IP Reputation Scoring: How Risk Engines Grade Your IP
Before any fingerprinting happens, your IP already has a score. What goes into IP reputation — ASN type, blacklist history, behavior signals — and how to check and improve yours.
Long before a risk engine looks at your browser fingerprint or checks your timezone, it has already graded you — by your IP alone. IP reputation scoring is the first gate of almost every anti-fraud system, and it's the reason two people doing identical actions can get wildly different outcomes: one sails through, the other gets a CAPTCHA on page one.
What goes into the score
IP type is the biggest factor. Every IP range belongs to an ASN with a declared purpose: residential broadband, mobile carrier, hosting/datacenter, or business line. Datacenter ranges are public knowledge — Amazon AWS, DigitalOcean, Hetzner and friends publish their ranges, and commercial IP intelligence databases (MaxMind, IP2Location, IPinfo and dozens more) pre-tag them. A datacenter IP starts the race several laps behind: it declares "this is a server, not a person."
Blacklist history is the second pillar. Ranges that have historically emitted spam, credential stuffing, or scraping get listed on DNSBLs like Spamhaus — and once a range is flagged, everyone on it inherits the reputation. Buying a cheap VPS often means buying an IP that a hundred other tenants already burned.
Behavioral signals add texture on top: how many distinct accounts log in from this range, request rate patterns, whether the IP jumps between countries impossibly fast, and how long it has been stable. A residential IP that has been quiet for months scores better than a fresh one from a "clean" range.
Put together, this is why the same login flow can pass from a home connection and fail from a $5 VPS — the fingerprint was fine, but the IP entered the room with a criminal record.
The 52.9% problem
Our own anonymized detection data makes the stakes visible: over the past week, 52.9% of visitors testing their setup exited through a datacenter IP, up 1.7 points. Residential was 43%, mobile just 1.3%.
The economics explain it — datacenter IPs are cheap, fast, and available by the thousand. But every one of them announces its type. If your use case involves account longevity, spending the budget on IP type rather than IP count is almost always the better trade. The concrete differences are compared in residential vs datacenter IPs, and a pre-purchase checklist lives in the proxy buying guide.
How to check where you stand
Three checks, in order of effort:
- Type check: run an IP lookup and read the IP type field. "Datacenter" or "Hosting" means the first gate is already against you
- Blacklist check: the DNSBL checker queries major blocklists directly — Spamhaus, Barracuda and friends — against your exit IP. One or two obscure listings are common; a Spamhaus SBL hit is a red flag
- Consistency check: reputation isn't just the IP. A "clean" residential IP paired with a mismatched timezone still fails (see timezone and language mismatches), and 14% of last week's test sessions had DNS exits that didn't match their HTTP exits — run the DNS leak test too
If the checks come back badly: for short-lived scraping, datacenter IP reputation barely matters. For accounts you want to keep alive, move to residential or mobile exits before doing anything else — no amount of fingerprint tuning outranks the IP class.
Why mobile IPs score best
Mobile carriers sit behind CGNAT — hundreds of real subscribers share one public IPv4, rotating constantly. Blocking a mobile IP means blocking real customers, so risk engines treat them gingerly. That's why mobile exits score highest despite (or because of) only 1.3% of our visitors using them. They're also the most expensive per GB, which is the market pricing the reputation correctly.
TL;DR
- IP reputation is the first gate: type (ASN), blacklist history, and behavior decide the baseline before any fingerprint check
- Over half of proxy users are still on datacenter exits — the most pre-judged class of IP
- Check yours: IP type lookup, DNSBL scan, then consistency tests
- For account longevity, upgrade IP type first; for throwaway scraping, don't bother
Curious what your exit IP grades as? Run the full check on IPchase — type, location, blacklist status, all in one pass.
Check your own network: run a full disguise check on the homepage, or try the fingerprint test.