IP Risk Scoring
A fraud score you can read the reasoning for.
Every lookup returns scoring.fraud_score — a 0–100 risk score built from 40+ weighted signals — alongside a recommended_action and a detection_methods array naming exactly which signals fired. The model subtracts as well as adds: a residential ISP takes 20 points off, a verified crawler takes 30 off, and CGNAT ranges are capped so shared mobile IPs don't get punished for their neighbors. Plug it into checkout, signup, and login without inheriting a black box.
- 40+ Weighted Signals
- Exonerating Evidence
- CGNAT Safeguards
detection_methods
40+ Weighted Signals
VPN handshake evidence, proxy probes, provider-list matches, ASN classification, WHOIS keywords, threat-feed hits, DNSBL listings, and more — each signal carries its own weight in the final 0–100 score.
Exonerating Evidence
The score goes down when the evidence says it should: a residential ISP subtracts 20 points, a verified crawler subtracts 30. Most scoring engines only accuse — ours also clears.
CGNAT Safeguards
Carrier-grade NAT puts thousands of real users behind one IP. GeoIPHub caps scores on CGNAT ranges so one bad actor on a mobile network doesn't get an entire city blocked.
Recommended Actions
Every score maps to a verdict you can branch on: allow (0–25), review (26–50), step_up (51–75), block (76–100). Use ours as a starting point or apply your own thresholds to the raw score.
Explainable Verdicts
scoring.detection_methods lists exactly which signals fired on this IP. When a customer asks why they were challenged, you have a real answer — not a number you can't defend.
Overall Confidence
scoring.confidence reports how much evidence sits behind the verdict, so your decision engine can treat a well-evidenced 80 differently from a thin one.
Ready to get started?
1,500 free requests per day. Every field included. No credit card required.