What can't the score see?
The score reads public data, so some things are out of reach. Residential proxies that look like home lines can't be told apart without a paid feed. IPv6 is on far fewer lists than IPv4, so its score rests on fewer readings. The city is a vote of the databases and can be wrong for an address that recently moved. A pulse or an abuse report is a claim, not a verdict: one wrong report can lower a score. A clean result means the sources found nothing, not that every site will let you in.
How is the score calculated?
Every address starts at 100, and points come off for what the sources find: up to 20 for a data center network and up to 5 for a business network; 20 for a proxy flag, 15 for VPN and 75 for Tor; 10 for abuse reports; up to 35 for the average fraud score; and 6 for each mail blocklist, at most 24. Flags count by how many sources agree, and a flag only one source made counts half. An address on a mail blocklist is never graded A, and on two or more lists never better than C (UCEPROTECT counts half); too few sources with risk data also stops the grade at B. A Tor exit always gets F, whatever else the sources say.
The fraud score is how suspicious risk databases rate an IP, from 0 to 100. Higher means more suspicious.
Grades: A is 85 or more, B 70 or more, C 50 or more, D 30 or more, and F below 30. The list under the verdict shows where each point went.
Which sources are used?
Without any keys: ip-api.com, proxycheck.io, IPQuery, ipapi.is, IP2Location, IPinfo, RDAP (the regional IP address registries), ip.guide, Shodan InternetDB, the Tor Project's exit list, and Cloudflare (your own IP only). With free API keys, the site owner can add IPQualityScore, AbuseIPDB, Scamalytics and ipdata.
Each row links to that source's own page, so you can check its answer there.
What are native and broadcast IPs?
A native IP is used in the country where it's registered. A broadcast IP is registered in one country, usually by a hosting company, and used in another.
Why it matters: most location databases go by where the address really is, but some services go by where it's registered. On a broadcast IP, those services may think you're in the registration country. If you need a country's streaming or AI services, a native IP is the safer bet.
We compare the regional registry's record (RDAP) with where most databases place the address. When the record has no country (common for ARIN), we use the country of the network that owns the block.
Home or data center IP: why does it matter?
Sites see data center IPs as servers, VPNs and proxies, not people. Streaming services, ticket sellers, banks and sign-up forms block them or ask for more verification.
Home and mobile addresses look like ordinary users. Mobile addresses are also shared by many people at once (carrier-grade NAT), so sites rarely block them.
Why do the sources disagree?
Each has its own data. Some only know which networks belong to hosting companies; others run honeypots or collect fraud reports from their customers. One may already know a VPN server that another hasn't seen yet.
That's why we count how many sources agree instead of trusting any single one.
My score is low. What can I do?
If it's your home connection: an abuse report or blocklist entry often means a device on your network is infected or being used as a proxy. Clean it up, then ask the blocklist to remove your address (each one links to its lookup and removal page).
If it's a VPN or server: the score mostly reflects the network type, which you can't change. Switch to a provider that offers home broadband or less-used addresses.
Do you store anything?
To check an address, we send it to the sources listed above; a few of them are asked by your browser directly. Results are cached for six hours per address, so the free sources aren't asked again on every visit. Nothing else is kept.
To find your exit IPs, your browser contacts a few IP lookup services directly.
If you press "Run the test", Cloudflare reads your browser to decide whether you're human; this site only gets whether you passed.
"Live test: your connection" runs on this site's own server: your browser looks up a few random names and connects once to probe.1ms.dog. The server only sees which DNS resolver asked and the settings of the TCP handshake; it keeps them in memory for two minutes and writes nothing to disk.
The /24 portrait is read by this site's own server: the 256 reverse names of the /24 around the address you check, against a few public lists. No address in the /24 is contacted. Results are cached in the server's memory for 7 days, and who asked isn't recorded.
