What Is an IP Fraud Score? How Risk Teams Use IP Scoring to Block Bad Traffic Before It Converts

Introduction

Every signup, login, and checkout on your site arrives with one piece of data you never have to ask for: an IP address. That address can't tell you who someone is, but it can tell you a lot about how they're connecting. Are they behind a VPN or a SOCKS proxy? Is the traffic coming out of a cloud data center instead of a home broadband line? Is it a Tor exit node, or an address already on a threat list? An IP fraud score rolls those answers into one number your systems can act on in milliseconds.

This guide explains what an IP fraud score actually measures, how to read one, and how risk teams use IP scoring to stop fake accounts, card testing, and bot traffic before it ever converts. We'll also walk through a real integration so you can see how an IP fraud score check fits into your own flows. The timing matters, because the share of automated traffic hitting websites keeps climbing.

According to the 2025 Imperva Bad Bot Report, automated traffic made up 51% of all web traffic in 2024, and malicious bots alone accounted for 37% of all internet traffic, up from 32% in 2023.

Source: Imperva 2025 Bad Bot Report

Why Bad Traffic Is Now a Revenue Problem, Not Just a Security One

A few years ago, bot traffic was mostly an infrastructure headache. Today it hits the P&L directly. Bots create fake accounts to farm signup bonuses, test stolen cards in small batches, scrape pricing, hoard inventory, and stuff credentials into login forms. Each of those attacks shows up somewhere in your numbers: inflated acquisition costs, chargebacks, wasted free trial credits, or support tickets from locked out customers.

The common thread is that most of this activity has to come from somewhere. Attackers rarely run thousands of requests from their own home connection. They rent hosting servers, route through proxies, or hide behind anonymizers. That's exactly the layer an IP risk score is built to inspect.

What an IP Fraud Score Actually Measures

An IP fraud score is a numeric estimate of how risky a connection is, based on what's known about the IP address behind it. It doesn't judge the person. It judges the network path they're using.

In Greip's IP Scoring endpoint, the score field is a composite threat score from 0 to 100, where a higher value means higher risk. Alongside the number you get:

• risk_level, a band of low, medium, or high
• recommendation, a suggested action of accept, review, or reject
• rules, a list of the specific signals that fired for that request
• security, the raw signals behind the score, such as vpn<em>or</em>proxy, tor, bot, relay, hosting, and is_blacklisted

That combination is what makes a fraud score IP lookup useful. The number helps you sort traffic fast, and the rules tell you why.

The Signals Behind a High IP Risk Score

Each signal catches a different kind of bad traffic, and knowing them helps you tune your response instead of blocking blindly.

Anonymization Signals

IP<em>VPN</em>OR<em>PROXY fires when the address is tied to a VPN, proxy, or anonymization service, and vpn</em>or<em>proxy</em>type tells you what kind (for example Socks). IP<em>TOR flags known Tor exit nodes. IP</em>RELAY catches private relay patterns such as Apple Private Relay, with relay<em>country and relay</em>city filled in when detected.

Infrastructure and Reputation Signals

IP<em>HOSTING means the address belongs to a hosting or cloud provider ASN. Real shoppers rarely browse from a data center, so this is one of the strongest hints of automation. IP</em>BLACKLISTED fires when the IP is on a Greip threat list or your own custom blocklist.

Behavior Signals

IP_BOT fires when the request's user agent matches automated bot patterns. It's a quick way to catch unsophisticated scripts that don't bother disguising themselves.

How to Read the Score Without Overreacting

A common mistake is treating every flagged IP as a fraudster. Plenty of honest people use VPNs for privacy, and Apple Private Relay is switched on for many iPhone users by default. If you hard block every anonymized connection, you'll lose good customers.

That's why the recommendation field matters. A medium score with review is a prompt for more checks, not a verdict. A high score with reject, especially when hosting, Tor, or blacklist signals stack together, is a much clearer call. Read the rules list before deciding, and you'll avoid most false positives.

A Technical Look at the IP Scoring Response

Here's the sample response from the docs for the address 12.12.12.12:

{
  "success": true,
  "data": {
    "ip": "12.12.12.12",
    "score": 35,
    "risk_level": "medium",
    "recommendation": "review",
    "rules": [
      {
        "id": "IP_VPN_OR_PROXY",
        "description": "IP address is associated with VPN, proxy, or anonymization service."
      },
      {
        "id": "IP_HOSTING",
        "description": "IP address belongs to hosting or cloud provider ASN."
      }
    ],
    "security": {
      "vpn_or_proxy": true,
      "vpn_or_proxy_type": "Socks",
      "tor": false,
      "bot": false,
      "relay": false,
      "relay_country": null,
      "relay_city": null,
      "hosting": true,
      "is_blacklisted": false
    },
    "custom_rules_applied": {
      "total": 0,
      "rules": []
    }
  },
  "execution_ms": 90
}

This IP sits in the middle band. It's a SOCKS proxy running on hosting infrastructure, which is a classic pattern for automated tools, but it isn't blacklisted. The suggested action is review, and custom<em>rules</em>applied shows that none of your own rules matched.

Run Your First IP Fraud Score Check in Minutes

The endpoint is a simple GET request to https://v2.greipapi.com/score/ip/{ip}. API v2 only accepts your key in the Authorization header, never in the query string. Use mode=test while building so you don't affect live data:

curl -s "https://v2.greipapi.com/score/ip/12.12.12.12?mode=test" \
  -H "Authorization: Bearer YOUR_API_KEY"

In a Node.js backend, you can turn the response into a decision for your signup or checkout handler:

async function scoreIp(ip, userId) {
  const url = `https://v2.greipapi.com/score/ip/${encodeURIComponent(ip)}?mode=test&user_id=${encodeURIComponent(userId)}`;
  const res = await fetch(url, {
    headers: { Authorization: `Bearer ${process.env.GREIP_API_KEY}` },
  });
  const json = await res.json();
  if (!json.success) {
    // Decide whether to fail open or closed for your risk tolerance
    return { decision: "review", reason: json.description };
  }
  const { score, risk_level, recommendation, rules } = json.data;
  return {
    decision: recommendation,
    score,
    risk_level,
    reasons: rules.map((r) => r.id),
  };
}

Passing user_id lets you see each user's requests on the Events page in your dashboard, which helps a lot when support asks why someone was flagged.

Where IP Scoring Pays Off Most

IP scoring is cheap to run and fits almost anywhere a request hits your server. These are the spots where it tends to deliver the biggest return.

• Signup forms. Catch bulk account creation from hosting ranges and proxy pools before fake accounts drain trial credits or bonuses.
• Login and account recovery. Add a step-up challenge when a known account suddenly logs in from Tor or a blacklisted address.
• Checkout. Send high risk IPs to extra verification before payment, which cuts card testing and chargebacks.
• Promo and referral flows. Stop the same person claiming a discount dozens of times through rotating proxies.
• Content and review submission. Slow down spam and review bombing from data center traffic.

Common Challenges and How to Handle Them

No IP signal is perfect, and a few patterns trip teams up.

Residential proxies route traffic through real home connections, so they don't look like hosting. That's where the vpn<em>or</em>proxy signal and your own velocity checks matter more than the hosting flag.

Shared IPs at offices, universities, and mobile carriers can put many legitimate users behind one address. Avoid permanent bans on those ranges and lean on review rather than reject.

Privacy tools like Apple Private Relay are legitimate. A relay signal alone is usually a reason to watch, not to block.

Best Practices for Turning Scores Into Decisions

A score is only as good as the policy around it. Teams that get the most out of IP scoring follow a few habits.

1. Map recommendations to actions. accept passes, review adds friction like email or SMS verification, and reject blocks or queues for manual review.
2. Log the rules, not just the number. Storing rule ids makes it easy to audit decisions and tune thresholds later.
3. Use custom rules and blocklists. Add addresses you've already caught so is_blacklisted fires next time.
4. Layer signals. Combine IP scoring with location and network data. Greip's IP geolocation service shows country mismatches against billing details, and ASN intelligence helps you spot whole networks behaving badly.
5. Review false positives monthly. Check what was blocked and adjust before good customers churn.

Layer IP Scoring With VPN and Proxy Detection

IP scoring gives you the verdict. Dedicated VPN and proxy detection gives you deeper context on how someone is hiding, which matters for use cases like regional pricing, licensing, and multi accounting. Used together, they let you separate the privacy conscious customer from the fraud ring using a rotating proxy pool. If you want to spot check a suspicious address by hand first, the free proxy and VPN checker is a quick way to see the signals.

Where IP Risk Scoring Is Heading

As AI makes bots cheaper to build, attackers will keep shifting toward residential and mobile proxies that blend in with real users. That pushes IP risk scoring away from static blocklists and toward combined signals: anonymization, infrastructure, reputation, and your own business rules evaluated together on every request. Expect more teams to run IP scoring on every sensitive action, not just checkout, and to feed results into a single risk decision alongside email, phone, and transaction data.

Frequently Asked Questions

What is an IP fraud score?

An IP fraud score is a number that estimates how risky a connection is based on its IP address. Greip's IP Scoring endpoint returns a composite score from 0 to 100, where higher means riskier, plus a risk level, a recommended action, and the rules that fired.

How do I run an IP fraud score check?

Send a GET request to https://v2.greipapi.com/score/ip/{ip} with your API key in the Authorization header as a Bearer token. Use mode=test while building, and run the call from your server so the key stays private.

What signals raise an IP risk score?

The main signals are VPN or proxy use, Tor exit nodes, private relay patterns, hosting or cloud provider ASNs, bot user agents, and addresses on a Greip threat list or your own custom blocklist.

Should I block every IP with a high fraud score?

Not automatically. Map the recommendation to an action: accept passes, review adds friction such as email or SMS verification, and reject blocks or queues for manual review. Check the rules list so you don't punish privacy-conscious customers using a VPN or Apple Private Relay.

Where does IP scoring help the most?

IP scoring pays off at signup, login and account recovery, checkout, promo and referral flows, and content submission, anywhere bots and fraudsters try to create fake accounts, test cards, or abuse offers.

Is IP scoring enough on its own?

IP scoring is a strong first layer, but residential proxies and shared IPs can blur the picture. Combine it with IP geolocation, ASN intelligence, VPN and proxy detection, and email or phone scoring for a more reliable decision.

Which Greip plan includes IP Scoring?

The IP Scoring endpoint is available on Standard plans and above.

Conclusion

An IP fraud score turns raw network data into a fast, explainable decision. With a 0 to 100 score, a clear low, medium, or high band, an accept, review, or reject recommendation, and the rules that triggered it, your team can block bad traffic at signup, login, and checkout without punishing real customers. Start in test mode, map recommendations to actions, log the rules, and layer IP scoring with geolocation, ASN, and VPN detection as you grow. When you're ready to try it on your own traffic, the IP Scoring docs have everything you need to make your first call with Greip.