threat_score, trust_score, vpn_score and proxy_score, each 0 to 100, built from blocklist hits, anonymity signals and network properties — one number to act on per question.
{
"ip": "185.220.101.34",
"threat": {
"scores": {
"vpn_score": 2,
"proxy_score": 4,
"threat_score": 92,
"trust_score": 3
},
"is_threat": true,
"is_known_attacker": true,
"is_known_abuser": true,
"is_datacenter": true
}
}the response's scores, in the threat object — with every plan
Every IP address receives a composite threat score from 0.0 (clean) to 1.0 (confirmed malicious), computed across nine independent threat categories. The score updates continuously as new evidence arrives.
IPs observed sending unsolicited bulk email, listed on major DNSBLs and real-time blocklists.
Hosts conducting systematic port enumeration across IP ranges, detected via distributed honeypot networks.
IPs attempting credential stuffing or dictionary attacks against SSH, SMTP, FTP, and web login endpoints.
Command-and-control infrastructure identified through traffic analysis, sinkholing, and malware reverse engineering.
Hosts actively probing for known CVEs, unpatched services, and zero-day vulnerabilities across the internet.
Infrastructure hosting credential harvesting pages, brand impersonation, or malicious redirects.
Hosts serving malicious payloads, drive-by downloads, or acting as distribution nodes for known malware families.
IPs observed participating in volumetric, protocol, or application-layer denial-of-service attacks.
Aggregated abuse complaints from ISPs, hosting providers, and automated reporting systems worldwide.
Each signal produces an independent probability. The fusion engine weights them based on recency, reliability, and signal type, then outputs a single calibrated confidence score.
The scores and the signals behind them, returned with every lookup on Business and above. No field-level pricing.
threat.scores.trust_scoreHow trustworthy the address is, 0 to 100. Sixty and above reads as low risk, under forty as high.
threat.scores.threat_scoreThe probability, 0 to 100, that the address is a threat.
threat.scores.vpn_scoreThe probability, 0 to 100, that the address is the exit node of a commercial VPN.
threat.scores.proxy_scoreThe probability, 0 to 100, that the address is a proxy.
threat.is_known_attackerWhether the address is a known source of malicious activity: attacks, malware, botnet traffic.
threat.is_known_abuserWhether the address is a known source of abuse: spam, harvesters, registration bots and other nuisance bots.
threat.is_threatTrue when either is_known_attacker or is_known_abuser is true.
threat.blocklistsThe blocklists the address has been reported to; empty when it is on none.
Feed reputation scores into your web application firewall to automatically escalate blocking thresholds for known-bad IPs. Challenge medium-risk traffic with CAPTCHAs, hard-block high-risk.
Enrich security event logs with threat context at ingestion time. Analysts see reputation scores, threat categories, and blocklist history alongside every alert — no manual lookup required.
Score IPs at registration and login to detect account takeover attempts, credential stuffing campaigns, and fake account creation from known-malicious infrastructure.
Reject or quarantine inbound email from IPs with high spam or phishing scores. Reduce inbox noise and protect users from malicious attachments and credential harvesting.
Score the buyer's address before the charge. A clean reputation goes straight through; a known attacker, a proxy-heavy range or a fresh blocklist hit gets step-up verification or a manual review first.
During active incidents, bulk-query attacker IPs to understand campaign scope, identify related infrastructure, and determine whether the threat is targeted or opportunistic.
The four reputation scores are computed for every lookup on the Business plan and above.
Monthly prices; yearly billing is 20% less. Compare every plan