Proxy Fraud Score Explained: How IP Reputation Is Calculated

A fraud score is a number, conventionally between 0 and 100, that a third-party reputation vendor assigns to an IP address as an estimate of how likely traffic from it is to be abusive. Lower is better. It is a prediction produced by a private model, about an address, before anyone has seen what you intend to do with it.

Sites buy these feeds and wire them into signup forms, checkout flows, login endpoints and comment boxes. That makes the score of your exit address a gate you pass through before your own request is evaluated on its merits, and it makes the distribution of scores across a pool worth measuring. It sits in our live benchmark next to success rate and latency for that reason.

What a fraud score actually is

There is no standard. Vendors ship the same idea under names like fraud score, risk score, abuse confidence and threat level, and each one is the output of a proprietary model over a proprietary dataset. The scale is ordinal rather than physical: a 40 is worse than a 20, but nothing tells you it is twice as bad.

The thresholds belong to the buyer, not the vendor. One site might serve a challenge above 60 and refuse service above 85. Another blocks everything above 40 because it sells something heavily targeted by carding. So an address is never clean or dirty in the abstract. It is above or below whichever line the target you care about happened to draw. We treat 10 or below as the target band in our own scoring, which is a deliberately conservative choice documented in our methodology.

The signals that feed a score

Vendors publish very little about weighting, but the input categories are well understood because they are the only things observable about an address from the outside.

Two of those you can influence. Open ports are a property of the exit device, and a badly maintained pool full of compromised routers scores poorly for exactly the reason it should. Geolocation inconsistency is often self-inflicted: request a city that the exit cannot plausibly be in and you create the inconsistency yourself. The precedence rules that cause this are in the proxy geotargeting guide.

Why two vendors disagree about the same address

Take one residential exit and check it against three services and you will often get three materially different numbers. That is expected behaviour, not a bug in any of them.

• Different training data. A vendor whose customers are payment processors sees carding. A vendor whose customers are ticketing sites sees scalping bots. Each model learns the abuse its customers experience.
• Different recency windows. One vendor decays abuse history over about a month, another carries it for a year. The same incident makes an address look fine to one and toxic to the other.
• Different weight on proxy detection. Some models treat membership of any commercial proxy pool as strongly negative on its own. Score a residential exit with one of those and it lands mid-range no matter how well behaved the household is.
• Different scan cadence. Open-port and service data goes stale. A vendor that rescanned yesterday and one that rescanned in March are describing two different machines.

The practical consequence is that a screenshot from a free lookup page is one vendor's opinion about one address on one day, and it is not evidence about a pool. Pick a single vendor, sample many exits through one code path, and compare distributions between providers. That is the only comparison that holds up.

How a shared residential address inherits a household

Residential exits are real subscriber addresses, which is the whole point of the product and also the source of the problem. Whatever that connection did last week is attached to it this week: torrent traffic, a compromised laptop on the LAN, a family member running a mail script, or a previous holder of the same DHCP lease. None of it has anything to do with you, and all of it is in the score.

Carrier-grade NAT widens the inheritance. Where many subscribers share one public address, you inherit a neighbourhood rather than a household, and mobile pools are the extreme case: thousands of users behind a single address, which cuts both ways because sites cannot ban it without collateral damage.

You also inherit the other tenants of the proxy pool. The same exit is rented to other customers, sometimes concurrently, and their traffic accrues to the address. This is the largest single reason pool-level reputation drifts over weeks with no change on the provider side, and it is why a pool that was excellent during your trial can be ordinary by the time your contract starts. Pool depth in your target country decides how fast that pressure spreads.

Fraud score and clean rate measure different things

These two metrics get used interchangeably and they are not the same shape of number. One describes an address, the other describes a pool.

A pool can post a good median fraud score and still have a poor clean rate, if a long tail of its exits is heavily flagged. A rotating job meets that tail constantly and a sticky job may never see it. Decide which metric matters by how you rotate, not by which number looks better; rotating vs sticky proxy sessions sets out that choice, and the highest clean rate rankings show how far apart pools land.

What the score predicts

A low fraud score predicts how a reputation-driven gate will treat your address: whether a signup form accepts you, whether a checkout adds a verification step, whether a login triggers an email confirmation, whether a comment lands in review. On targets that buy the same vendor feed you are scoring against, it correlates with block rate well enough to act on.

What it does not predict

• Success rate against behavioural detection. Plenty of exits scoring 0 fail instantly because the client leaked automation through its TLS fingerprint, header order or timing. IP reputation is one input among many, and on sophisticated targets it is not the deciding one. See proxy success rate explained.
• Latency or throughput. A pristine address on a congested rural uplink is still slow. Reputation and speed are unrelated measurements and have to be sampled separately.
• Ethical sourcing. A score says nothing about whether the household consented to relay your traffic.
• Tomorrow. Scores move daily. A number you recorded last month is history, not a property of the pool.

Lowering the score you actually get

You cannot improve an address's reputation. You can change which addresses you end up on, and that is where the gains are.

• Narrow the geography. Aggregate reputation varies enormously by country and by ASN, and city-level targeting changes which subnets you draw from. Loosening a country filter to chase throughput usually costs you reputation.
• Prefer static ISP addresses for identity-bound work. They are announced from provider hardware, carry no household history, and their score is stable enough to be worth checking once. ISP proxies explained covers the trade-offs.
• Score before you spend. Where the provider exposes the exit address, check it against your own threshold before doing anything expensive, and rotate away from anything above it. A discarded session is cheaper than a failed checkout.
• Retire session keys after a block rather than reusing them, because the same key often maps you back into the same slice of the pool.
• Never touch free proxy lists. Those addresses are scored as hostile by default, and correctly so. Free proxy lists risks explains what else is wrong with them.
• Keep your own infrastructure closed. An exposed proxy port on your server earns your own address a poor score, which matters the moment you make a request without the proxy.

We sample fraud score and clean rate across every pool we track, continuously and from both US and EU infrastructure, so the figures reflect current supply rather than a single afternoon. The history is downloadable from the performance graphs, and the sourcing model recorded for each network is on its profile, for example Infatica, which is a useful clue to how much household history you are inheriting. If you are weighing reputation against price and speed, how to choose a proxy provider puts the metrics in order.