How is the score calculated?
Every address starts at 100. Points come off for what the sources find: up to 20 for a data-center network, 20 for proxy and 15 for VPN flags, 40 for Tor, 10 for abuse reports, up to 35 for the average fraud score, and 6 per mail blocklist (at most 24). Flags count by how many sources agree, so one source alone takes off only part of the points.
Grades: A 85+, B 70+, C 50+, D 30+, F below 30. The breakdown under the source table shows exactly where the points went.
Which sources are used?
Without any keys: ip-api.com, proxycheck.io, IPQuery, ipapi.is, IP2Location, IPinfo, RDAP (the regional registries), ip.guide, Shodan InternetDB, the Tor Project's exit list, and Cloudflare (your own address only). With free API keys the site owner can add IPQualityScore, AbuseIPDB, Scamalytics and ipdata. Each row links to that source's own page, so you can check its answer there.
What is a native IP, and a broadcast IP?
A native IP is used in the country where it's registered. A broadcast IP is registered in one country (in the registry's records, often by a hosting company) and announced from another. Most geolocation databases follow where the address really is, but some services go by the registration, so a broadcast IP can make you look like you're in another country.
We compare the regional registry's record (RDAP) with where most databases place the address. When the registry record has no country (common for ARIN), we use the country of the network that owns the block.
Residential or data center: why does it matter?
Sites see data-center addresses as servers, VPNs and proxies, not people. Streaming services, ticketing, banks and sign-up forms block them or ask for more verification. Residential and mobile addresses look like ordinary users. Mobile addresses are also shared by many people at once (CGNAT), so sites rarely block them.
Why do the sources disagree?
Each one has its own data: some only know which networks belong to hosting companies, others run honeypots or collect fraud reports from their customers. A VPN server may be known to one and not yet to another. That's why we count how many agree instead of trusting any single one.
My score is low. What can I do?
If it's your home connection: an abuse report or blocklist entry often means a device on your network was infected or used as a proxy. Clean it, then ask the blocklist to remove the address (each one links to its removal page). If it's a VPN or server, the score mostly reflects the network type and you can't change it. Pick a provider that offers residential or less-used addresses.
Is anything stored?
Results are cached for six hours per address so the free sources aren't asked again for every visit. Nothing else is kept, and the IPv4/IPv6 detection runs in your browser.