing coverage or expired data does not mean clean. See per-source coverage and dates in the methodology.
The Azure link is Microsoft's Service Tags download confirmation page. The build follows its ServiceTags_Public JSON link and uses only the IPv4 prefixes in the AzureCloud tag. A hit means the address falls in a range that vendor published. It is not a fraud verdict, and it does not by itself raise the score into the high-risk band.
A proxy/VPN floor needs at least 2 dedicated votes on a hosting address, or 2 on any other address. ip-api does not count as one of those votes. A known anonymizer ASN can qualify on its own. The thresholds are recalibrated weekly; the current value and sample size are on the methodology page.
The band describes how strong the IP-level evidence was in this lookup. It is not any platform’s internal score and IPOK has no data to set a “pass mark” for a specific service.
These are the scores IPOK returned for four public addresses at 2026-10-18 16:25 (Beijing time), with what drove each one. Click an address to see its current result; scores change as sources update.
| IP | Score | Why |
|---|---|---|
| 8.8.8.8 Google Public DNS | 11 | ip-api reported proxy=true, but no dedicated proxy/VPN source agreed, so it was outvoted. It is a hosting address, but AbuseIPDB marks it as whitelisted, and a trusted whitelist suppresses the datacenter floor, so the score is the weighted average of 11. |
| 1.1.1.1 Cloudflare DNS | 18 | 9 sources answered. vpnapi.io flagged it as VPN and proxy, one dedicated vote where two are required, so it was outvoted. AbuseIPDB whitelists it, so the datacenter floor does not apply either: the score is the weighted average of 18. |
| 54.156.0.101 AWS EC2, us-east-1 | 65 | proxycheck.io (proxy + VPN) and vpnapi.io (VPN) voted: exactly the two votes required, so the confirmed proxy/VPN floor lifted the weighted average of 27 to 65. Two votes is the minimum, so read this as moderate evidence. Type: hosting, matching AWS's published EC2 range. |
| 171.25.193.25 Tor exit (DFRI) | 90 | 6 of the 8 sources that answered said tor=true, it is on the official Tor exit list, and SpamCop and S5H list it. The weighted average was 81; the Tor floor raised it to 90. |
Lookups at 2026-10-18 16:25 Beijing time (UTC+8) from one test server. Most risk-source answers were served from cache (read between Oct 16 and Oct 18); Scamalytics was not called for the Tor and AWS addresses because its quota was used up, and IPQS is dormant.
The two DNS resolvers show why a majority vote is worth having: each had one source raising a false proxy or VPN flag, and the other sources outvoted it. The Tor exit shows the opposite case, where nearly every source agreed and a hard floor applied. The AWS address sits in between: two votes is exactly the threshold, so the score is high but the evidence is thinner than it looks. That is the kind of nuance a single fraud number cannot show.
Scamalytics and IPQualityScore both publish their own fraud scores with free tiers: Scamalytics 5,000 lookups a month, IPQualityScore 1,000 a month and at most 35 a day, both with a free account (checked 2026-10-11). IPOK calls Scamalytics only when you explicitly look up an IP and quota is available, and does not call IPQualityScore at all. For quotas and what each free tier flags, see the free IP checkers comparison; for how often each source actually flags datacenter vs residential IPs, see source agreement data.
It only sums up the IP-level evidence IPOK received. It does not see your account, device fingerprint, payment details, behaviour or a platform’s policy, so it cannot promise that a sign-up, login, payment or stream will work. Use it to find out which signal is behind a block, then fix or appeal that signal. For the address’s location and network, see IP lookup; for whether your VPN exposes another address, see the IP leak test.
A number that estimates how suspicious an IP address looks, based on signals such as proxy, VPN or Tor use, hosting ranges, blocklist listings and abuse reports. Each vendor computes it differently, so the same IP can get very different scores from different services.
Open https://ipok.io/en: it checks your own IP automatically, or enter any public IP. You get IPOK's 0–100 score and the separate answer from each source, including Scamalytics' fraud score when it is called. No signup. From code, GET https://ipok.io/api/ip?ip=… returns the same data with a riskBreakdown block.
IPOK's bands are Low observed risk < 15, Lower observed risk 15 – < 50, Caution 50 – < 70, High risk ≥ 70. They describe how strong the negative IP-level evidence was, from very weak (Low observed risk) to very strong (High risk). There is no score that guarantees a sign-up or payment will pass: platforms also look at the account, device and behaviour, which IPOK cannot see.
The score describes the address, not you. Common reasons are that the IP is in a hosting or VPN range, that many people share the same exit, or that many neighbours in the same /24 are flagged. Open the per-source breakdown to see which signal raised it.
They use different data, different definitions (fraud, abuse, proxy) and different scales, and they update at different times. IPOK shows each source next to its weight so a disagreement is visible instead of hidden inside one number. IPQualityScore is currently not queried by IPOK because it has no API key configured.
If the cause is a blocklist or abuse record, check and appeal it through that list's official process. If the cause is the network type (hosting, VPN), that is a property of the address; a different address only gives you a different record, not a guaranteed lower score.
Yes: IPOK's /api/ip is free, keyless and CORS-enabled, with 20 self-lookups and 15 specified-IP lookups per UTC day per source IP. For an embeddable badge use /api/badge; it does not call Scamalytics, so its score can differ slightly from a full lookup. Vendor free tiers are compared on the free IP checkers page.
Last checked 2026-10-18. IPOK is a verified AbuseIPDB webmaster and only queries it; it never reports visitor IPs.