IP fraud score explained

The server IP risk score summarizes network and reputation signals for an IP. It does not include browser WebRTC, DNS or fingerprint observations, and latency is a separate measurement.

How to read the result

A higher risk score indicates more IP risk signals in this assessment. It cannot predict whether a third-party service will accept an account or payment. Unavailable data does not mean safe. Purity and risk fields must be read with their own labels, not combined with browser observations.

Steps

1. Run the IP query and read its reasons and source status.
2. Inspect browser observations separately on the privacy page.
3. Use latency only to assess the measured network path; change one factor and compare like-for-like results.

How the composite risk score is calculated

Multiply the AbuseIPDB abuse score by 0.72 and take the greater of that value and the network baseline: Tor 72, VPN/proxy 58, or datacenter 42. If several types match, use only the first in that order. Then add 1 point per report, capped at 18 points. Round and limit the result to 0–100. Browser observations and latency do not contribute.

0–29 is low, 30–59 medium, 60–79 high and 80–100 critical. The composite score represents signals under the current rules, not a probability of malicious activity.

FAQ

Can a browser leak change this score?

No. Browser observations and latency are separate from the server IP score. A browser issue can require attention without changing the IP score.

Related diagnostics

Modern home, IP risk, privacy and latency pages start a shared session automatically, including external DNS and STUN connections. Direct entry to tools, method or policy pages does not start a session; an existing session may continue. Old language homepages show an IP profile and use separate buttons for extra browser checks. Guides are explanations, not test results.