Understanding the IP Risk Score

What the score represents

The risk score ranges from 0 to 100; higher values mean more risk signals were observed. Bands are 0–7 (A+) very clean, 8–25 (A) clean, 26–44 (B) neutral, 45–64 (C) slight risk, 65–84 (D) elevated risk, and 85–100 (F) extreme risk. If no risk points are added while key signals are missing, the page shows “Insufficient data” instead of interpreting 0 as very clean. It is an explainable reference score, not a blocking probability or a security certification.

Current scoring rules

Threat and abuse evidence share one family; only the strongest item counts: abuse record +55, high threat +40, or medium threat +20. Network-route attributes also share one family: Tor +25, proxy +15, VPN +12, or hosting/datacenter +10. A crawler flag adds +8. The final score is the sum of these groups, capped at 100.

For example, a medium threat signal plus a proxy signal scores 20 + 15 = 35, in the neutral band. If both proxy and hosting are present, only the proxy's 15 points count. Missing data is not treated as a clean signal; the page lists unavailable fields.

ASN Human/Bot traffic is a network-wide statistic, while native and residential status describe network context; none directly adds to the IP risk score. Current sources do not provide complete counts or frequency history for scans, brute-force attempts, or spam, so this score is not a full behavioral-history assessment.

Read it with the underlying signals

Review the listed score factors and unavailable fields. Similar signals can come from the same underlying evidence, so only the highest value in each family is counted. Missing or conflicting provider data reduces confidence. A low-risk label does not guarantee that an IP is trustworthy, and a higher-risk label does not prove abuse. Scores of 70 or above warrant review; do not automatically block based on the score alone.

Limitations

IPDO does not have a universal ground-truth list of clean or malicious IP addresses. Geolocation, network ownership, and risk sources can be stale, incomplete, or inconsistent. Use the score as an informational signal and make access or security decisions using independent evidence appropriate to your use case.