Scamalytics Proxy Detection Explained

Scamalytics is an IP intelligence service used by websites to assess the fraud risk of IP addresses and assign a score. The London-based company started out using machine learning to spot scammers on online dating platforms, and its IP fraud detection data has been in production since 2011, with over 7,500 users. Today, its products help businesses detect fraud, safeguard users, and protect revenues in fintech, banking, payments, and e-commerce. Online businesses, from payment processors to marketplaces, check that score to decide whether to allow, challenge, or block requests.

If you use proxies for data collection or any of the other proxy advantages, you need to know your IPs’ risk scores. Learning how to read a Scamalytics lookup can be useful for increasing your success rates when web scraping. This guide explains how to read and interpret a Scamalytics result, not how to deploy Scamalytics as a fraud detection product.

How Scamalytics Fraud Scoring Works

The Scamalytics IP score is a number from 0 to 100 that assigns a probability judgment to the IP based on reported abuse and other network characteristics. It's not a verdict on the current user, but an estimate of the IP's risk.

A score of 70, for example, means that roughly 7 in 10 users who visited from that address were linked to fraud, and 0 means no known risk.

Scamalytics tells clients to adjust the scores based on their own fraud data. The same score can pass on one site and trigger a CAPTCHA or even a block on another. Scores themselves come from fraud reports.

Confirmed fraud cases are sent to Scamalytics, which applies them to the surrounding subnet, Autonomous System Number (ASN), and hosting block. As a result, an IP address near known malicious addresses can score high before anyone reports it directly, an effect known as neighborhood scoring.

Each lookup includes checking for the connection type, for example, whether the IP belongs to a datacenter, a VPN, a proxy network, or a high-risk Internet Service Provider (ISP), and blocklist checks from other abuse databases. Geolocation signals are also used so a site can check whether the location matches the user's.

Scamalytics can also detect VPN, proxy, and Tor use, and it adds data enrichment from more than 10 external sources, including MaxMind GeoLite2, Spamhaus DROP, FireHOL, Google, and Amazon AWS. Its on-premises database is updated daily.

Fraud Score vs Proxy Label vs Residential Classification

A Scamalytics lookup returns several separate fields that are often confused.

• Fraud score is a 0–100 risk estimate based on reported fraud and network reputation. This is the number most sites build their rules on.

• Proxy, VPN, or Tor label is a classification flag from detection feeds that shows what the address appears to be. It describes the address and doesn't rate its risk.

• Connection type refers to whether the address belongs to a home ISP, a mobile carrier, a datacenter, or a hosting provider.

Combinations of these fields create a range of results. A home IP flagged as a residential proxy with a score of just 9 is less likely to face extra checks or blocks, but a datacenter proxy IP with a score of 87 will, even if both carry proxy flags.

Websites usually build their rules on the fraud score because it reflects reported abuse, so the proxy flag alone rarely triggers a block. Residential IPs also tend to score lower than datacenter IPs.

Why Residential Proxy IPs Appear in Intelligence Databases

Residential proxy addresses are sourced from real home connections. The fact that they are included in detection databases doesn’t necessarily mean they are compromised or malicious.

Proxy flags come from detection feeds and publicly circulated proxy lists. One of the strongest signals is when a partner platform reports an incident with an IP or a related neighbor network.

Neighborhood scoring is a big factor. An address can inherit a higher risk score from nearby addresses in the same subnet or ASN without sending any bad traffic itself.

Home ISPs also reassign dynamic IPs. The address your proxy exit uses today may have belonged to someone performing malicious activity on online platforms that report it.

How Rotation Affects Your Risk Profile

Fraud scores respond to behavior over time. The longer you keep one address and the more traffic you send through it, the more likely it is to build a pattern that websites can report on. That's why proxy rotation helps to keep your IP risk score from rising.

With anyIP rotating proxies, you can get a new IP address on every request or keep one for a preset interval of 1, 5, or 60 minutes, a day, or 7 days, subject to IP availability.

Rotation alone won't fix a high IP score, though. If each address sends too many identical requests in a short window, targets can still rate-limit or flag it. Request pacing and consistent browser fingerprinting matter as much as the number of IPs you use.

How to Read Your Scamalytics Result

You can check your IPs on the Scamalytics website or using their API. Enter an IP address on the lookup page to view its fraud score, or query the API in real time. The free API tier includes 5,000 credits per month, and Scamalytics says it does not log API calls or store the IP addresses customers submit.

It's best to read the Scamalytics results in order of importance. Start with the connection type, then check the IP score and risk level.

Look at the proxy or VPN label last, since it doesn't mean much alone. The most common cases you'll encounter are based on a combination of factors.

• A low score with a proxy flag is typical for residential proxies. Most sites let these requests through, so the IP works for common scraping and browsing tasks.

• A medium score on a residential connection can often be inherited from the ISP or subnet rather than your own traffic. Expect CAPTCHAs on stricter sites, and switch to a lower-scoring IP before you start a new session.

• A high score on a datacenter address means the network has a record of reported abuse. Expect blocks or extra checks on sites with strict IP reputation checks, so use a residential or mobile IP for those targets.

Note that Scamalytics is just one database out of many. Other IP intelligence providers use different data and may score the same address differently, so check at least one more source before you judge the IP.

How anyIP Approaches IP Quality

At anyIP, we source residential proxies through exclusive partnerships, selected so that IP addresses are sourced with consent, and test each server to verify its residential origin. We check nodes automatically every 10 seconds and replace proxy servers that don't meet our standards.

It's up to you to decide whether to use residential, mobile, or mixed IPs, what locations to target, and how often to rotate the IPs. Use services like Scamalytics to check risk scores, and our own proxy checker to confirm that IPs are live and responsive. If an address returns a high score, switch to another one from the pool.

Keeping Risk Scores Low in Practice

• Match the proxy type to the target. Use residential or mobile IPs for sites with strict IP reputation checks, and datacenter IPs only where speed is most important. Check our guide to proxy server types for more information.

• Keep one IP per multi-step flow. Use a sticky session for logins and multi-page form flows instead of rotating mid-session.

• Pace your requests. Add delays between requests rather than sending bursts from one IP.

• Spread your traffic. Avoid routing all traffic through one exit point.

No proxy setup protects an address from poor behavior. Sustained abusive behavior will push any risk score up. When you choose a proxy service, look into how the provider sources and tests its IPs, so poor IP reputation is less likely to affect your projects.