Proxy Fraud Score in 2026: What Scamalytics and IPQS Numbers Mean for Your Proxies

A proxy fraud score is the 0–100 risk number that IP intelligence vendors such as Scamalytics and IPQualityScore (IPQS) attach to the exit IP your proxy hands you. Websites, ad platforms and payment systems query those scores in real time, so a high number can get your proxy challenged or blocked. On both vendors' scales, lower means safer.

A "clean" residential IP no longer guarantees a low score. MaxMind and IPinfo now sell residential proxy databases that can name the proxy provider behind an address, and Scamalytics spreads fraud reports across whole subnets and ASNs. Your score can rise because of what other customers did on the same network.

The stakes rose sharply in 2026. In January, Google disrupted IPIDEA, a residential proxy network whose exit nodes more than 550 threat groups used in a single week, and in May the Imperva Bad Bot Report put automated traffic above 53% of all web traffic. For anyone buying proxies, both numbers point the same way: websites have more reason than ever to check where traffic comes from.

This guide decodes what Scamalytics and IPQS numbers actually mean, how each proxy type tends to score, why the same IP shows different scores on different checkers, which blocklist hits you can safely ignore, and a repeatable way to test a proxy pool before you pay for it.

Author: Christopher Vance Web Infrastructure Specialist

"The question I hear most from teams buying proxies is simple: why did a 'premium residential' pool start failing on day three? Usually the answer sits in the proxy fraud score, not in speed or uptime. Since Google disrupted IPIDEA's network in January 2026 and vendors began naming proxy providers in their data, I score a sample of exit IPs before any pool goes near production."

"One honest caveat: a score of zero is not a free pass. Scamalytics and IPQS only see part of the internet, and websites also read your browser fingerprint, TLS handshake and behavior. A low score gets you through the first gate, nothing more. And if a project depends on passing payment or account fraud checks through proxies, these scores exist precisely to stop it."

What Is a Proxy Fraud Score, and Who Calculates It?

A proxy fraud score is a vendor's estimate of how risky traffic from your proxy's exit IP looks, usually on a 0–100 scale. IP intelligence companies such as Scamalytics and IPQS calculate it from abuse reports, proxy and VPN detection, connection type and network history. Websites buy that data through APIs and databases, then challenge, slow down or block visitors whose IP crosses their chosen threshold.

Your proxy provider does not set the number. An exit IP — the address a target website actually sees when your request leaves the proxy network — carries its own history, and every vendor scores it independently. If you want a refresher on how that relay works, our guide to the role of proxy servers in networking covers the basics.

Fraud scores also differ from simple proxy detection. Peakhour's guide on proxy and fraud scores draws the line clearly: a proxy score estimates whether a request uses an intermediary, while a fraud score estimates business risk. A legitimate privacy user can trigger a proxy flag without looking fraudulent, and a fresh residential exit can look clean while still carrying risk.

Knowing who calculates the score is the easy part. Reading the number correctly takes more care, because 75 means something very different on each vendor's scale.

What Do Scamalytics and IPQS Fraud Scores Actually Mean?

On both Scamalytics and IPQS, a fraud score runs from 0 to 100 and higher means riskier, but the bands differ. Scamalytics rates 0–19 low, 20–59 medium, 60–89 high and 90–100 very high risk. IPQS says average proxy and VPN connections typically score 70–75, flags 85 and above as suspicious, and strongly recommends blocking at 90 or above. Always read a score against its own vendor's scale.

Scamalytics explains its number in plain terms on its Scamalytics product documentation: a score of 70 means its network tied roughly seven in ten users seen from that IP to fraud. IPQS frames its bands around behavior instead, and its two documentation pages draw the lines slightly differently. Its overview calls 75+ suspicious and 88 to 90+ high risk, while its IPQS best-practices documentation puts average proxy traffic at 70–75, suspicious activity at 85+ and a block recommendation at 90+.

Settings change IPQS results too. Its documentation describes a strictness level from 0 to 3, warns that levels 2 and above produce more false positives, and offers a lighter-penalties option for mixed-quality addresses. Two websites that both "use IPQS" can therefore treat the same proxy IP differently.

So where does a typical proxy land on these scales? That depends heavily on the type of proxy you bought.

How Do Residential, ISP, Mobile and Datacenter Proxies Score?

Each proxy type exposes different risk signals: datacenter proxies reveal hosting networks that fraud vendors treat as automated, while residential proxies look like home users but increasingly appear in dedicated residential proxy databases. Mobile proxies sit behind carrier NAT, so many real users share each IP. ISP proxies use addresses registered to ISPs while running on data center servers, and no type guarantees a low proxy fraud score.

Carrier-grade NAT — where a mobile operator places many subscribers behind one shared public IP — explains why mobile IPs behave unusually. IPQS marks such addresses with a shared-connection flag on Enterprise plans, and Scamalytics' public page for a Three Ireland mobile CGNAT pool shows an overall score of 0 while a few individual addresses in the same pool score 100. Our explainer on how carrier-grade NAT shares one IP covers the mechanics.

Our own fraud checker shows the same pattern from a different angle: it adds points for data center and public proxy addresses, and it openly notes that residential proxies pass its address check because they route through real home connections. That blind spot is exactly what the newer residential proxy databases try to close. For a deeper look at the product itself, see our guide on what residential proxies are and when they make sense.

Residential proxies have the best reputation on paper. Yet "clean" residential pools can still score high, and the reasons have changed in the last two years.

Why Does a "Clean" Residential Proxy Still Get a High Score?

A residential proxy can score high even with no abuse of its own for three reasons. Scamalytics applies fraud feedback across the surrounding subnet, ASN and hosting block. MaxMind, IPinfo and Scamalytics now identify residential proxy networks and even name the provider. And shared pools inherit whatever earlier customers did, with IPQS weighing abuse from the past 24 to 48 hours heavily, so your IP's neighborhood and pool matter as much as its own history.

Provider-level detection is the biggest shift. MaxMind's GeoIP Residential Proxy database lists the network, a provider_name field with values such as oxylabs or smartproxy, an anonymizer_confidence value from 1 to 99, and the date it last saw the network. IPinfo launched a similar residential proxy detection API on 8 July 2025, adding last-seen dates, how often an IP appears and a mobile flag.

Scamalytics now sells the same kind of signal: its Residential Proxy Data add-on returns a provider name, last-seen date, days seen and a residential proxy score. Once a vendor ties your exit IP to a named proxy network, a website can block that provider's whole footprint, regardless of each address's individual history.

Rotation adds another layer of variance to your proxy fraud score. Each rotating request can land on a different IP with a different history, so a pool that averages well can still hand you a 100 on the request that matters. I always look at the spread of scores across a sample, not the average, because the worst tenth of a pool decides how often your sessions fail.

Pool history explains high scores. But many buyers hit a more confusing problem first: the same IP showing a different score on every checker they try.

Why Does the Same Proxy IP Score Differently on Each Checker?

Different checkers score the same proxy IP differently because each vendor sees different traffic, weighs different signals and uses different settings. Scamalytics relies on fraud reports from its operator network and may infer a score from the owning network when it lacks direct visibility. IPQS also factors in the user agent, language and strictness level. Small or free checkers apply their own point systems, so no single score is the "real" one.

Inference explains many surprises. On its public IP pages, Scamalytics sometimes states that it has no visibility into traffic from that exact address and bases the score on the operator's other IPs. A brand-new exit IP can therefore inherit a low or high proxy fraud score from its network before Scamalytics has seen any traffic from it.

User-agent data matters more than it looks. IPQS says that passing the full user agent "can improve scoring by over 20%," so a checker that sends only the IP can disagree with what a real website sees. When you compare results, compare like with like: same vendor, same settings, same hour.

Fraud scores are not the only red flags a checker can raise. Blocklist hits show up on most residential IPv4 addresses in at least one published sample, and many of them have nothing to do with web traffic.

Should Spamhaus or Blocklist Hits Worry Proxy Buyers?

A PBL-only Spamhaus hit on a residential proxy IP is harmless for web traffic, because Spamhaus' Policy Block List covers end-user IP ranges that should never send email directly. A PBL listing describes a sending policy, not abuse. Spamhaus ZEN returns 127.0.0.10 or 127.0.0.11 for PBL entries. Worry when ZEN returns an SBL, CSS, XBL or BCL code, which points to spam operations, a hijacked machine or botnet infrastructure.

Real-world data shows how common these hits are. Databay, a proxy provider, published 1,000 redacted observations across 25 claimed residential ASNs in May 2026 (updated July 2026) and found DNSBL labels on 80.3% of its IPv4 rows, almost all from Spamhaus ZEN. Its data cannot show which ZEN sub-list fired, so treat it as a disclosed first-party sample, not an industry benchmark. PBL listings are a plausible explanation, since the PBL covers end-user ranges by design.

Email reputation and web reputation are different worlds. Spamhaus' own explanation of the Policy Block List says it belongs on mail servers during SMTP delivery on port 25. Our guide to how IP reputation scores work for email senders explains that side; for web proxies, only the abuse-type codes deserve attention.

With the scores and blocklists decoded, you can finally test a provider properly — before a trial turns into a contract.

How Do You Check a Proxy's Fraud Score Before You Buy?

To check a proxy fraud score before buying, take a trial, collect a sample of exit IPs across several hours, and run each one through Scamalytics, IPQS and a second checker. Record the score, risk band, connection type, ASN and any residential proxy or recent-abuse flag. Judge the pool by its worst tenth, not its average. Then repeat the sample a day later, because pools rotate.

Some providers now expose fraud scores directly. Evomi documents a fraudscore parameter that filters its Core Residential proxies by Scamalytics score, at the cost of extra bandwidth. Webshare offers a "High IP Reputation" add-on that it says gives proxies in the plan a 0% fraud score through its Scamalytics integration. Both are provider claims, so verify them with your own sample.

When I run this test, I keep a simple spreadsheet with one row per exit IP and one column per checker, then sort it before I read a single average. That sort usually decides the purchase in minutes, and it gives you hard evidence to bring to the provider's support team.

A test tells you what scores you will get. Deciding what score is acceptable depends entirely on what you plan to do with the proxy.

What Proxy Fraud Score Is Good Enough for Your Use Case?

A good proxy fraud score depends on how sensitive the target is. For public-data jobs such as price or search monitoring, Scamalytics low or medium scores and IPQS results under 75 usually work. For ad verification or logging into your own accounts, aim for Scamalytics low risk (0–19). Anything IPQS rates 90 or above, or Scamalytics rates very high, should leave your pool, whatever the task.

These targets are my working rules from vetting pools, not vendor policy, and every website sets its own threshold. A low score also covers only one layer of detection. Sites compare your IP with your browser fingerprint, timezone and TLS handshake, and our guide on the detection layers beyond IP reputation explains why a 0-score proxy can still fail.

Match the score to the job, test before you commit, and the number becomes a buying tool instead of a mystery.

A proxy fraud score is not a verdict on your provider's marketing; it is a live reading from vendors whose data now reaches deep into residential networks. Read every number against its own scale, where Scamalytics treats 0–19 as low risk and IPQS recommends blocking at 90 or above. Expect high scores from neighborhood effects, named proxy networks and pool history, even on residential IPs you never abused.

Ignore PBL-only Spamhaus hits on residential IPs, but reject any address with an XBL, SBL, CSS or BCL code. Then test before you pay: sample exit IPs across the day, score each on two or more checkers, and judge the pool by its worst tenth. Pair that test with the type advice in our guide to checking whether an IP is residential or datacenter, so the connection type you see matches the one you bought. If you are still comparing vendors, our roundup of residential proxy providers worth testing gives you a shortlist for this process.

Start with the proxy checker below on your current exit IP, then run your trial sample through the same steps before any pool reaches production.