An IP fraud score summarizes risk associated with an address under a particular provider's model. It does not identify the person behind the request, prove a transaction is fraudulent or carry the same meaning across vendors. Before setting a threshold, establish the score's scale, inputs, age and the action it is meant to support.
This page explains how to interpret an IP-level number alongside VPN detection. For a comparison of products, use the VPN detection tools table; for integration steps, read the proxy detection API guide.
First ask what is being scored
The label “risk score” can refer to an IP, a browser visit, a device, an account or a transaction. The denominators and evidence differ. In MaxMind's minFraud API documentation, the overall risk_score and the IP address's risk are distinct response fields. The documentation describes its own ranges and product editions; those ranges are not a universal industry scale.
ShieldLabs' risk-scoring page describes a 0–100 score for each identification with named detections and a Trusted, Suspicious or Dangerous assessment. The associated visitor, user, device and IP context belongs to that identification workflow. Do not assume that “70” from this system equals “70” from an IP-only feed or a transaction model.
| Result | Unit being assessed | Useful question | It cannot establish alone |
|---|---|---|---|
| IP reputation or IP risk | An address at a given observation time | Is this network associated with risk signals? | Which person used it |
| VPN or proxy label | The observed connection | Does the request appear to use a masking service? | Whether the account violates policy |
| Identification risk | A visit with available network and device context | Which signals appeared in this visit? | The outcome of every future visit |
| Transaction fraud score | A transaction and its submitted context | Should this event be reviewed? | A universal IP threshold |
Inspect reasons and freshness before thresholds
Record the raw score, category labels, reason fields, timestamp and address. A high score may reflect a recently observed proxy, an earlier reputation event or a combination of network indicators. The response documentation is the authority on what a particular provider actually includes. MaxMind exposes IP risk reasons in some editions and separate anonymity fields in its richer minFraud responses; coverage depends on the edition.
Check the age of the data. An exit can change owner or use; a shared carrier address may represent many unrelated customers. Re-evaluate a sample after an address changes and retain the result as it was returned at decision time. Our residential proxy detection pilot shows how to test rotation without calling every residential address suspicious.
Connect the score to an accountable decision
A threshold should be attached to a specific workflow and a cost of error. For example, a registration with repeated benefit claims can justify review at a different point than a routine page view. Record how many independently labeled abusive cases were caught and how many legitimate customers were challenged. Segment corporate VPN, Apple Private Relay and shared mobile networks so a high-risk bucket is not merely a privacy-network bucket.
Do not compare “accuracy” claims unless the vendors use the same labeled population, observation period and outcome definition. In the false-positive guide, we separate network classification errors from bad application decisions. The methodology explains the site's editorial scoring; the vendor scores there are not laboratory accuracy rates.
When to add device and account context
IP data is valuable for a current connection, but customers can share addresses and one visitor can change them. Device and visitor identity may help link repeated activity across a changed exit. Account history can then distinguish a risky pattern from a legitimate privacy choice. This is why the device intelligence article tests continuity and incorrect links separately.
For a practical shortlist, inspect an IP-focused service and a combined network/device product against the same cases. ShieldLabs' review covers its combined output; MaxMind's review covers an IP-oriented option. Compare the result shape, coverage and billing unit before comparing their numerical scores.
FAQ
Is an IP fraud score the probability that this user is fraudulent?
No universal interpretation exists. Some providers define a probability for their own transaction score, while an IP risk field describes an address. Read the specific field definition and validation method before treating a number as a probability for your customer.
What is a good IP fraud score threshold?
There is no portable cutoff across products. Choose a candidate threshold with labeled events from your own workflow, then measure misses and legitimate-user friction. Recheck it when traffic mix or vendor data changes.
Does a VPN automatically mean a high IP fraud score?
No. A VPN classification and a risk assessment are different outputs. Corporate VPNs and privacy relays are legitimate in many workflows; account and device evidence can change the interpretation.
Can an IP score identify repeat accounts after the IP changes?
An IP-only number cannot preserve identity across every exit change. A product that also returns visitor, device and account links can provide continuity; test that behavior and its incorrect-link rate in your environment.
Sources
Sources reviewed October 21, 2026.