Skip to content

What Is a High IP Fraud Score? Scamalytics Scores and Risk Bands

What the score means, how Scamalytics draws its four bands, and what to check before changing anything.

What a fraud score is and who defines "high"

An IP fraud score is a risk number from 0 to 100 that a checking service assigns to an address. The higher it is, the more that address is associated with fraudulent or abusive activity in the service's own data. It is not an industry standard: each service uses its own data, its own method and its own bands. That is why the same address can score differently in two tools, and why scores cannot be converted from one tool to another.

Scamalytics' product page is direct about its own score. It describes a fraud score from 0 to 100 with a low, medium, high or very high risk rating, and says a score of 0 indicates no known fraud risk. It also gives the score a plain meaning: at 70, approximately 7 out of 10 users seen from that IP address have been linked to fraudulent activity. That reading applies only to Scamalytics' own score.

How Scamalytics draws its four bands

The page lists the bands below, together with the action it suggests for each:

How Scamalytics draws its four bands

How Scamalytics draws its four bands
ItemScore rangeAction suggested on the page
Low risk0–19Allow access with no extra friction
Medium risk20–59Show a CAPTCHA or add verification checks
High risk60–89Require step-up authentication or SMS verification
Very high risk90–100Block the request or send it for manual review

Note: Data from the Scamalytics product page, read on 9 November 2026. The page says the thresholds are intended as a starting point and should be adjusted to your own fraud data; the right-hand column is advice to site operators, not a description of what any particular website does.

How Scamalytics draws its four bands

Two points are worth keeping in mind. First, the band edges are starting values, not fixed rules, so sites that use Scamalytics data can tune them, and there is no universal answer to what happens at exactly 60. Second, the right-hand column is written for the operator of a website. It shows roughly what a score means in a risk context; it is not a promise about what a visitor will experience.

How the score is built: neighbors count too

Scamalytics explains that its score is built from fraud feedback supplied by a network of operators, and that this intelligence is applied across the surrounding IP neighbourhood, including addresses within the same subnet, ASN and hosting block. As a result, IPs close to known malicious addresses can receive elevated risk scores before they have been reported individually.

That has a practical consequence for reading a score. A high number on one address does not always mean the problem is that address alone. It may belong to the whole stretch of network around it. This is why Step 2 includes a spot check of neighboring addresses.

Step 1: find your exit IP and look up the score

  1. Find the current exit IP

    On a direct connection it is the address your network provider gave you; through a proxy it is the address of the proxy end. Open any page that shows "your IP", or read the exit address shown in the client you use.

  2. Open the Scamalytics IP lookup

    and enter the address. The official page shows the fraud score and risk rating, along with proxy status, Tor status, the "true country" and the operator.

  3. Record each item separately

    score, risk band, proxy status, Tor status, true country and operator. Do not collapse them into a single "high risk" note.

  4. Note the limits Scamalytics states

    The page says it has no visibility into the entire internet, that its statements are its opinion based on limited information, and that coverage is limited to web connections from internet users to websites and applications, not other connections such as server-to-server traffic.

Step 1: find your exit IP and look up the score

For a broader checking method, see the IP purity check guide.

Step 2: read the score together with ASN, network type and native or broadcast

A number alone is not enough. Look at these four things together.

Step 2: read the score together with ASN, network type and native or broadcast

  1. Operator and ASN

    They tell you whose network the address belongs to: a consumer ISP, a cloud provider or a hosting company. The operator line on the lookup page is the entry point, and the IP type check explains the method.

  2. Network type

    Separate residential, ISP and datacenter first. The same high score usually has different causes on a datacenter address and on a home broadband address, and the next step differs too. The comparison of residential, ISP and datacenter proxies covers the three.

  3. Native or broadcast

    In common industry usage a "native IP" is one whose registration country matches the country where it is used, and a "broadcast IP" is one where they differ. This is an industry habit rather than an official field, but it affects how location is judged, so read it next to the score. Further reading: native vs broadcast IPs.

  4. Neighbors in the same range

    Since the score takes the same subnet and ASN into account, spot check two or three addresses in the same range. If the whole range is high, the history belongs to the range; if only yours is high, focus on that address's own record.

Common mistakes when reading a score

  1. Treating one lookup as final

    The same address can score differently on different days because the feedback behind it keeps updating. Note the date and keep using the same tool for comparisons.

  2. Reading the number without the band logic

    A 55 is "medium risk" on Scamalytics' scale, but that says only where it sits on that tool's scale; in another tool the same number has no comparable meaning.

  3. Ignoring the page's own limits

    The page describes its conclusions as opinion based on limited information, covering web connections. Using it to infer server-to-server traffic or the situation of a specific account goes beyond what it claims.

  4. Mistaking suggested actions for outcomes

    The right-hand column of the table is reference for site operators, who may adjust thresholds. The same score can lead to very different results on different sites.

  5. Changing several variables at once

    If you swap type, region and address together, you cannot tell which change mattered. Change one thing, record the result, then change the next.

Step 3: when the score is high, work in this order

  1. Finish the type and neighbor checks first,

    then decide whether to change anything. There are two outcomes, a high range or only your own address, and they call for different actions.

  2. If the whole range is high, change the type or the region

    move one step between datacenter, ISP and residential, or switch to another country or city that matches your target and test again. Proxy302, for example, offers rotating residential, static ISP and datacenter proxies; static ISP and datacenter IPs are rented per IP and stay fixed for the lease term. When you need the same address over time, start from static ISP proxies.

  3. If only your address is high, get a new address and test again

    Compare its proxy status, Tor status and operator. If the score changes clearly with the new address, the issue travelled with the old one.

  4. Retest and confirm location

    Retest with the same checker so the before and after are comparable, and confirm the exit location is what you expect; the guide to checking a proxy IP's location helps.

  5. Remember the boundary

    Changing the IP changes only the network address a service sees; outcomes for accounts or business activity are decided by each platform under its own rules. Treat "look up, check type and neighbors, change if needed, retest" as a loop, and a few rounds will show whether the cause is type, range or region.

How to do it with Proxy302

Proxy302 offers static ISP IPs that stay fixed for the lease term, so a score you check stays attached to the same address while you use it.

Look up the IP you receive the same way, then use the gateway proxy.proxy302.com with the protocol you generated: HTTP on port 2222 or SOCKS5 on port 3333.

How to do it with Proxy302: steps

  1. Step 1

    Open the product page that fits (static ISP, rotating residential or the ISP for AI subscriptions) and pick the region, traffic or lease term, and quantity. For per-IP products also choose HTTP or SOCKS5.

  2. Step 2

    After the proxy is generated, open My assets and copy HOST, PORT, USERNAME and PASSWORD.

  3. Step 3

    Open https://ipinfo.io/json through the proxy and check that the country and org fields (ASN and organization) are what you expected.

  4. Step 4

    Then compare network type and native or broadcast on the IP purity check page. Two tools disagreeing is normal; go by your actual use.

Prices and limits

Rotating residential starts at US$1.50 per GB on the Budget line and US$5 per GB on the Premium line; larger packages are cheaper per GB, and purchased traffic has no expiry. A static ISP IP is US$0.50 for one day or US$7.99 for 30 days, the same in every country, fixed for the lease. A datacenter IP is US$0.25 for one day or US$3.99 for 30 days. Stock changes daily, so go by the order page. The smallest purchase is 1 GB of traffic or one IP for one day. Changing IP does not lift a restriction or raise a limit; what happens to an account is up to the platform.

Proxy302 at a glance

Proxy302 at a glance
ItemPriceProtocolsLocations
Rotating residentialFrom US$1.50 per GB (Budget line); US$5 per GB (Premium line); lower per GB in larger packagesHTTP, SOCKS5195+ countries and regions; state and major city on lines that support it (small towns and some connections exit at country level; no city level in Russia and Singapore)
Static ISP, per IPUS$0.50 for 1 day, US$7.99 for 30 days, the same in every countryHTTP or SOCKS5, chosen per IP30 countries on the order form; stock changes daily
ISP for AI subscriptionsPer 30 days: Claude 15 PTC, GPT / Grok 10 PTC, Gemini 8 PTCHTTP or SOCKS5Claude: US, UK, DE, JP. GPT / Grok: US, UK, FR, JP, KR. Gemini: US, UK, FR, JP
Datacenter, per IPUS$0.25 for 1 day, US$3.99 for 30 daysHTTP or SOCKS5, chosen per IP8 countries

Prices are in PTC, paid from the wallet; 1 PTC = US$1. There is no free trial: the smallest purchase is 1 GB of rotating residential traffic or one IP for one day. Checked on 9 November 2026.

FAQ

What IP fraud score counts as high?

It depends on the tool. On Scamalytics' official product page, 60–89 is "high risk" and 90–100 is "very high risk", and the page says these thresholds are a starting point that users can adjust to their own data. Other tools have their own scales, so do not apply these numbers to them.

Can scores from different checkers be converted?

No. Each tool uses its own data and method and defines its own bands. When you compare, compare before and after results from the same tool.

Why is the IP of my home broadband score high?

The score is a tool's judgment about an address from the data it can see. Scamalytics says its score takes into account neighboring addresses in the same subnet and ASN, so an address can look high because of the history of its range. Spot check neighbors first, then look at the address's own proxy and Tor status.

Does a low score mean there is no problem?

Not necessarily. A score is an estimate, not a verdict. Scamalytics itself says its conclusions are opinion based on limited information and cover web connections only. Whether a particular service accepts a visit is decided by that service's own rules.

What should I do first with a score of 90 or more?

Do not change anything yet. Follow Step 3: confirm the type, spot check neighbors in the same range, change type or region if the whole range is high, or get a new address and retest if only yours is high. Keep using the same checker for the retest.

Reference links

3
  1. Scamalytics: products and risk bands

    Official documentation · Confirmed on:

    Read on 9 November 2026: the fraud score runs from 0 to 100 with four bands (0–19, 20–59, 60–89, 90–100); 70 means about 7 in 10 users seen from the IP were linked to fraud; thresholds are a starting point; the score is applied across the same subnet, ASN and hosting block.

  2. Scamalytics: IP lookup page

    Official documentation · Confirmed on:

    Read on 9 November 2026: the page shows fraud score, risk, proxy status, Tor status, true country and operator, and states its limits (no visibility into the whole internet, opinion on limited information, web connections only).

  3. Proxy302 product facts and price list

    Product observation · Confirmed on:

    Product facts file of the site, checked 9 November 2026 against the console, the backend and the price table: products, prices in US$ (1 PTC = US$1), lease terms, protocols and ports, countries, quantity limits, no free trial.

Ready to try it?

Create an account, top up once, then pick rotating residential, static ISP or datacenter IPs and have one running in your browser within minutes.

Get started