IP purity & risk evidence check
Try a sample IP
What is IP purity, and where does the score come from?›
Having sign-up, payment, or regional-access issues? Check IP-layer signals first; account, device, behavior, and platform policy are separate.
IP purity reflects how heavily an address is flagged across threat databases. IPOK has up to 10 integrated sources; dormant or failed sources are excluded, and each result reports the count actually returned.
🔒 Privacy-firstno signup · no tracking cookies · WebRTC on click only›
No signup · no session replay · no tracking cookies · WebRTC contacts public STUN on click; ICE candidates stay on-device
Lookup caches are not tied to visitors; we do not sell query data. Privacy →
What “IP purity” and a risk score actually mean
Some platforms use an exit IP as one of many risk inputs, but IPOK cannot see their internal models. Here, “IP purity” means only observable IP-level evidence: usage type, proxy / VPN / Tor flags, abuse and blocklist records, attribution consistency, and the /24 neighborhood.
The 0–100 score summarizes those returned signals; higher means stronger adverse IP evidence observed by IPOK. It is not any platform's own score and cannot by itself predict signup, login, payment, or content access. Account state, device fingerprint, behavior, and platform policy are separate factors.
How IPOK gets to the number (the one-line version)
IPOK does not trust any single vendor. Up to 10 sources are integrated: ip-api, ipapi.is, proxycheck, AbuseIPDB, Scamalytics, StopForumSpam, IPOK-DB, IPHub, vpnapi.io, plus the currently dormant and uncalled IPQS. Dormant or failed sources are excluded and each result reports the actual count. Usable numeric scores are weighted, with hard-signal floors for Tor, authoritative blocklists, and confirmed proxies.
When a score is available, open “How is this score computed?” to review sources, weights, and floors. If current evidence is missing, or stale / undated risk contributions remain in the aggregate, the result shows “Insufficient evidence” with no total score. Existing observations and missing-source states remain visible; unknown is not safe.
Want to look up any IP address instead of your own, or test your VPN for leaks?
Use cases & threat detection scenarios
Why clean exit IPs are vital for global operations, account safety, and automation
Cross-border e-commerce & multi-account safety
E-commerce platforms commonly evaluate network reputation during authentication and checkout. An exit IP flagged as hosting, scoring high risk across multiple sources, or listed on blocklists may increase the likelihood of verification challenges or association reviews. Multi-source checks help surface anomalous exit signals before operating storefronts.
Web scraping & anti-bot proxy verification
When scrapers using Playwright or Puppeteer encounter Cloudflare Turnstile or CAPTCHAs, network reputation is an initial diagnostic layer. Multi-source scoring helps isolate whether issues stem from exit IP reputation or client-side fingerprint configuration.
Global social media growth & account warmup
When operating multi-account social media setups, proxy exits clustered within abused subnets or hosting blocks can serve as correlation clues for platform risk controls. Cross-checking IP reputation and /24 block distribution beforehand assists in filtering out flagged proxy exits.
Network security & privacy penetration audit
Audit whether VPN, proxy, or gateway routing leaves unintended public IPs exposed. WebRTC candidates are parsed strictly on-device, and dual-stack and DNS are diagnosed separately for network debugging privacy.
Multi-dimensional detection spectrum
Consolidated multi-source evidence and transparent rules to compare cross-vendor differences
Dual-stack routing & network topology
Inspect IPv4 and IPv6 routes independently to detect single-stack bypasses or tunnel leaks under proxy/VPN setups, distinguishing datacenter hosting, residential ISPs, and cellular networks.
Multi-source threat database consensus
Aggregates up to 10 risk sources (ip-api, ipapi.is, proxycheck, AbuseIPDB, Scamalytics, StopForumSpam, IPOK-DB, IPHub, vpnapi.io). Update and caching policies vary by source: some online risk feeds use a default 12-hour edge cache and a 72-hour global cache, with fallback to snapshots fetched no more than 7 days earlier when upstream data is unavailable. Other sources and offline datasets follow separate policies; check the returned observation time and stale indicator where available.
/24 subnet neighborhood reputation analysis
Examine known abuse flags across the same /24 subnet based on IPOK's offline reputation database and scan snapshots (with 1-hour response caching), offering correlation context without predicting third-party platform actions.
AI & streaming service region reference
Provide snapshots of official regional coverage and known restrictions for major AI models (ChatGPT, Claude, Gemini) and streaming platforms, serving as static references rather than live unblocking tests.
How to read the IP-evidence tiers
The hosting signal sets a 35-point floor, so an available score can still fall in Lower observed risk; mobile sharing is only a topology-based heuristic estimate. Every tier describes IP-level evidence only. Account, device, behavior, and platform policy are separate.
Frequently asked questions & diagnostic tips
Why can sources succeed without a score?
A successful response is not necessarily current evidence. Stale or undated observations, or non-current risk contributions in the aggregate, hide the total and show “Insufficient evidence”. Review sources and observation times, then recheck if needed; missing data is not evidence of safety.
Why is my IP showing a high risk score even though I've never done anything wrong?
Risk scores are about reputation, not just your own behavior. The most common reasons: your IP sits in a data-center / hosting range (VPS, cloud server, some “residential” proxies), your VPN's exit IP is shared by many users, or your /24 neighborhood is full of flagged addresses so you get caught by guilt-by-association. Open the score breakdown and signals list on your result — IPOK names the exact reason (e.g. “hosting”, “proxy/VPN”, “on blocklist”, “dirty neighborhood”) rather than leaving you to guess.
What's the difference between a residential IP and a hosting (data-center) IP, and why does it matter?
A residential IP is assigned by a consumer ISP to a home connection; a hosting IP belongs to a data center (AWS, a VPS provider, etc.) where bots, scrapers, and proxies are also common. IPOK reflects that distinction with a 35-point hosting floor: an available score can still fall in Lower observed risk, but not in the under-15 Low observed risk band. Additional proxy, abuse, or blocklist evidence is what pushes the score higher.
How is IPOK's risk score different from other IP checkers?
IPOK integrates up to 10 sources, shows the verdicts actually returned for this lookup side by side, and publishes its weights, hard floors and bands. Dormant or failed sources do not contribute to the score; third-party providers still control their own algorithms and data. Tools use different sources and models, so results often differ; IPOK has no online ping or traceroute today.
Does IPOK log or store the IPs I check?
IPOK has no accounts and does not store a per-request history tying a requester to a target IP and timestamp. It separately uses an instance-local one-minute requester-IP burst bucket, a requester-IP/UTC-day quota bucket, and a shared source-result cache keyed by target IP; no relationship between the three is stored. Normal cache entries are valid for 72 hours, with stale fallback readable for up to 7 days. Cloudflare still processes standard request metadata; WebRTC internal addresses stay local.
What score do I need to pass sign-ups and avoid bans?
IPOK has no data-supported pass line for that outcome. The score describes current IP-level evidence only; the same IP can produce different results across platforms, accounts, devices, and behavior. Use the score and source breakdown as diagnostic clues, not a pass guarantee.
My VPN / proxy scores badly — how do I find an exit with weaker adverse IP evidence?
Switch exits and compare the source breakdown, hard floors, and /24 neighborhood to identify candidates with weaker adverse evidence in IPOK's data. A residential or mobile label does not guarantee a platform outcome; validate against the target service and its rules yourself.
Why is IP purity critical for cross-border e-commerce (Amazon, TikTok Shop)?
E-commerce platforms typically deploy multi-dimensional risk controls around sign-in and checkout. IP reputation serves as a diagnostic clue: an exit IP carrying hosting tags, elevated risk scores, or abuse records across certain feeds may increase the chance of verification challenges or association reviews. IPOK displays multi-source signals and score breakdowns, but cannot confirm which feeds a given platform uses, nor predict platform decisions.
Why does a provider's 'native residential proxy' sometimes show as hosting or high-risk on IPOK?
Discrepancies between provider labels and test results can arise from differences in database classification, update lag, evolving IP usage, or past abuse records. IPOK displays observations returned across sources; a single label cannot confirm provider misrepresentation or prove the exact underlying route.
Why do automated scrapers (Playwright/Selenium) still hit CAPTCHAs even with new proxies?
Bot detection systems typically evaluate network reputation, browser fingerprints, and behavioral dynamics concurrently. IP reputation is only one layer: an exit IP flagged as hosting or with elevated risk scores may increase challenge frequencies, but fingerprint anomalies, header mismatches, or abnormal request velocity can also trigger defenses. We recommend investigating network IP signals and browser fingerprints separately.
When does IPOK's WebRTC check run, and where does the data go?
It runs only after you click. The browser connects to Google and Cloudflare public STUN servers; candidate addresses are parsed locally in the browser and are not sent to IPOK.