What an IP risk score means, and why 0 is not "safe"

An IP risk score is not the probability that the address is an attacker. As IP99 publishes it, the score measures the freshness and strength of verifiable evidence that an address is currently proxy, VPN, dial-up pool, cloud phone or datacenter infrastructure, and a score of 0 means we hold no current evidence — it does not mean the address is safe. Reading the number as a probability is the most common way an IP feed gets misused.

Two clocks

An address changes hands in minutes: a home connection rented as a proxy exit this morning is an ordinary subscriber this afternoon. The lists that describe addresses are refreshed in days. The gap between the two clocks is where false positives live. So the score is built around when something was seen, and it decays as that observation ages.

How to read the fields

risk.score — 0–100. Freshness and strength of verifiable risk evidence, decaying with its age.
risk.level — none (0) · low (1–29) · medium (30–69) · high (70–100).
evidence_state — active: fresh evidence. stale: seen before, evidence expired, score 0, still a weak signal. none: never seen.
risk.tags — what the evidence says: proxy, vpn, dialup_pool, cloud_phone, hosting and others.
computed_at, meta.data_version — when this verdict was computed and which data build produced it.
score_semantics — always capture_evidence_freshness: the response restates what the number measures so a consumer cannot silently drift into treating it as a probability.

Why 0 has two meanings

A score of 0 with evidence_state: "none" means the address has never been seen in any risk evidence. A score of 0 with evidence_state: "stale" means it was seen — as a proxy exit, say — and that evidence has since expired. The first is "unknown"; the second is "was, and probably no longer is". Neither is a clean bill of health, and a source that reports "clean" where it should report "unknown" is telling you something it does not know. Branch on evidence_state, not on the number.

How to act on it

if evidence_state == "active" and risk.level in ("high", "medium"):
    step_up()          # second factor, delay, manual review — not a ban
elif evidence_state == "stale":
    weak_prior()       # combine with device, velocity, account age
else:                  # "none"
    no_information()   # NOT "safe": fall back to your other signals

Two habits keep this honest: query at decision time instead of caching a verdict, and store source_url with the decision so a disputed block can be traced back to what was observed and when.

Check an address

Free, no signup, no API key — 1000 lookups per day per client IP:

curl https://ip99.com/v1/ip/8.8.8.8

Agents can call the same lookup as an MCP tool at https://ip99.com/mcp. Field reference: API documentation.

FAQ

Is a score of 0 safe?

No. 0 with evidence_state none means no evidence has ever been seen for the address; 0 with evidence_state stale means evidence existed and expired. Neither says the address is safe, and datacenter or residential proxy space with no observation yet will score 0.

Is the score a probability of fraud?

No. It measures how fresh and how strong the verifiable evidence of risk infrastructure is. Two addresses with the same score can carry very different fraud risk depending on your own signals; the score tells you what the network has been seen doing, not what the user intends.

Why did an address change from high to 0?

Because the evidence aged out. Rotating proxy exits and dial-up pools change tenant within minutes to hours; when the last observation is older than the decay window the state moves to stale and the score to 0. That is the score working as designed.

Should I block on high?

Step up rather than block: a second factor, a delay or a manual review. A high score means the address is currently in risk infrastructure; behind carrier-grade NAT and residential proxy pools that infrastructure is shared with real customers.

Where does the evidence come from?

From continuous observation of proxy supply and network infrastructure, captured with timestamps. Every response carries source_url, a page a human can read to see what was observed and when.