IPQS Fraud Score Explained
IPQualityScore, usually shortened to IPQS, returns a fraud score from 0 to 100 for an IP address, along with yes or no flags such as proxy, VPN and recent abuse. Websites buy this data to decide whether to trust, challenge or block a visitor. The number you see on IPQS’s public lookup is not necessarily the number a website sees, because each customer chooses its own settings. This guide reads IPQS’s own documentation to explain the score, the flags and why carrier addresses vary.
Short answer
- IPQS treats 75 and above as suspicious but not necessarily fraudulent, and suggests flagging or blocking from 90, adjustable by each customer.
- The flags explain the number. recent_abuse, bot_status and frequent_abuser describe history; proxy and vpn describe the connection type.
- IPQS lists mobile networks among shared connections, where several users are active on one address. Carrier addresses inherit that mix.
- The public lookup uses IPQS’s least strict settings. A site with stricter settings can see a higher score for the same address.
The score and the flags, from IPQS’s documentation
| Field | IPQS meaning | How to read it |
|---|---|---|
| fraud_score | Overall risk from IP, user agent, language and other inputs | A summary; read the flags behind it |
| proxy, vpn, tor | Suspected proxy, VPN or Tor connection | Describes the connection, not intent |
| active_vpn, active_tor | Active commercial VPN or Tor exit | Stronger than the general flags |
| recent_abuse | Verified abuse from this IP within the past few days | History of the address, possibly not yours |
| bot_status | Bots or non-human traffic used the IP recently | Strengthens suspicion |
| abuse_velocity | How often the IP is abusive: high, medium, low or none | Trend over the recent period |
| connection_type | Residential, Corporate, Education, Mobile or Data Center | Context for the other flags |
| shared_connection | Likely several users on the address at once, such as mobile networks | Explains mixed history |
| frequent_abuser | Consistent abuse over six months or more | Long-term reputation |
IPQS’s response parameters define the fraud score as a summary built from the IP address together with the browser user agent, its language and any extra values a customer sends. The same page describes three bands. From 75, an address is suspicious: IPQS expects many of these to be proxy, VPN or Tor users, which can simply mean someone browsing privately rather than a fraudster. From 85 it is high risk, with suspicious behavior signals. From 90 it shows frequent abuse within the last 24 to 72 hours. IPQS suggests acting, by flagging or blocking, once a score reaches 90, while noting that customers may prefer a higher or lower threshold.
Why mobile IPs vary
IPQS’s definition of shared_connection names mobile networks first, next to corporate exit points, libraries, cafes and hotels. Its dynamic_connection flag marks addresses whose users are likely to be given a different address soon. Both describe how carriers work. Operators share public addresses across many subscribers using carrier-grade NAT, reserved in RFC 6598, and reassign them over time.
The consequence is that a carrier address carries the combined record of everyone who used it. The IETF’s RFC 6269 warns that penalizing a shared address for abuse also affects the other users behind it. On IPQS that shows as a recent_abuse or bot_status flag on an address you have only just received. Two addresses from the same carrier in the same city can score differently on the same day.
IPQS also adjusts for device type. Its advanced options say its algorithms adjust scoring based on the device type, read from the user agent, and that customers who cannot pass a user agent can flag mobile devices with mobile=true. The same address can therefore be scored differently for a phone browser and a desktop browser.
How sites use the number
Each IPQS customer tunes its own requests. The advanced options page describes strictness from 0 to 3, recommends starting at 0, and warns that anything from level 2 upward is very strict and produces false positives. A lighter_penalties option lowers scores for mixed-quality addresses to prevent false positives, and allow_public_access_points relaxes checks for schools, institutions and some corporate networks. IPQS’s best practices add that passing the full user agent improves scoring considerably.
The same documentation states that a request with the lowest strictness settings matches IPQS’s front-end lookup results and returns the most suppressed scores. So the public lookup shows close to the friendliest view of an address. A site running strictness 1 or 2, without lighter penalties, can see a higher score for the same IP.
What a site then does is its own decision: allow, ask for a CAPTCHA or SMS code, hold an order for review, or block. The score you see is one input to that decision, not the decision.
What to do with your result
- Read the flags before the number. A high score with
proxytrue and no abuse flags means the connection type was noticed. A high score withrecent_abuseorbot_statustrue means the address has a history. - Do not chase zero. A score in the 70s with no abuse flags is unremarkable for a shared or proxied address, and IPQS itself says 75 is not necessarily fraudulent.
- For an address with recent abuse, change the address. History belongs to the IP. With Coronium mobile proxies, change it from the dashboard, through the API, with a rotation link or on a timer, then look it up again. If a line keeps drawing flagged addresses, Coronium allows up to two device replacements per rolling 24 hours; a replacement has new credentials and may be on a different carrier.
- Keep the rest consistent. User agent and language feed the score, so keep them consistent with the device and location you present.
Our IP reputation check shows whether an address appears in the IPsum threat feed and how many source lists include it; it is not a fraud score. The guide to IP reputation, fraud scores and blocklists explains how these sources differ.
Sources and review scope
Sources reviewed October 30, 2026. Each checker was reviewed on October 30, 2026 from its own documentation, its published page scripts or an archived copy of its page, as the article states. Checkers change without notice, and a checker verdict is not a website’s decision. We do not see any site’s private risk rules.
Frequently asked questions
Read another checker
How each public checker reaches its verdict, and which of its findings a real site can act on.
Related workflows
What reputation tools measure and what they cannot see.
IPsum feed listings for a public IPv4 address.
A second fraud score with a different data source.
Look up an address on public block lists.
One device and one SIM per customer.
The full set of error and checker guides.
Where to get a dedicated line
A Coronium mobile proxy is one physical device with its own SIM, rented to one customer. It connects over HTTP or SOCKS5, the IP changes by dashboard button, API link or timer, and data is not metered on dedicated lines. Brazil lines are the exception: 20 GB of data a month and a new IP on request only, with no timer. Stock and prices differ by country and carrier.