What Does a 0–100 Risk Score Represent?

An IP risk score is a normalised summary of everything an IP reputation system knows about a given address. A score of 0 means the IP looks entirely benign — it is a residential address with no abuse history, no association with VPN or proxy services, and no unusual traffic patterns. A score of 100 means the IP is a known threat: a Tor exit node, a flagged open proxy, or an address with a documented history of attacks.

The score exists because individual signals are not always conclusive on their own. A single VPN flag on a low-traffic IP might be a false positive. A combination of VPN + datacenter + abuse history + unusual geo patterns at score 87 is not. The score aggregates all available evidence into a single number that you can threshold against.

The Signals That Feed Into Scoring

Risk scores are calculated by weighting and combining multiple independent signals. Predax uses the following signal categories:

Network infrastructure signals (all returned under classification.* in the response)

• is_vpn — IP belongs to a known VPN provider's ASN or CIDR range
• is_proxy — IP is a known open or commercial proxy
• is_tor — IP is a current Tor exit node (updated hourly from the official consensus)
• is_datacenter — IP is registered to a cloud/hosting provider (AWS, GCP, Azure, Hetzner, OVH, etc.)

Reputation signals

• ASN reputation — the Autonomous System the IP belongs to has a history of abuse
• Community flagging — the IP has been reported across multiple Predax customers within a rolling window
• Threat-list matches — the IP appears in commercially-licensed public threat data such as Spamhaus DROP. (We deliberately don't ingest abuse databases whose licences prohibit commercial use, even the well-known ones — a risk score built on data you aren't allowed to use isn't a foundation.)

Behavioural and geographic signals

• Geographic anomalies — the IP's claimed location conflicts with its routing path
• Crawler/bot patterns — the IP matches known web scraper or bot ASN profiles
• High request velocity — the IP has been observed making unusually large numbers of API calls across the Predax customer base

Each signal contributes a weighted additive component to the final score. The weights are tunable per-account using Predax's custom scoring feature.

Score Ranges in Practice

(The API's own risk_level field uses four labels — minimal, low, medium, high — this table is guidance on what the underlying number tends to mean, not a mirror of that field.)

What the Distribution Actually Looks Like

Rather than invent illustrative examples, here is the real shape of the score across production traffic — 93,414 unique IP addresses scored by our API, measured August 2026:

• 70,414 of them (75.4%) score 0 — no risk signal of any kind.
• Only 2.2% score 50 or above.
• 30.3% carry a datacenter flag — which is why "block all datacenter IPs" turns away roughly 28% of traffic to act on a 2% problem.
• The distribution is a barbell: just 16 IPs in the whole dataset land in the 50–64 band. Traffic clusters at "clearly clean" and "clearly risky," with almost nothing in between.

That barbell shape has a practical consequence: fine-tuning your threshold by five or ten points changes the outcome for a vanishing number of IPs. What actually changes outcomes is which categories of signal you choose to act on — the full analysis is in our false-positives deep dive.

Choosing the Right Threshold

The right threshold is not universal — it depends on what you are protecting and what the cost of a false positive is versus a false negative.

Login / account creation: A threshold of 65–70 is appropriate for most applications. Block Tor (scores almost always above 85) outright; challenge VPN users (scores 50–80) with MFA.

Checkout / payment: A threshold of 60–65. Payment fraud is expensive, so you want to catch more — accept a slightly higher false positive rate in exchange for lower fraud rate.

API rate limiting: A threshold of 80–85. You want to limit rate-limiting false positives (a developer on a corporate VPN should not be rate-limited). Save the hard blocks for confirmed high-abuse IPs.

Content access / geo-restriction: A threshold of 50–60 for VPN detection specifically. You care about intent (bypassing geo-blocks) more than confirmed abuse.

Score vs. Individual Flags

The risk score and the individual boolean flags (classification.is_vpn, classification.is_tor, etc.) are complementary. Use the flags when you need to act on a specific signal — for example, you might block all Tor exits unconditionally regardless of risk score, because legitimate users essentially never browse through Tor.

Use the risk score when you need a holistic view — for example, when deciding whether to hold a WooCommerce order for review. A score of 78 tells you more than any single flag because it accounts for the combination of signals present.

The best implementations use both: flag checks for hard stops (Tor = always challenge), score thresholds for graduated responses (score 50–80 = MFA, score 80+ = block).

Related guides

• How to detect VPN users — the most common signal feeding into the score.
• Proxy detection API guide — proxy categories and how each weights the score differently.
• Residential vs datacenter proxies — why proxy *type* matters as much as proxy *presence*.
• ASN-based blocking explained — using ASN reputation as a higher-leverage filter than per-IP scoring.
• Bot traffic in 2026 — applying risk scoring to non-human traffic.

Ready to use it? See pricing — every plan exposes the full score plus the underlying flags.