Every fraud-prevention stack eventually reduces a complicated question (can we trust this request?) to a single number. For the network layer, that number is the fraud score. This page covers what the score actually measures, what counts as good or bad, why your own address might score high, and what to do about it.
What the Score Actually Measures
The score condenses everything knowable about an IP address into one decision-ready number. It answers a narrow question precisely: how much risk evidence surrounds the network this request came from?
That framing matters, because the score does not know who is behind the keyboard. It knows things like:
The last two rows separate good scoring from crude scoring. A model that only adds risk points ends up flagging every mobile carrier and shared connection in the world. A well-built fraud_score combines 40+ weighted signals and also subtracts: a residential ISP removes points, a verified crawler removes more, and CGNAT ranges are capped so a shared address cannot condemn a crowd. We walk through how 40+ signals combine into one risk number separately.
Score Ranges: What's Good and What's Bad
There is no universal scale (every provider computes its own), but on our 0–100 scale the bands map directly to actions:
Two caveats stop most scoring mistakes before they happen:
- Read the score against its own scale. Other vendors' bands differ: one major provider treats only 90+ as confidently high-risk. A "75" from two different APIs can mean two different things, so never port a threshold between providers unchanged.
- The right cutoff depends on the action being protected. A login can tolerate a higher block threshold than a checkout, because a re-prompted password costs seconds while a fraudulent card-not-present order costs a chargeback (the chargeback reduction playbook covers that side). We set out block thresholds for login, signup and checkout one action at a time.
Why Is My IP Fraud Score High?
The most common surprise in this topic: people check their own home connection and find a mid or high score. The causes are usually inherited rather than personal:
None of these mean you did anything. That is exactly why a fraud score is a risk signal, not a verdict, and why scoring systems that show their evidence beat black boxes. If a score arrives with its detection_methods (the exact signals that fired), you can see why an address scored 79 instead of guessing.
How to Bring a High Score Down
Honest answer first: you cannot appeal a number into changing. Scores move when the underlying evidence changes. What actually works:
- Turn off the VPN or proxy and reconnect from your normal ISP line. This is the single biggest and fastest reduction.
- Get a fresh address: renew your DHCP lease or reboot your router; on many ISPs this rotates you off a flagged address.
- Scan your devices. If something on the network is botnet-infected, the flags will keep coming back until it's cleaned.
- Ask your ISP for a different allocation if your range is chronically listed.
- For businesses: send transactional traffic from dedicated, properly configured infrastructure with clean reverse DNS, not from shared hosting ranges.
Then allow time. Continuously refreshed scores follow the evidence. When an address stops appearing in abuse feeds and proxy networks, its score decays back down, typically within days rather than months.
How to Check Any Address
For a one-off check, paste any address into the free checker linked at the top of this page and you get the 0–100 score, the recommended action, and the signals that produced it.
For production use, the same verdict comes from one API call. Here is the real scoring group for 185.220.101.1, a Tor exit node:
curl -H "x-api-key: YOUR_API_KEY" \
https://api.geoiphub.com/v1/lookup/185.220.101.1
{
"ip": "185.220.101.1",
"scoring": {
"fraud_score": 79,
"confidence": 0.6736666666666667,
"recommended_action": "block",
"detection_methods": ["tor_exit", "datacenter_ip", "rdns_tor"]
}
}
That response shape is the checklist for evaluating any provider: a score you can act on, a recommended action you can map to policy, a confidence value, and, most importantly, the named evidence behind the verdict. A bare number with no detection_methods is impossible to audit when a real customer asks why they were blocked.
Score at decision points rather than on every pageview. At login, the score is a first filter against credential stuffing and account takeover. At signup, it helps catch duplicate accounts from one operator and coupon and referral abuse. At checkout and withdrawal, it is one layer in a payment fraud detection stack. The same network signals also help spot click fraud by IP address on paid campaigns. Pair the IP layer with device and behavioral signals for full coverage, since device fingerprinting and IP intelligence see different things. Our fraud prevention guide shows where the score plugs into each flow, and how VPN and proxy detection works explains where the heaviest-weighted signals come from.
Start Scoring Every IP in Real Time
GeoIPHub gives fraud, security, and engineering teams a single API for IP geolocation, VPN & proxy detection, threat intelligence, and an explainable 0–100 risk score.
Get Your Free API Key
Sign up in minutes — no credit card required. Upgrade only when you need more volume.
Frequently Asked Questions
What is a good IP fraud score?
On a 0–100 scale where higher means riskier, scores from 0–25 indicate no meaningful risk evidence and are safe to allow. Scores of 26–50 warrant logging and monitoring, 51–75 justify a step-up challenge like MFA or CAPTCHA, and 76–100 carry strong multi-signal evidence worth blocking. Scales differ between vendors, so always read a score against the provider's own bands rather than assuming every 0–100 scale means the same thing.
Does a high IP fraud score mean fraud was committed?
No. A fraud score measures the risk of the network a request came from (anonymization, abuse history, and infrastructure signals), not the intent of the person using it. A high score means the address deserves scrutiny or a challenge, not that its user is a fraudster. That is why mature systems pair scores with step-up verification instead of silent hard blocks.
Does using a VPN or proxy increase my IP fraud score?
Yes, almost always. Commercial VPN exits and datacenter proxies are the infrastructure most fraud actually uses, so detection systems weight them heavily. Tor exits score higher still. Turning the VPN off and reconnecting from your normal ISP connection is the single fastest way to present a lower-risk address.
Why is my home IP's fraud score high?
The usual causes are inherited, not personal: your ISP recycles addresses and a previous holder ran abusive traffic, your address sits in a shared CGNAT pool with thousands of other users, or your ISP's range was recently flagged on abuse blocklists. Malware on a device in the household can also put an address on botnet lists. None of these mean you did anything wrong, and well-built scores cap shared-address penalties for exactly this reason.
How do I check an IP's fraud score?
Paste the address into a free checker to get its score and the signals behind it in seconds, or call an IP intelligence API for programmatic checks at signup, login, or checkout. When evaluating any score, prefer providers that show the contributing evidence. A bare number you can't audit is hard to act on and impossible to defend to a blocked customer.