What is an IP threat / trust score?
When a firewall, CDN, or fraud system decides whether to trust your connection, it often boils your IP down to a single number — a threat score or trust score. Understanding what feeds that score explains a lot of mysterious blocks and CAPTCHA challenges.
What is an IP threat score?
It’s a risk estimate for an IP, usually on a scale (say 0–100), built from many signals. Security providers like Cloudflare and Akamai compute it continuously to decide whether to allow, challenge, or block traffic. A “clean” residential IP scores low-risk; a flagged datacenter or proxy IP scores high-risk and gets friction.
What feeds an IP threat score?
Common inputs include: whether the IP belongs to a residential ISP, a datacenter/hosting provider, or a known VPN/proxy range; its presence on blocklists; recent abuse history (spam, brute-force, scraping, bot traffic); the reputation of its ASN (the network that owns it); and behavioural signals like request rate. Datacenter and proxy IPs start at a disadvantage because so much automated abuse originates from them.
Why might your IP score badly?
You can score poorly through no fault of your own: using a VPN whose IP is shared with abusers, sitting on CGNAT behind a noisy neighbour, or inheriting a dynamic IP with a bad history. A compromised device on your network sending bot traffic will also tank your score.
How to check the signals you can see
You can’t read a provider’s private score, but you can inspect the public signals behind it. Our Blacklist Check tool shows blocklist presence; the connection details on our homepage and the Bulk IP Audit tool show the network owner (ASN) and whether an address looks like residential, hosting, or proxy. Those are the same factors a threat score weighs.
How do you improve a bad IP score?
Switch off a flagged VPN or pick a server with a cleaner IP; scan your network for malware if your residential IP is flagged; on a server, keep the IP off blocklists and maintain valid reverse DNS. Reputation recovers over time once the abusive signals stop.
Related: Bulk IP Audit tool · Datacenter vs residential blocklists