IP Risk Score Thresholds Explained: A Practical Guide for Fraud Prevention

IP risk scores rate an address from 0 to 100 based on its history of abuse, yet most industry resources fail to specify actionable thresholds. A practical framework divides scores into four bands: 1–19 (allow), 20–44 (combine with other signals), 45–79 (add friction), and 80–100 (block or escalate to manual review). Certain fields — including is_residential_proxy, is_known_attacker, and confidence scores — can override these bands, since a residential proxy and a cloud IP at the same score carry different risk profiles. The score measures abuse history tied to an address, not the individual behind a transaction, meaning a high score reflects shared infrastructure risk rather than a direct fraud probability. Vendors market this metric under several names, including IP fraud score and IP reputation score, but the underlying concept is consistent across providers such as IPQualityScore, MaxMind, and Spur.