A good IP fraud score is a low one. On the common 0 to 100 scale, Scamalytics calls 0 to 19 low risk, and IPQualityScore starts calling a score suspicious at 75. No score is good everywhere, because each site sets its own cutoff, and some scales run the other way. We read the documentation of five scoring services and checked the 4,992 free proxies working on our list on October 22, 2026. Their median score was 55.
What is an IP fraud score?
An IP fraud score is one number that rates how risky an address looks. A scoring service builds it from what it knows about the address. Is it a proxy, VPN or Tor exit? Which network does it belong to? What abuse has been reported from it? On most scales, a higher number means more risk.
IP fraud score
a risk rating
One number that rates how risky an IP address looks, usually from 0 to 100 with higher meaning riskier. It combines proxy, VPN and Tor flags, the network the address belongs to, and the abuse reported from it.
Each service defines its number a little differently. Scamalytics counts the people behind an address. A score of 70, it says, means "approximately 7 out of 10 users seen from that IP address have been linked to fraudulent activity". IPQualityScore bases its score on the IP and, when a site passes them, the visitor's user agent and language. MaxMind's minFraud rates a whole payment, and its risk score of 20 means "a 20% chance of being fraudulent". AbuseIPDB publishes a confidence score built from user reports, which it calls "our calculated evaluation on how abusive the IP is".
Is an IP fraud score the same as IP reputation?
They overlap. A reputation score answers one question: how much abuse has come from this address? AbuseIPDB's confidence score, built from user reports, is that kind. A fraud score adds other signals to the history, such as proxy flags and the network type. MaxMind goes further and scores a whole payment. Its inputs include the reputation of the IP, the email address and the device, how often each appears across its network, and proxy detection.
What is a good IP fraud score?
It depends on whose scale you read. Five services document theirs:
| Service | Scale | Where risk starts |
|---|---|---|
| IPQS | 0 to 100 | Suspicious at 75 |
| Scamalytics | 0 to 100 | Medium at 20 |
| MaxMind | 0.01 to 99 | A % chance of fraud |
| Cloudflare | 1 to 99 | Low means a bot |
| reCAPTCHA v3 | 0.0 to 1.0 | Low means a bot |
Scamalytics suggests an action for each range. Allow 0 to 19, and show a CAPTCHA or add checks at 20 to 59. At 60 to 89, ask for step-up authentication; at 90 to 100, block or review. It calls those ranges "a starting point" for each site to adjust.
IPQualityScore draws its lines higher. It calls scores of 75 and up "suspicious and likely to be a proxy, VPN, or TOR connection". Those users are "not necessarily" fraudulent, it adds, and may be "protecting their privacy online". It treats 90 and up as high risk.
Two scales run the other way. Cloudflare's bot score runs from 1 to 99, and "a score of 1 means Cloudflare is quite certain the request was automated". Google's reCAPTCHA v3 returns 0.0 to 1.0, where "1.0 is very likely a good interaction". Read the direction of a scale before you read its number.
Where do sites use IP fraud scores?
Sites check scores at the moments that cost them money: sign-ups, logins and payments. For logins, Google's reCAPTCHA guide suggests that with low scores sites "require 2-factor-authentication or email verification". Scamalytics' suggested actions climb from a CAPTCHA to step-up authentication to a block. MaxMind's minFraud is a transaction risk service, so its score sits on the checkout.
The same address can therefore pass a newsletter form and fail a payment. A score is one input to a decision that each site makes for itself.
What scores do free proxies get?
We run an IP reputation check on every working address of our free proxy list. At 06:57 UTC on October 22, 2026, 4,992 free proxies were working, and every one had a score from the check. The check scores from 0 to 100, higher meaning riskier. Only 6 scored under 25, and the median was 55.
The check flagged 4,955 of them, 99.3%, as proxies. It found recent abuse on 4,440, or 89%. The network decided much of the rest:
| Network | Working | Median score |
|---|---|---|
| Datacenter | 1,870 | 80 |
| Home or business | 3,120 | 55 |
| Mobile | 4 | 50 |
More than half of the datacenter addresses, 54%, scored 75 or more, against 22% of those on home or business networks. Our check uses its own scale, so these numbers do not convert into Scamalytics or IPQualityScore points. Read them as a pattern: a flagged address on a hosting network scores highest. Our page on anonymous proxy detected errors measures the same list against proxy flags.
Why is my IP fraud score high?
Usually the address carried the score before you did anything. Four causes cover most cases:
- It is flagged as a proxy, VPN or Tor exit. IPQualityScore ties its suspicious band to exactly that.
- It sits on a hosting network. On our free list, datacenter addresses scored a median of 80, against 55 on home or business networks.
- It is shared. An address that many people use at once collects everyone's reports. Scamalytics' list of its highest-risk addresses on October 22, 2026, held mobile carriers such as Claro, MTN Nigeria and Telekom Srpske at 100. The same list held hosting companies such as OVH, DigitalOcean and Amazon. Our page on carrier-grade NAT explains why carriers share addresses.
- Its network has a record. An address with no history of its own inherits its network's. Scamalytics scored one of Cloudflare's addresses at 0 out of 100 from the record of Cloudflare's other addresses, because it sees no traffic from that address itself.
A high score is a property of the address and its network. It says little about the person using it, which is why IPQualityScore separates "suspicious" from "fraudulent".
How do you check an IP fraud score?
Look the address up in a scoring service, and read the number against that service's own scale. IPQualityScore and Scamalytics both offer lookups on their sites. MaxMind's minFraud scores whole payments for businesses. Our free proxy checker app shows the fraud score of the exit you connect through, and the network and country behind it.
Check the exit you will actually use, from the line you will use it on. A rotating line gives you a new address on each new connection, so its score can change from one request to the next.
How can you lower your IP fraud score?
A score belongs to the address, so the fix is an address with a better record.
- Stop using free proxies and public VPN exits. 99.3% of the working free proxies we checked carried a proxy flag.
- Use a consumer network for sites that score visitors. Hosting networks start high, as the table above shows.
- Keep one address from carrying many accounts. MaxMind lists velocity, how often a detail appears across its network, among the inputs to its risk score.
- Check again later. Scores move with recent behavior: IPQualityScore says scores of 90 and up "indicate recent or excessive abuse".
Can a proxy have a low fraud score?
A proxy takes the score of its exit address. Free proxies almost never score low: 6 of the 4,992 working ones scored under 25 on our check. A residential exit sits on a consumer network, and consumer networks scored lower than hosting networks on our free list. The exit's own record decides the rest. We make no promise about the score of any exit, ours included, so check the one you get.
A low score clears one check out of several. Sites also read your TLS fingerprint, your headers and your behavior. Our guide to how websites detect proxies covers those signals, and what is a clean IP covers the address side. Our residential proxies cost $0.50 per GB for one GB and $0.44/GB at 2,000 GB+, and residential pricing lists every tier.
What this page could not check
- Scales, not models. Each service documents its scale and its suggested ranges. None publishes how it weighs each signal, so we cannot say why one address scores 60 and another 80.
- One check, one scale. Our free list scores come from one IP reputation check on its own 0 to 100 scale. They do not convert into another service's points.
- A moving list. The working list changes every few minutes. A second read three minutes later counted 4,867 scored addresses.
- No paid networks. We did not score any paid proxy network, ours included.
- Check by January 22, 2027. Services change their ranges and their suggested actions.
Sources
- IPQualityScore: Proxy and VPN Detection API, response parameters; IP reputation check. Read October 22, 2026.
- Scamalytics: products page (score definition and suggested actions); IP fraud check pages. Read October 22, 2026.
- MaxMind: Overall risk score, minFraud knowledge base. Read October 22, 2026.
- AbuseIPDB: API documentation, abuseConfidenceScore. Read October 22, 2026.
- Cloudflare: Bot scores, developer documentation. Read October 22, 2026.
- Google: reCAPTCHA v3 developer documentation. Read October 22, 2026.
- HProxy free proxy list: IP reputation check of the working free proxies, October 22, 2026, 06:57 UTC.
