IP Reputation Checkers 2026: IPQS, Scamalytics, IPinfo, proxycheck.io, and ipapi.is - Why the Verdicts Differ

You run the same proxy through three IP checking services and receive three different responses. For example, IPQualityScore assigns a fraud score of 88 and marks the address as a proxy. Scamalytics considers it low-risk. ipapi.is sees nothing suspicious at all. Where's the truth? The answer is unpleasant but useful: each checker answers its own question. Some look at the range of addresses, some access proxy networks and record the outgoing IPs, while others accumulate a history of complaints. Understanding how each one works makes discrepancies less frightening and more diagnostic.

Below, we analyze five popular services based on what they actually document about themselves and explain which one is important for your task.

Why Checkers Disagree: Three Different Methods

Almost any IP reputation service is built on a combination of three approaches. The proportions vary, which is why the verdicts differ.

• Network Directory (ASN and range owner). If the address belongs to a hosting provider (Hetzner, OVH, AWS) — it’s labeled as a "data center." This method is quick and nearly infallible for server IPs, but it says nothing about a residential address through which foreign traffic flows.
• Active Monitoring of Proxy Networks. The service itself connects to VPN and proxy providers, records which outgoing IPs it is given, and maintains a database with the date of the last appearance. This is the only way to see a residential proxy as a proxy.
• Behavior History. If spam, brute force, fraud transactions, or scanning originated from the address — the risk score increases. This method depends on where the service has sensors and which clients send it signals.

Hence, the main rule: a clean response from one checker does not mean cleanliness for all. It means that this particular method found nothing.

Comparison of Five Services

IPQualityScore (IPQS): Focus on Behavior and Fraud Score

IPQS is one of the strictest and most well-known services in anti-fraud. Its API returns a long list of indicators: proxy, vpn, tor, recent_abuse, frequent_abuser, bot_status, shared_connection, dynamic_connection, mobile, connection_type, and the final fraud_score from 0 to 100.

How to read the score, IPQS explains in its documentation:

• 75 and above — likely a proxy, VPN, or Tor, but not necessarily a fraud;
• 90 and above — frequent abuse in the last 24–72 hours, such addresses should be flagged or blocked.

An important detail is the strictness parameter. The higher it is, the deeper the check and the more false positives; for minimal false alarms, the documentation recommends 0 or 1. Therefore, the same IP may receive different scores on different sites: it all depends on how strictly the site configured the request. IPQS offers 1,000 checks for free at the start.

What this means for you: IPQS quickly reacts to fresh abuses. If someone spammed from this IP in the provider's pool yesterday, the score will jump, even if the address is residential.

Scamalytics: Fraud Score for Dating Sites and E-commerce

Scamalytics shows a fraud score (in its public lists of dangerous IPs — values up to 100), the actual country, operator, proxy, and Tor status. The methodology for calculating this is not publicly disclosed. It is known who supplies the data: DB-IP.com (geolocation) and IP2Proxy (proxy database). Scamalytics explicitly states that its assessments are "opinions based on limited information" and pertain only to connections to websites, not server requests.

What this means for you: Scamalytics' verdict largely inherits the IP2Proxy database. If the provider's addresses are not included there, the service will show low risk, even when IPQS raises an alarm.

IPinfo: Active Measurement and Separate Residential Proxy Database

IPinfo operates differently from the others. According to its own description, it connects directly to VPN and proxy services, analyzes handshakes, and checks the behavior of outgoing nodes (ProbeNet technology). It has a separate dataset and methodology for residential proxies, and the response includes fields:

• service — which proxy service the address belongs to (for mobile — with the suffix _mobile);
• last_seen — when the address was last seen in the proxy pool;
• percent_days_seen — what fraction of the last 30 days it was there.

In the example from the documentation, IPinfo directly names the provider of the address by the name of the service. The company claims that the accuracy of identifying VPNs and proxies is "usually over 99%" and that data is updated daily; this is the vendor's own assessment, with no independent verification.

What this means for you: IPinfo is a case where a residential IP can be marked specifically as a residential proxy, rather than just "suspicious." The percent_days_seen indicator here is more important than the flag: an address that appeared in the pool for one day out of thirty and an address that is constantly there look different for anti-fraud purposes.

proxycheck.io: Risk Adjusted for Recent Attacks

proxycheck.io offers 1,000 free requests per day and returns the network type (Residential, Business, Wireless, Hosting), an anonymity flag, and a risk score of 0–100. In the third version of the API, the score is calculated in real-time with weight on recent attacks, and each type of detection has its own baseline: hosting — 33%, VPN — 50%, proxy — 100%. The recommended actions table is divided into ranges of 0–25, 26–50, 51–75, and 76–100, depending on whether anonymization was found.

What this means for you: A typical server IP at proxycheck.io starts at one-third of the scale by default, even if no one has abused it. "33" here is not a condemnation, but a mark indicating "this is hosting."

ipapi.is: Quick Directory Without Residential Detection

ipapi.is returns flags is_proxy, is_vpn, is_tor, is_datacenter, is_abuser, the name of the data center, and the company's abuser score and ASN. For free — 1,000 requests per day, commercial use is allowed. The service honestly describes itself: the identification of proxies and VPNs is "moderately accurate," and it does not identify residential proxies and unknown VPNs.

What this means for you: "Clean" in ipapi.is for a residential proxy is an expected result, not proof of quality. However, for server IPs, it serves as a good quick filter: it immediately shows whether the address is flagged as a data center.

Summary Table

• IPQS — method: behavior + networks; sees residential proxies: partially, through abuse signals; main indicator: fraud_score (75+ / 90+); free: 1,000 checks at the start.
• Scamalytics — method: fraud score based on DB-IP and IP2Proxy data; residential: depends on the IP2Proxy database; indicator: score up to 100; free: public check on the website, API upon request.
• IPinfo — method: active measurement of proxy networks; residential: yes, separate dataset; indicators: is_res_proxy, last_seen, percent_days_seen; API rates — from 150,000 requests per month.
• proxycheck.io — method: detections + recent attacks; residential: network type Residential, detection — based on observations; indicator: risk 0–100 with baselines of 33/50/100; free: 1,000 per day.
• ipapi.is — method: network directory; residential: no (according to the service itself); indicators: is_datacenter, abuser_score; free: 1,000 per day.

Why Residential IPs Are So Poorly Captured by Reputation

A fresh figure to understand the scale. In April 2026, GreyNoise published a report "The Invisible Army" based on 4.02 billion sessions from 5.72 million unique IPs over 90 days (November 29, 2025 — February 27, 2026). The conclusions:

• 39% of unique IPs attacking network perimeters are residential connections, although they account for only 22% of sessions;
• 78% of such residential IPs are invisible to reputation feeds;
• on average, a residential IP gives less than three sessions before disappearing, with a median of one session.

GreyNoise concludes that defenders should move away from relying on IP reputation to analyzing behavior. For honest proxy users, this leads to two consequences. First: a low score for a residential IP is the norm, not a reflection of your provider's quality. Second: since IPs almost don't matter, websites are increasingly looking at browser fingerprints and behavior. This is discussed in our analysis of fingerprint checkers CreepJS, Pixelscan, and Iphey.

How to Properly Check Proxies: 5 Steps

1. Find out who checks you on the target site. There's no point in aiming for a zero in IPQS if your platform doesn't use it. Sometimes the vendor can be seen in the network requests of the login or payment pages; if not visible — focus on the site's behavior rather than the checkers.
2. Take a sample, not just one IP. When rotating, check 20–30 addresses. One "dirty" IP in the pool is noise, a third of dirty ones is a signal.
3. Look at the fields, not just the final number. recent_abuse in IPQS, percent_days_seen in IPinfo, network type in proxycheck.io tell more than the score.
4. Cross-check geo and type. If proxies are sold as mobile, but checkers see hosting, that’s a reason to question the seller. How to distinguish real 4G from a fake by ASN and CGNAT was discussed in our article on six checks before purchase.
5. Determine the threshold for your task. For scraping public data, a high score often doesn’t matter at all; for ad accounts and marketplaces, it is critical. Thresholds for platforms are collected in a separate Fraud Score guide.

Common Mistakes

• Chasing a zero. A mobile IP behind CGNAT is inherently shared: hundreds of subscribers go through it, and IPQS will honestly mark shared_connection. For social networks, this is a plus, not a minus: banning such an IP means affecting real users.
• Checking with high strictness and panicking. At strictness levels of 2–3, IPQS warns about an increase in false positives.
• Confusing "clean in ipapi.is" with "clean everywhere." The service does not look for residential proxies at all.
• Checking only once. IPQS and proxycheck.io scores take recent events into account, so yesterday's check guarantees nothing today.

What Type of Proxy to Choose for Your Task

• Price scraping, SEO monitoring, open APIs — data center proxies. Checkers will see hosting, but most public data websites don’t care, and the price per gigabyte is the lowest.
• Marketplaces, anti-fraud sites, account registration — residential proxies: network type Residential, addresses from real providers, rotation on request or by timer.
• Social networks and ad accounts — mobile proxies: a shared CGNAT address from the operator, which platforms are very reluctant to block.

Conclusion

IP reputation checkers do not lie; they simply answer different questions. ipapi.is tells whose range it is. IPinfo — whether the address has been seen in proxy networks and how often. IPQS and proxycheck.io — how recently it has been abused. Scamalytics — what its data providers know about it. Cross-check the readings, look at the fields, not just one number, and remember GreyNoise's conclusion: IPs are no longer the main signal. A clean pool solves half the problem; the other half is the browser fingerprint and behavior.