Scamalytics is a free lookup that gives any IP address a fraud score from 0 to 100 and lists what it knows about that address: who operates it, where it is, and whether it looks like a datacenter, VPN, proxy or blacklisted host. Websites and anti-fraud tools rate visitors' IPs in a similar way, so checking a proxy IP before you use it tells you how it is likely to be treated.
This guide shows how to check a proxy IP on Scamalytics, how to read every part of the result, and what to do when an IP scores high.
What is Scamalytics?
Scamalytics Ltd runs a fraud-detection network used by websites and apps. Its public lookup at scamalytics.com shows, for one IP address:
- A fraud score from 0 (lowest risk) to 100 (highest risk), with a risk label such as Low Risk
- A short explanation of how the score was reached
- Operator details: hostname, ASN, ISP, organization and connection type
- Location: country, region, city and postal code
- Datacenter, external blacklist, proxy and residential proxy checks, each answered Yes or No
Scamalytics says its location data comes from DB-IP.com and its proxy data is sponsored by IP2Proxy. It also says the result is its opinion based on the traffic it can see, and that it covers web connections only.
Scamalytics IP check: how to look up a proxy IP
Step 1
Find the proxy's exit IP
Connect through the proxy and note the public IP that websites see. Per-IP plans show the address in the provider's dashboard. On a rotating GB plan every request can use a new IP, so switch to a sticky session first, or the IP you check may not be the one you use next.
Step 2
Search for the IP
Open scamalytics.com, paste the IP into the search box and press search. You can also go straight to scamalytics.com/ip/ followed by the address.
Step 3
Read the score
The coloured bar shows the risk label and the fraud score. The paragraph below it explains whether Scamalytics has seen traffic from this exact IP or scored it from its operator's overall traffic.
Step 4
Check the flags
Scroll down to the Datacenter, External Blacklists, Proxies and Residential Proxy sections. A low score with a red Yes in these sections still matters, as the flags example further down shows.
How to read the Scamalytics fraud score
Higher means riskier. A score of 0 is the lowest risk and 100 the highest. Scamalytics shows the risk label next to the number but does not publish a fixed pass mark, and every website decides for itself which scores it accepts, challenges or blocks.
Read the explanation under the score as well. For 8.8.8.8, Scamalytics says it has no direct visibility into traffic from that IP, so it scored the address from the overall risk of its operator's IP range. The same happens to many proxy IPs: an address with no history of its own inherits the reputation of its ISP or network. That is why two IPs from the same provider and city can score very differently: they often sit in different ranges or belong to different ISPs, and one of them may have a history of its own.
What each flag means
| Section | What it checks | What a Yes means for a proxy |
|---|---|---|
| Datacenter | Whether the IP is hosted in a datacenter | It is not a home or mobile connection, whatever the score |
| External Blacklists | Firehol, IP2ProxyLite, IPsum, Spamhaus and X4Bnet Spambot lists | The IP has been reported for abuse or proxy use; many sites block listed IPs |
| Anonymizing VPN | Known VPN exit addresses | Sites that block VPNs will likely block it |
| Tor Exit Node | Tor network exits | Most sign-up and payment forms refuse Tor |
| Server | A commercial server rather than a domestic connection | Same signal as Datacenter, from the proxy data |
| Public Proxy / Web Proxy | Open or web-based proxies | Shared by many users and widely blocked |
| Search Engine Robot | Crawlers such as search engine bots | Not expected on a proxy IP |
| Residential Proxy | Membership of a residential proxy network | The IP is a home connection that is known to carry proxy traffic |
The example shows why you should read both. Google's DNS address has a perfect score, yet it is plainly a datacenter server. A site that only allows home connections would still treat it as a datacenter IP.
Why a residential proxy IP can still score high
Residential proxies use home connections, so they usually avoid the Datacenter and Server flags. They do not guarantee a low score:
- Shared history. Residential pools are shared. An IP used by someone else last week carries whatever reputation that use earned.
- Network reputation. An IP with little history of its own is scored from its ISP or range, so a busy or abused network pulls the score up.
- Blacklists. Any IP, home connections included, can appear on Spamhaus, Firehol or similar lists after abuse.
- Proxy detection. Scamalytics has a dedicated Residential Proxy check. Some residential IPs will show Yes there, even with a low score.
- Scores change. Reputation is recalculated as new traffic is seen, so an IP can score differently next week.
If you are new to residential proxies, What is a residential proxy and how does it work explains how the IP is assigned.
What to do when a proxy IP scores high
You cannot change how Scamalytics scores an address, but you can choose a different one:
- Per-IP plans: extract another IP for the same location and check it before you use it. Per-IP codes are listed under residential IP plans, for example NovProxy IP.
- GB plans with sticky sessions: start a new session (most providers use a session ID in the username) to get a new IP, then check that one. GB codes are listed under residential GB plans, for example NovProxy GB.
- Change the location or ISP. If every IP from one city or ASN scores high, try a neighbouring city or another carrier where the provider offers ASN targeting.
- Check again later. Scores move as traffic is seen, so an IP that was borderline may change.
Scamalytics compared with other IP fraud checkers
| Checker | Score | Read it as | Flags shown | Account |
|---|---|---|---|---|
| Scamalytics | 0–100 | Higher is riskier | Datacenter, blacklists, VPN, Tor, server, proxy, residential proxy | Not needed for single lookups |
| IPQualityScore | 0–100 | Higher is riskier; IPQS documents 75 and above as suspicious, 85 and above as high risk, and recommends blocking from 90 | Proxy, VPN, Tor, recent abuse, bot activity | Not needed for the online checker |
| IPFighter | Percentage | Higher is better | Proxy, hosting, residential IP, blacklists, WebRTC, DNS and timezone mismatch | Not needed |
| Fraudlogix | Low, Medium, High or Extreme | Higher level is riskier | Proxy, VPN, Tor, datacenter | Free tier with a monthly lookup limit |
Two things stand out. IPFighter's scale runs the other way: 100% is good, unlike Scamalytics and IPQualityScore where 100 is the worst. And the checkers use different data, so the same IP can be low risk on one and suspicious on another. Checking an IP on two of them gives a fairer picture than relying on one.
FAQ
Is Scamalytics legit?
Yes. Scamalytics Ltd is a fraud-detection company, and the free lookup shows the same kind of IP risk data the company says it provides to websites through its API. Treat the result as its opinion: the company itself says it only sees part of the internet's traffic.
What is a good Scamalytics fraud score?
Lower is better, and 0 is the best possible. There is no universal pass mark, because each website sets its own limits. Check the flags too: a low score with Datacenter or Server marked Yes is still a datacenter IP.
Does Scamalytics detect residential proxies?
It tries to. The result has a Residential Proxy check that shows whether the IP is known to belong to a residential proxy network. Not every residential proxy IP is flagged, and results change over time.
Why does my IP have a high fraud score when I have done nothing wrong?
Scamalytics often scores an IP from its operator's or range's overall traffic, and a shared or recycled IP carries its previous users' history. Your own behaviour is only one part of the score.
Is Scamlytics the same as Scamalytics?
Yes. "Scamlytics" is a common misspelling. The site is scamalytics.com.