If you have ever looked up an IP address and been told it carries a “fraud score”, there is a good chance the number came from Scamalytics. It is an IP fraud intelligence service that helps businesses judge whether internet traffic from a given address looks risky — and its free per-IP lookup pages have made it one of the most-quoted reputation sources on the web.
The idea is straightforward: every IP address leaves a trail, and addresses associated with proxies, VPNs, Tor exit nodes or past fraud deserve extra scrutiny. But a fraud score is an opinion based on limited data, not a verdict. This guide explains what Scamalytics does, how its score works, and how to read the results sensibly.
BLUF: Scamalytics is an IP fraud intelligence platform by Scamalytics Ltd that assigns IP addresses a fraud score from 0 to 100, based on observed traffic, proxy and VPN detection, and fraud reported by its network of operators. A high score means a high share of traffic seen from that address looked fraudulent — it does not prove the current user is a fraudster. The company itself stresses its visibility covers only part of the internet.
At a Glance
- What it is: An IP fraud detection and intelligence platform operated by Scamalytics Ltd.
- Core output: A fraud score from 0 to 100 for individual IP addresses.
- Signals used: Proxy and VPN detection, Tor exit nodes, ISP and organisation data, geolocation, and fraud reports from a network of operators.
- How scores are read: A score of 70 means roughly 7 in 10 users seen from that IP were linked to fraudulent activity, in Scamalytics’ view; 0 means no known risk.
- Access: Free per-IP lookup pages (for example, scamalytics.com/ip/ followed by an address) plus a commercial IP Fraud Risk API.
- Key caveat: The company’s own pages state it has visibility into “many millions” of users per month but not the whole internet, and its statements are opinions based on limited information.
What a Scamalytics Fraud Score Means
The fraud score is the headline number. It runs from 0 (lowest risk) to 100 (highest risk) and is presented alongside a simple risk label — low, medium or high. According to Scamalytics, the score reflects the proportion of traffic observed from that address that has been linked to fraudulent activity: a score of 70 suggests that roughly 70 per cent of users seen from that IP, within the traffic Scamalytics can observe, were associated with fraud.
The result pages also break down what the company can see about the address: the ISP, the organisation managing it, the country, and whether any of its addresses host what Scamalytics calls “high risk services” — anonymising VPNs, Tor exit nodes, servers, public proxies and web proxies. For ISP-level pages, you can see what share of that provider’s addresses fall into each category, which is useful for spotting networks that cater to anonymised traffic.
Crucially, a high number is not an accusation. Shared IP addresses — corporate networks, mobile carriers, VPN exit points — are used by thousands of people, and one bad actor can lift the score for everyone on the address. Independent tests of free IP reputation APIs have shown that different providers frequently disagree on the same address, which is a useful reminder that every score is a model with blind spots, not ground truth.
How the Score Is Built
Scamalytics says its score is built on feedback from a global network of operators that report confirmed fraudulent activity. When fraud is confirmed from one address, that intelligence can be extended to nearby addresses within the same subnet, ASN or hosting block — the reasoning being that abusive infrastructure tends to cluster.
The company supplements this with its own observations across the web traffic it can see, plus third-party data: its pages credit DB-IP for IP geolocation data and IP2Proxy for proxy detection data. The combination produces the per-IP and per-ISP pages that anyone can browse without signing up, alongside the paid API for businesses that want to check traffic automatically at scale.
The limitation is stated plainly on every results page: Scamalytics sees “many millions” of internet users per month, but it does not see the entire internet. Its statements cover only web connections made by users to websites and applications — not server-to-server traffic — and represent the company’s opinion based on the information available to it.
How Businesses Use Fraud Scores
The typical customer is a business that takes signups, payments or logins online and wants a cheap first filter for suspicious traffic. An e-commerce store might check the fraud score at checkout; a forum might flag registrations from high-risk addresses for manual review; a streaming service might look for VPN and proxy signals when enforcing regional licensing.
The paid IP Fraud Risk API returns the score and related signals in a machine-readable format so these checks can run automatically. The free lookup pages serve a second audience: curious individuals checking their own address, security researchers comparing providers, and journalists writing about IP reputation.
Used well, the tool is one input among several — combined with device data, behavioural signals and human review. Used badly, as a sole basis for banning users, it will produce false positives, because legitimate users routinely appear on high-scoring addresses through no fault of their own.
People Also Ask
What is a good Scamalytics fraud score?
Lower is better. A score of 0 means Scamalytics sees no known fraud risk from that address, and scores in the low single digits are generally considered low risk. Scores climbing toward 50 indicate a medium risk, while scores of 70 and above suggest that a large share of observed traffic from the address has been linked to fraud — but the company’s own guidance stresses this is a risk indicator, not proof of wrongdoing.
Is Scamalytics free to use?
The per-IP lookup pages on the Scamalytics website can be viewed without signing up or paying — you enter an IP address and see its fraud score, risk classification and network details. Businesses that want to check addresses automatically at scale use the commercial IP Fraud Risk API, which is a paid product.
Why does my IP address have a high fraud score?
Common reasons include sharing an address with other users (mobile networks, offices and VPNs put many people on one IP), the address previously being used for abusive activity, or the address belonging to a hosting provider or proxy service associated with anonymised traffic. If your own connection shows a high score, restarting your router to get a new address or asking your ISP about it are reasonable first steps.
How accurate is Scamalytics?
It is best treated as one signal rather than a definitive answer. Scamalytics states that its visibility covers only part of the internet and that its pages represent opinions based on limited information. Independent comparisons have found that free IP reputation services often disagree with each other on the same addresses, so a Scamalytics score should be weighed alongside other evidence rather than trusted in isolation.
