What is an IP fraud score, and how is it calculated?

An IP fraud score is a number that estimates how likely traffic from an IP address is to be abusive. It usually runs from 0 to 100, and a higher number means more risk. The score sums up what is known about the address. That includes the attacks it was caught in, whether it is a VPN, proxy or Tor exit, and how much of its network is abusive. Because it rates the address, everyone who shares that address shares the score.

#How is an IP fraud score calculated?

A scoring service gathers evidence about an address, weighs each piece and maps the total onto its scale. FFraud publishes its method, so its steps serve as the worked example here (how we score).

1. Abuse. Honeypot sensors and community reports record what the address did: command and control, botnet traffic, brute force, scanning, phishing or spam.
2. Proof. An address joins the public list only after at least two independent confirmations.
3. Connection type. The address is classed as VPN, proxy, Tor, data center, home or mobile.
4. Neighborhood. The share of the surrounding /24 network that is flagged counts, even for a quiet address.
5. Recency and confidence. The score notes whether abuse is recent or old, and how many separate layers agree.
6. Floors and ceilings. Tor exits get a high floor, shared mobile gateways get a ceiling, and crawlers of known search engines stay low.

No single layer can push the score to the top on its own. An address in a data center with no abuse stays low: Google's public resolver 8.8.8.8 scored 5 on October 23, 2026 (FFraud API).

A confirmed score holds when the address goes quiet, because attackers often rest their servers between campaigns, and only new evidence changes it. A separate recent_abuse flag says whether abuse was confirmed in the last 30 days (API reference).

What the open data shows

FFraud's open data lists 1,580,496 confirmed abusive addresses with their scores (build of October 23, 2026, 07:30 UTC). In that file, the kind of abuse sets most of the number. Each address carries its worst recorded category. Of the 649,082 addresses whose worst category is command and control, 96.0 percent score exactly 90. Of the 251,695 whose worst category is spam, 79.4 percent score 65. With brute force as the worst category, 89.0 percent of 77,801 addresses score 70.

#What do the numbers mean?

Each service draws its own bands. FFraud's API returns a risk label with every score, in the ranges below (live answers, October 23, 2026).

FFraud's docs suggest acting on the band: allow none and low, challenge medium and high with a CAPTCHA or a second step, and block critical. They also suggest blocking high when abuse was confirmed in the last 30 days (score bands).

Every address in the file scores 50 or more, because the file holds only confirmed attackers. Just over half of them, 792,148, score 90 or more. A score in the 60s or 70s still means confirmed abuse, mostly spam, brute force or general abuse reports.

#What does a real IP fraud score look like?

These are live answers from FFraud's API on October 23, 2026, at 07:59 UTC. The Tor exit is on the Tor Project's own exit list from that morning.

curl https://api.ffraud.com/public/ip/185.220.101.34

The first row carries a data center flag and still scores 5. A flag says what kind of connection an address is. The score weighs that together with what the address has done.

#Why is my IP fraud score high?

A high score on your own connection can come from other people. The score belongs to the address, and addresses are shared and reused.

• Carrier-grade NAT. A provider's carrier-grade NAT can put several homes or small firms behind one public address (RFC 6269). A block of addresses was set aside for these devices in 2012 (RFC 6598).
• A VPN or proxy exit. A proxy makes requests look as if they came from its own address (RFC 7239). You share that address with every other user of the server.
• A recycled cloud address. Cloud providers return released addresses to a shared pool for the next customer (AWS EC2 docs). The history comes with the address.
• An infected device. Malware can route other people's traffic through your connection. The FBI counted over 19 million compromised IP addresses in one such botnet, 911 S5.

The IETF warned in 2011 that blocking a shared address for abuse "will cause collateral damage" (RFC 6269). One user who fails logins can lock out others on their first try. FFraud puts a ceiling on shared mobile gateways for this reason.

#How do I check an IP fraud score?

Paste the address into an IP reputation check to see its score and the reasons behind it. For your own connection, what is my IP shows the address that websites see and its score.

To check a proxy, connect through it first and then open the same page, which shows the exit address that gets scored. In code, one request returns the score with its reasons:

curl https://api.ffraud.com/public/ip/185.220.101.34

#Why do two services give one IP different scores?

Each service sees different traffic and keeps its own scale. On October 23, 2026, the Tor exit 185.220.101.34 scored 100 at FFraud and 11, low risk, at Scamalytics. Its page said it had "no visibility into the web traffic directly from" that address (Scamalytics IP page, October 23, 2026).

Other scores look alike and measure something else. A payment risk score rates one payment. A bot score rates one web request. Some run the other way, so a low number means danger. Each range below comes from the vendor's own docs or checker page, read on October 23, 2026.

Some consumer checkers for "ip score" flip the scale too, and a higher number means a healthier address. Check which way a scale runs before you compare two numbers.

#Questions people ask

To see the score and its reasons for any address, run it through the free IP reputation check.