Scamalytics Fraud Score Explained
Scamalytics rates an IP address from 0 to 100 and labels it low, medium, high or very high risk. The number has a concrete meaning: Scamalytics says a score of 70 means roughly 7 in 10 users seen from that address have been linked to fraud. It is built from fraud reports sent by the businesses that use it, then spread across neighboring addresses. That second step is why carrier IPs often score higher than their current user deserves.
Short answer
- The score estimates the share of users seen on the address who were linked to fraud, based on reports from Scamalyticsโ customer network.
- Risk is spread to neighbors: addresses in the same subnet, network or hosting block can score high before anyone reports them.
- Scamalytics suggests actions by band, from allowing below 20 to blocking or manual review from 90, and calls these a starting point.
- Its own page says it sees many millions of users a month but not the whole internet, and that its statements are opinions based on limited information.
How Scamalytics builds the score
| Score | Risk label | Suggested action |
|---|---|---|
| 0 to 19 | Low | Allow access with no extra friction |
| 20 to 59 | Medium | Show a CAPTCHA or add verification |
| 60 to 89 | High | Require step-up authentication or SMS verification |
| 90 to 100 | Very high | Block or flag for manual review |
Scamalyticsโ product page says the score is based on fraud feedback from a global network of operators who report confirmed fraudulent activity. It then applies that intelligence across the surrounding IP neighborhood, including addresses in the same subnet, ASN and hosting block, so that addresses near known malicious ones can receive elevated scores before they are reported individually.
The same page gives the meaning of the number: 70 means about seven in ten users seen from that address have been linked to fraud, and 0 means no known fraud risk. It suggests actions by range:
The proxy, VPN and other flags
Alongside the score, every lookup returns proxy and anonymization detection, an ISP-level risk score, geolocation and data from more than ten outside sources. Scamalytics names them: MaxMind GeoLite2, IPinfo, Spamhaus DROP, FireHOL, IPsum, x4bnet, and the published address ranges of Google, Amazon Web Services and Apple. A paid add-on classifies proxy types further.
Read the flags as labels from those sources. A data center flag usually comes from published cloud ranges or hosting databases; a VPN or proxy flag comes from detection lists; a blacklist flag means a threat feed lists the address. The ISP-level risk tells you whether the whole provider network has a poor record, which matters for hosting companies more than for carriers.
The public IP lookup carries a caveat worth repeating. Scamalytics says its network sees many millions of internet users per month but not the entire internet, that its statements are opinions based on the limited information available, and that they cover web connections by internet users, not server-to-server traffic. Its geolocation is credited to DB-IP and its proxy data to IP2Proxy.
Why carrier IPs vary
Two features of the method hit mobile carrier addresses hard.
Many users per address. Carriers place many subscribers behind shared public addresses through carrier-grade NAT, with RFC 6598 reserving the internal range for it. A score defined as the share of users linked to fraud is a shared statistic: one subscriberโs fraud lowers everyoneโs standing. The IETFโs RFC 6269 describes this collateral effect of penalizing shared addresses.
Neighborhood spreading. Carrier pools are large blocks of addresses inside one network. When risk is applied across a subnet and an ASN, a busy pool can lift the score of addresses that have done nothing.
The result is variance. Two addresses from the same operator can sit in different bands, and an address you receive today may already carry a high score. That is a statement about the address and its neighbors, not about you.
Scamalytics and IPQS side by side
| Aspect | Scamalytics | IPQS |
|---|---|---|
| What the number means | Share of users seen on the address linked to fraud | Overall risk from IP, user agent, language and other inputs |
| Main data | Fraud reports from its operator network, spread to neighboring addresses | Its threat network plus proxy and VPN detection |
| Bands | Low below 20, medium to 59, high to 89, very high from 90 | Suspicious from 75, high risk from 85, frequent abuse from 90 |
| Customer settings | Thresholds adjusted by each customer | Strictness 0 to 3, lighter penalties, device type |
| Public lookup | Opinion based on its own visibility | Matches its least strict settings |
People often check both services and get different answers. That is expected, because the two numbers are built differently and answer slightly different questions. The comparison below uses each vendorโs own description of its score.
When the score affects a real site
Only sites that buy Scamalytics data use its score, and each sets its own thresholds; the published bands are a starting point. Scamalytics lists ad networks, financial institutions, social networks and marketplaces as typical use cases for its downloadable database. If a site you use asks for SMS codes or extra checks, a medium or high score is one possible reason, among many.
What helps:
- Change the address if it scores high. On Coronium mobile proxies, each line is one physical device with its own SIM, rented to one customer, and you change its IP from the dashboard, the API, a rotation link or a timer. Look the new address up before you use it for anything that matters.
- Keep the address once it is good. Frequent rotation draws new addresses with unknown histories.
- Do not treat a low score as a pass. Sites combine IP scores with device, behavior and account data.
To compare sources, our IP reputation check shows whether an address appears in the IPsum feed, one of the open lists Scamalytics names, and on how many source lists. It does not produce a fraud score. The IPQS fraud score guide covers a scoring service built on different data.
Sources and review scope
Sources reviewed October 30, 2026. Each checker was reviewed on October 30, 2026 from its own documentation, its published page scripts or an archived copy of its page, as the article states. Checkers change without notice, and a checker verdict is not a websiteโs decision. We do not see any siteโs private risk rules.
Frequently asked questions
Read another checker
How each public checker reaches its verdict, and which of its findings a real site can act on.
Related workflows
A second fraud score, with documented strictness settings.
Look up an address on public block lists.
What reputation tools measure and what they cannot see.
The network that announces an address.
One device and one SIM per customer.
The full set of error and checker guides.
Where to get a dedicated line
A Coronium mobile proxy is one physical device with its own SIM, rented to one customer. It connects over HTTP or SOCKS5, the IP changes by dashboard button, API link or timer, and data is not metered on dedicated lines. Brazil lines are the exception: 20 GB of data a month and a new IP on request only, with no timer. Stock and prices differ by country and carrier.