IP fraud score check
iplogs.com does not compute a fraud score. It gives a 0–100 risk score for VPN, proxy, Tor or hosting evidence, plus a separate abuse reputation (allowlist, greylist or blocklist). Together they answer the question most IP fraud scores are used for: is this address hiding who is behind it, and has it been seen attacking anyone?
What the risk score means
| Score | Verdict | Suggested action |
|---|---|---|
| 0–29 | Clean | Allow. |
| 30–59 | Suspicious | Allow; add friction only on sensitive actions. |
| 60–84 | Likely VPN | Challenge: verify an email or phone, or require a login. Privacy relays: prefer a light challenge. |
| 85–100 | VPN detected | Challenge or block, per your policy on VPNs and Tor. |
The reputation is separate: allowlist means no abuse reports and nothing hidden, greylist no abuse but a hidden or hosted address, blocklist recent attacks or abuse. A VPN can be greylisted and clean of abuse at the same time.
Check an IP's risk score
Paste an IPv4 or IPv6 address to see its score, reputation and the evidence behind both.
Many addresses: the bulk check. In code: the free API, no key.
Questions
What is a good IP fraud score?
On iplogs.com, a risk score under 30 is clean: nothing points to a VPN, proxy, Tor exit or hosting network. 30 to 59 is suspicious, 60 to 84 is likely a VPN or proxy, and 85 or more means one was detected. A low score with a clean reputation is what an ordinary home or mobile connection looks like.
Does a high score mean the user is a fraudster?
No. It means the address hides who is behind it or sits in a hosting network, which plenty of honest people use (VPNs for privacy, iCloud Private Relay, office gateways). Treat it as a reason for a second check, such as an email or phone confirmation, not as proof.
How is this different from other vendors' fraud scores?
Fraud-prevention vendors blend IP risk with signals we don't see, such as account age, device and payment history, into one proprietary number. iplogs.com scores only what the IP address shows and lists the evidence behind it, so the same number can't be compared across vendors.
Why is the score 0–100 here but 0–1 in the API?
It is the same number. The API returns score as a fraction from 0 to 1; the website multiplies it by 100. A score of 0.85 in the API is 85 on the site.