How scoring works
The purity score is a reference score: it starts at 97, each risk signal deducts points, and reverse DNS published by the network owner adds 3. When Tor / proxy / VPN / datacenter overlap, only the heaviest counts in full and the rest at 40%; an IP already flagged as VPN / proxy is not charged again for its proxycheck risk score.
Deduction rules
| Base score | 97 pts |
| Reverse DNS confirmed | +3 pts |
| Tor exit node Same group as proxy / VPN / datacenter: heaviest hit in full, the rest at 40% | −65 pts |
| Proxy server Same group rule as above | −25 pts |
| VPN exit Same group rule as above | −20 pts |
| Datacenter / cloud IP Same group rule as above | −20 pts |
| Recent abuse | −20 pts |
| Elevated network abuse score ipapi.is network abuse tier: Elevated 5 / High 10 / Very High 15 | up to −15 pts |
| DNS blocklist listing | −8 (max −24) pts |
| Risk score ≥ 66 Not counted when already flagged as VPN / proxy | −15 pts |
| Risk score 34–65 Not counted when already flagged as VPN / proxy | −8 pts |
| Crawler | −8 pts |
| Private Relay / secure gateway egress | −8 pts |
| Anycast address | −8 pts |
| Origin mismatch Registry ≠ located country 3 / sources disagree 6 / no location 8 | up to −8 pts |
| Non-residential network Business / education / government 2, unknown 5 | up to −5 pts |
| Partial coverage One detection source answered 6 / fewer than 3 blocklists checked 3 | up to −9 pts |
| Detection unavailable Neither detection API answered, so proxy / datacenter use is not verified | −16 pts |
Grades
| A+Pristine | 95–100 | Very clean residential or business exit. Virtually every platform works. |
| AExcellent | 85–94 | Clean residential or business exit. Most platforms work normally. |
| BGood | 70–84 | Minor risk signals. Most services work; a few may ask for verification. |
| CFair | 50–69 | Several risk signals. Popular platforms may restrict or challenge you. |
| DPoor | 25–49 | High-risk exit. Many platforms block it or challenge often. |
| FBad | 0–24 | Very high risk (Tor / proxy / blocklisted). Most platforms will block it. |
Data sources
Location and ASN come from Cloudflare edge data, ipapi.is, ipinfo.io and Team Cymru. VPN / proxy / datacenter / Tor flags come from ipapi.is and proxycheck.io. Blocklists are queried over DNS-over-HTTPS: SpamCop, Barracuda, UCEPROTECT, DroneBL and SORBS. A built-in list of major cloud and hosting ASNs serves as a fallback.
DNSBL: bl.spamcop.net, b.barracudacentral.org, dnsbl-1.uceprotect.net, dnsbl.dronebl.org, spam.dnsbl.sorbs.net
Limitations
Residential proxies and freshly created VPN nodes are hard to detect. One ASN can serve both residential and hosting customers. Platform availability is an estimate, not a live test. If you believe a result is wrong, contact us to correct it.
Caching
A report for the same IP is cached at the edge for 3 hours to conserve third-party API quota.
Rate limit
The JSON API and command-line lookups allow up to 20 requests per minute per IP (web lookups count too). Beyond that you get HTTP 429; please retry after a minute.