IP reputation score: what it measures and how to read it

An IP reputation score is one vendor’s risk rating for one address, built from blocklist listings, abuse reports, the network the address belongs to and how traffic from it has behaved. Every vendor uses its own scale: some count up toward “risky”, some toward “human”, and email systems answer in words. A score only means something next to its scale.

The question usually arrives after something broke. A login asks for a second factor it never asked for before, a page returns a challenge instead of content, or a checker site paints an exit IP red. The reflex is to look up one number and trust it. That number is one vendor’s opinion, measured for one job, often email.

What an IP reputation score measures

Two layers, one number. Every IP reputation score blends what the network is with what the address has done. The network layer covers the autonomous system (ASN) that announces the range, the kind of connection behind it and whether the range belongs to a known VPN, proxy, Tor or hosting operator. The history layer covers spam traps hit, abuse reports filed and challenges failed by that exact address.

No universal score. Spamhaus, Cisco Talos, MaxMind, IPQS, AbuseIPDB and Cloudflare each keep their own data and their own scale. The same address can be “Neutral” for email at Talos, carry a fraud score in the 70s at one vendor and pass a bot check on a site behind Cloudflare, all on the same afternoon.

The site decides. The site receiving your request picks the vendor, the threshold and the action: allow, challenge, rate limit or block. Two sites using the same vendor can treat the same score differently.

Signals behind the score

Blocklists. DNS-based blocklists (DNSBLs) publish listed addresses as DNS records anyone can query. Spamhaus ZEN, for example, combines four lists in one zone: the SBL for spam sources and spam operations, the XBL for hosts infected with malware or exploited, the PBL for end-user ranges that should not send mail directly, and the CSS for low-reputation senders found automatically (Spamhaus ZEN, checked October 2026). A PBL entry is a policy statement about the range, not an accusation against the address.

Abuse reports. AbuseIPDB turns reports from its users into an “abuse confidence” from 0 to 100, weighted by how many distinct reporters filed and how recently, and describes the value as deliberately conservative (AbuseIPDB FAQ, checked October 2026). A handful of old reports from one reporter barely moves it.

Network type. IP intelligence databases label the network behind each range. MaxMind’s connection-type database (checked October 2026) returns Cable/DSL, Cellular, Corporate or Satellite. Hosting ranges carry their own flag. Many fraud and bot systems weight this label more than any single address’s history.

Anonymizer flags. MaxMind’s Anonymous IP database documentation (checked October 2026) lists six flags: is_anonymous, is_anonymous_vpn, is_hosting_provider, is_public_proxy, is_tor_exit_node and is_residential_proxy. The last one marks residential ISP addresses on a suspected anonymizing network.

Behaviour. Bot management products score the request as well as the address. Cloudflare’s bot score documentation (updated August 2026) names heuristics, machine learning and JavaScript detections among the engines behind its score. The IP is one input among several, and what the client does after connecting can outweigh it. Our guide to how websites detect proxies walks through each layer in order.

Neighbours. Reputation leaks across a range. A /24 full of listed addresses or an ASN known for abuse drags down a clean address inside it, which is why a fresh IP can start with a poor score.

Who scores IP reputation

Most confusion comes from comparing numbers built for different jobs. Email filters ask “will this sender spam my users”. Fraud scoring asks “is this checkout or signup risky”. Bot management asks “is a script making this request”. Each publishes a different scale.

Scorer	Built for	Scale	Which end is bad
Cisco Talos	Email and web filtering	Good, Neutral, Poor	Poor
Microsoft SNDS	Mail into Outlook.com	Green, yellow, red	Red
Validity Sender Score	Email sending	0-100	Low (100 is best)
IPQS fraud score	Fraud and signups	0-100	High (75 suspicious, 90 high risk)
MaxMind minFraud IP risk	Fraud on transactions	0.01-99, a percentage	High
AbuseIPDB	Abuse reports	0-100 confidence	High
Cloudflare bot score	Bot management	1-99	Low (1 is automated)
Akamai bot score	Bot management	0-100	High (100 is a bot)

Where each scale is defined, all checked October 2026:

• Talos sender reputation levels describe Neutral as within acceptable parameters.
• Sender Score rates sending IPs against each other on a rolling 30-day sample, so a high number is good there and bad at IPQS.
• The IPQS proxy detection API documentation calls 75 and above suspicious but not necessarily fraudulent, 90 and above high risk, and recommends flagging or blocking at 90 and above.
• MaxMind’s minFraud IP risk score is a percentage: 15.40 means a 15.4% chance of fraud from the IP alone.
• Akamai’s Bot Manager documentation puts humans at 0 and bots at 100.

Gmail no longer shows senders a number at all. Google retired the IP and domain reputation dashboards in Postmaster Tools on September 30, 2025, and the v2 interface reports spam rate and compliance instead (Postmastery, 2025).

Reading the scales

What a good score looks like

On a 0-100 risk scale such as IPQS or AbuseIPDB, lower is better, and the vendor’s own threshold is the line that counts: under 75 at IPQS is outside its “suspicious” band, and an AbuseIPDB confidence of 0 means no recent reports. MaxMind’s IP risk score is a percentage chance of fraud from the IP alone, so 0.5 means half a percent. On Cloudflare the logic flips: 30 to 99 reads as likely human and 1 to 29 as likely automated. For Talos, “Neutral” is a normal result: Talos describes it as within acceptable parameters, with mail that may still be filtered.

Why two checkers disagree

A checker site that shows a single red or green verdict is mixing these layers. One vendor flags the ASN, another has no reports, a third has seen the address on a residential proxy feed. The numbers disagree because they answer different questions with different data. Write down which vendor said what before acting on any of them.

Reputation by proxy type

A proxy exit carries both layers. Which layer dominates depends on the category, and so does the job it fits; the types of proxies overview compares the categories on everything else.

Category	What the network layer says	How per-IP history behaves	Fits
Datacenter proxies	Hosting ASN, flagged as hosting on sight	Stable address, history accumulates	Targets that accept hosting networks, volume work
Static ISP proxies	ISP-registered range	One address for the term, its history is built by its traffic	Logins and sessions that need one consistent address
Rotating residential proxies	Home ISP network	Each request or session meets a different address	Broad consumer-origin coverage across many pages
Mobile proxies	Carrier network, cellular connection type	Shared by many subscribers behind CGNAT	Platforms and apps that expect a mobile origin

Datacenter. The hosting label decides most outcomes here. A strict target reads the ASN and stops; a lenient one never looks past it. Per-address history matters on top of that, so a range with past abuse starts behind. On targets that accept hosting networks, a datacenter IP with a quiet history is a fast, predictable exit.

Static ISP. The address is registered to an ISP and stays assigned to the order for the whole term. That makes its reputation something you can measure on day one and watch afterwards, and the traffic you send through it shapes what it becomes. This is the category for ASN reputation plus a stable history, which is what account logins and long sessions reward.

Rotating residential. Per-IP history counts for less, because the address changes. IPinfo’s analysis of 170 million residential proxy IPs over 90 days (January 2026) found an average visibility of 4.56 days per address, which is why sites lean on the network type and on behaviour rather than an address’s long history. Our explainer on what a residential proxy is covers how the category works.

Mobile. Carriers place many subscribers behind one public IPv4 address with carrier-grade NAT. proxymint’s mobile exits run on carrier networks. Sites know a block on a carrier address hits real customers, so they tend to slow it down rather than ban it.

How to check an IP reputation score

Check the address the target sees, which is the exit, from the exit. Looking up the IP your provider dashboard prints is not the same thing when rotation is on. Replace USERNAME, PASSWORD, HOST and PORT with your own proxy details; 203.0.113.10 below is a documentation address from RFC 5737.

# 1. The exit IP and network the target sees
curl -s -x http://USERNAME:PASSWORD@HOST:PORT https://ipinfo.io/json

# 2. ASN, prefix and registry for that IP (Team Cymru)
whois -h whois.cymru.com " -v 203.0.113.10"

# 3. Spamhaus ZEN: reverse the octets and query the zone
dig +short 10.113.0.203.zen.spamhaus.org

The first call shows the exit and its network, the same way the proxymint Lab gateway test reads it. The second gives the ASN from Team Cymru’s IP to ASN mapping service (checked October 2026). An empty answer to the third means not listed. An answer of 127.255.255.254 is not a listing: Spamhaus returns that code when the query comes through a public or open resolver, and it carries no reputation data (Spamhaus, return codes, checked October 2026). Run it from a resolver you control or through Spamhaus’s free Data Query Service.

Then look the address up on AbuseIPDB and on one fraud vendor, and note the date next to each result. On a static address, repeat after a week of real traffic. On a rotating exit, sample 20 to 30 addresses and read the spread, because one address says almost nothing about the next one.

Why scores get it wrong

Shared addresses. Cloudflare’s CGNAT study (October 29, 2025) found CGNAT addresses were rate limited three times as often as other addresses, while the median bot rate behind them was nearly identical (4.8% against 4.7%). One subscriber’s behaviour lands on everyone sharing the address.

Churn. Residential addresses move between users faster than many lists refresh. A report filed against an address last month may describe someone else’s traffic.

Missing data. A Talos “Neutral” or an AbuseIPDB 0 can mean the address is new to that dataset, so an empty record proves less than a long clean one.

Range-level penalties. A listing for a whole range or a policy entry such as the PBL hits every address inside it, including ones that never sent anything.

How to improve a poor IP reputation score

On an address you control, fix the cause before asking anyone to delist it. Each blocklist publishes its own removal rule; some entries expire once the activity stops, and others stay until the operator files a request. Find which list or vendor flagged the address, read its reason, clean up the host or the traffic, then request removal where the list allows it. A mail server also needs SPF, DKIM and DMARC in place, because mailbox providers check authentication alongside the address.

Through a proxy, the fix depends on the layer that caused the flag:

• History on one address. On a static ISP address, lower the request rate, keep sessions consistent and send only the traffic the target permits; the reputation follows the traffic.
• The network label. If a target rejects hosting ASNs, no amount of good behaviour on a datacenter IP changes the label. Match the category to the target instead.
• Behaviour on the target. A bot score falls when the client fails JavaScript checks or reuses a broken fingerprint. That lives in your client, and changing the IP does not fix it.
• A rotating exit with a poor reading. Read the spread across a sample before drawing a conclusion, and use sticky sessions where the target expects one visitor to stay on one address.

If the target shows a “proxy detected” message rather than a score, the proxy detected error guide triages it check by check. None of this overrides a target’s rules. A site that has blocked a job on purpose has answered the question, and a cleaner IP is not a reason to keep going.

Which score to watch for your job

If the job is sending mail, watch blocklists, Talos and SNDS, and ignore web fraud scores. If it is signing in to accounts you own, watch fraud scores and anonymizer flags on one stable address, which points to static ISP. If it is collecting public pages across many addresses, the per-IP number matters less than the network type and your client’s behaviour, which points to rotating residential, or to datacenter where the target accepts hosting networks. If the target is built for phones, the cellular label is the signal that counts, and mobile is the category that carries it.