A Closer Look at How IPQS IP Scores Work

What an IP score means

Our IPQS IP score gives customers a quick way to assess connection quality before processing signups, logins, or reviewing payments. We define an IP fraud score as a 0-100 rating that indicates whether an IP address is associated with abusive or malicious activity, such as bots, proxies, VPNs, credential stuffing, or payment fraud. Each IP score turns traffic intelligence into a single practical result while keeping supporting fields available for deeper review.

How IP reputation shapes an IP fraud score

Our scoring draws on both network history and recent behavior. We look at the history associated with an IP address, then compare it with activity. Our IP reputation data also considers the surrounding network context, including whether the source is from a hosting provider, a residential connection, or a mobile network. That background helps our IP fraud score reflect more than a single isolated event and helps each IP score show both recent and longer-term patterns.

Why every IP address matters

Every IP address gives us one of the earliest data points during registration, login, and checkout. Our lookup data can return geolocation, ISP, hostname, ASN, time zone, connection type, and bot detection details. We also check whether an IP address may be a proxy, VPN, or Tor connection, because masked traffic can raise concerns depending on the use case. Reviewing an IP address early gives our models more context and strengthens the final IP score.

What goes into an IP risk score

Our scoring can evaluate the IP address, user agent, language, and other optional inputs. We combine IP reputation, behavioral patterns, anonymizer use, abuse history, and geolocation integrity to form the result. We also return an IP risk score that places less weight on reputation history than the overall fraud score. That separate IP risk score helps customers compare short-term session behavior with broader history and supports IP score review.

IP fraud detection and risk signals

Our scoring is backed by billions of events and a global network of honeypots and deception traps in more than 150 countries. These systems monitor for fake accounts, automated attacks, the use of stolen credentials, brute-force attempts, spam, and phishing. The response data can also include recent abuse, abuse velocity, bot status, frequent abuser history, and connection type. Those details show why a particular IP address may receive a higher score.

Reading an IP score in practice

We classify scores of 75 and above as suspicious, scores of 85 and above as indicating suspicious behavior, and scores of 90 and above as indicating abusive or malicious behavior. Customers should read an IP score as a summary rather than the only decision point. The returned fields provide a fuller picture of the IP address and the session behind it. When reviewed alongside the details, an IP fraud score helps teams understand traffic quality and act with more confidence.

Final takeaways on IP score

Our IP score is designed to give customers a clear, fast way to judge traffic quality while still providing the supporting details behind the result. By combining IP reputation, abuse history, connection characteristics, anonymizer detection, and other risk signals, our IP fraud score helps turn complex network intelligence into a practical decisioning tool. When reviewed alongside the returned data points, an IP risk score can help teams better understand suspicious activity, reduce false positives, and apply the right level of scrutiny to each IP address.