How is the threat score calculated?

The score (0-100) is aggregated using models that evaluate proxy status, historical abuse lists, ASN reputation, Tor node directory presence, and geographic consistency.

What is considered a high-risk score?

A score above 75 typically indicates a highly suspicious or automated connection. We recommend applying CAPTCHA or MFA challenges to scores in this range, and blocking scores above 90.

Can I customize the scoring weights?

Currently, the threat scoring engine uses a proprietary weighted algorithm optimized across our global network, but custom enterprise rulesets are coming soon.

Is a VPN user always assigned a high score?

No. While using an anonymizing VPN increases the baseline risk score, if the IP has no history of abuse, it will typically stay in the low-to-medium range, preventing false positives for privacy-conscious users.

Does the summary endpoint return geo data?

The summary endpoint returns the ISO country code. If you need city, region, or coordinates, you should use the Granular Geolocation API or the Full IP Lookup API.

How fast does a threat score decay?

Scores are dynamic. As an IP stops exhibiting malicious behavior or is removed from global blocklists, its threat score naturally decays over a period of 7 to 30 days depending on the severity of the past abuse.

IP Shield

Account

Security

Threat Scoring System

Combine multiple vectors into a single risk score to dynamically adjust login friction.

    {
  "ok": true,
  "date": "2025-06-12T00:00:00Z",
  "data": {
    "ip": "104.28.12.34",
    "country_code": "US",
    "proxy": true,
    "vpn": false,
    "threat_level": 85,
    "is_known_bot": false,
    "is_tor_node": false,
    "classification": "hosting",
    "asn_id": "13335"
  },
  "meta": {
    "total_credits": 10000,
    "credits_remaining": 9999
  }
}

Unified Threat Score

Evaluating individual flags like proxies, VPNs, or Tor nodes can be complex. The Threat Scoring System simplifies this by analyzing multiple threat vectors and returning a unified, actionable risk score from 0 to 100.

Unified 0-100 Score
Stop guessing with raw data and use a single, reliable metric for access control.
Sub-10ms Latency
Highly optimized rule evaluation happens in milliseconds at the edge.
Comprehensive Context
The summary payload includes all relevant flags like proxy, ASN, and Tor status alongside the score.

Multi-Vector Analysis

A high threat score isn't just about using a proxy. Our algorithms evaluate historical abuse data, routing anomalies, geographical inconsistencies, and known bad-actor infrastructure to compute a highly accurate risk profile.

Historical Abuse Data
Scores are heavily influenced by known spam, DDoS, and hacking blacklist databases.
Infrastructure Profiling
Datacenter IPs, bulletproof hosting, and residential proxies receive appropriate risk weights.
Anonymity Networks
Commercial VPNs and Tor exit nodes are factored into the baseline risk calculation.

Multi-vector analysis abstract visualization

Adaptive Friction Rules

Don't block legitimate users. Instead, use the Threat Score to create adaptive user experiences. Streamline login for low-risk traffic, while applying CAPTCHAs, MFA challenges, or manual review queues for high-risk requests.

Low Risk (0-20)
Streamline the checkout or login experience to maximize conversion rates.
Medium Risk (21-70)
Require a CAPTCHA, email verification, or secondary authentication factor.
High Risk (71-100)
Block the request entirely or flag the account for immediate manual review.

Adaptive friction rules abstract visualization

Simplify Your Security Logic

Stop managing complex rulesets and rely on a single, continuously updated metric.

Machine Learning Models

Our scoring algorithms adapt to new attack vectors automatically.

Single API Call

Get the score, ASN classification, and proxy status in one fast request.

Reduce False Positives

Context-aware scoring ensures legitimate privacy tool users aren't incorrectly blocked.

Protect APIs

Rate-limit or block high-threat IPs from accessing expensive backend resources.

Fraud Prevention

Flag high-risk transactions for manual review before capturing funds.

Easy Integration

Simply check if `threat_level > 75` to apply your security policies.

Real-time Updates

Threat intelligence is updated continuously as new attacks are detected globally.

Implement Threat Scoring

Get 1,000 free requests per month when you register.

Get API Key