Why IP Reputation Scores Disagree — and How to Read Them

Why does the same IP score differently on different services?

Because they are built for different decisions. Threat-reputation services grade addresses for email and malware filtering. Fraud-scoring services grade them for real-time transaction decisions. Anonymity-focused services concentrate on proxy, VPN, hosting and Tor detection.

An address can legitimately come back clean on one and risky on another, and neither result is a bug. Before you act on a score, know which question that service was built to answer.

What actually goes into a fraud score

A single number usually blends at least four different classes of signal. They are not equally relevant to you, and they are not equally stable.

The first two describe the address. The fourth describes the visitor. When a product mixes them into one number and calls it an IP score, the number stops being about your IP.

Some scores aren't testing your IP at all

This is testable, and it has been tested. In one published comparison, changing only the browser timezone — leaving the IP untouched — moved a score from 100 to 90. Nothing about the address changed.

Several of these tools pull in open-port scans, WebRTC checks and browser fingerprint mismatches, then present the result as a verdict on the address. Reviewers have singled out services that separate IP-level facts from inference as the more honest design.

The practical rule: if a tool's number moves when you change your browser, it is scoring your session, not your address. That is useful information, but it is a different question.

Four blind spots every score shares

1. They lag. Reputation is slow to build and slow to clear, so a score trails both fresh abuse and recent clean-up.
2. They aggregate. Everyone behind one address is scored as one entity, so pooled egress inherits its worst user.
3. They describe the address, not the person. A score cannot tell a legitimate operator from a bad one at the same address.
4. They are asymmetrically evadable. A freshly rotated malicious address can score clean while a long-lived legitimate one carries an old mark.

How to read a score without being misled

1. Run a positive control first. Query a known datacenter address through the same tool in the same session. If the control also comes back clean, the field is not populated and your result means nothing.
2. Check the vendor's own thresholds rather than assuming. One major service treats above 75 as worth extra verification, above 85 as suspicious, and above 90 as strongly associated with abuse — and states plainly that a high score means elevated risk, not confirmed bad behaviour.
3. Compare at least two sources built for different purposes, and expect them to differ.
4. Weight allocation facts above the number. ASN, RDAP registration and network type are checkable and stable; a composite score is neither.
5. If you believe a score is wrong, look for the vendor's false-positive report route — the major services publish one, free to use.

How we use these scores ourselves

As diagnostics, not as commitments. We check scores when selecting and delivering addresses, and we will show you what we saw. We do not treat any third-party number as the definition of a good address, because it is opaque, it lags, and in some products it is partly measuring a browser.

What we will state as fact is what we can control and you can verify: which access network the address was allocated from, its ASN, its registration shape, that a statically configured address does not change across a reinstall, and that one customer uses it.

A provider that promises a specific third-party score indefinitely has handed a vendor it does not control the power to define its own obligations. We would rather promise the things that stay true.