Check proxy IP reputation before it costs you CAPTCHAs and 403s. Read fraud scores, run a Spamhaus blacklist check, and know when to replace an IP.

How to check proxy IP reputation, fraud scores, and blacklists

A proxy can pass every basic test and still fail on the first real request. Your proxy connects and it even returns the right exit IP, and loads pages quickly. Then the target site answers with a CAPTCHA or a 403. The usual cause is the IP's history, which you inherit from whoever used it before you.

An IP reputation check measures that history. This guide expands the IP quality step from our guide to testing proxies. Here you will learn how to read proxies fraud scores, run a proxy IP blacklist check, and decide whether an IP is ready for production.

What proxy IP reputation is and why websites check it

Proxy IP reputation is a site's estimate of how risky traffic from an IP address is likely to be. Fraud and anti-bot services build that estimate from a handful of signals:

IP type and ASN. An IP on a cloud or hosting network looks like automation. One on a consumer ISP looks like an ordinary user.
Proxy and VPN detection. Risk databases flag IPs they have seen working as proxies, VPN exits, or Tor nodes.
Abuse history. Spam, credential stuffing, and scraping floods all get tied to the IP that sent them.
Shared use. Recycled residential IPs and shared datacenter IPs carry the record of every earlier user.

Sites run these checks at the points where fraud costs them money: signups, logins, checkout, and the anti-bot layer in front of the whole site. A poor reputation rarely produces a clear "you're blocked" message. More often you see extra CAPTCHAs, a verification step, or quiet rate limits.

This is why reputation matters so much when you run multiple accounts or try to get past Cloudflare. Your setup can be perfect, and the IP can still give you away.

How to check a proxy fraud score

A proxy fraud score rolls those signals into one number. The best-known version comes from IPQualityScore (IPQS), and it is usually what people mean by an IP quality score. The quality scores from 0 to 100, and a higher number means more risk.

First, confirm which IP you are actually checking. Send a request through the proxy to an IP echo service:

curl -x http://USER:PASS@HOST:PORT https://api.ipify.org

Paste the returned IP into the checker. For browser work, you can also open the checker with the proxy active, so it scores the same IP the target will see. On a rotating endpoint the IP changes between requests, so always score the one you got.

IPQS publishes its thresholds in its Proxy Detection API best practices:

Fraud score	IPQS guidance	What it means for a proxy
Below 75	Generally ordinary traffic	Fine for most tasks
75–84	Suspicious, but not necessarily fraud	OK for public scraping; test before account work
85–89	Suspicious activity; IPQS suggests flagging	Expect challenges on logins and signups
90+	Abusive behavior; IPQS strongly suggests blocking	Replace the IP

Two points help you read these numbers. IPQS says proxy and VPN connections with average risk tend to land around 70–75. A residential proxy in that band is normal, and hunting for a score near zero wastes time and IPs.

Checkers also disagree with each other. IPQS lets API users change how strict the scoring is, and other services use different data entirely. Compare IPs with one tool and the same settings, and treat a single high score as a reason to test the IP further.

Look past the headline number, too. The IPQS result includes flags such as proxy, vpn, and recent_abuse. A recent-abuse flag on a mid-range score is a stronger warning than a high score caused only by proxy detection.

How to run a proxy IP blacklist check

A proxy IP blacklist check looks for the IP on DNS-based blocklists (DNSBLs). These are public lists of IPs linked to spam, malware, or compromised machines. Most were built for email filtering, though some security tools and websites query them as well.

The fastest method is a multi-list checker such as MXToolbox, which tests one IP against dozens of lists at once. For Spamhaus, the most widely used blocklist operator, go straight to the Spamhaus Reputation Checker.

You can also query Spamhaus from the command line. Reverse the IP's four numbers and look them up under zen.spamhaus.org. To check 203.0.113.45:

dig +short 45.113.0.203.zen.spamhaus.org

An empty answer means the IP isn't listed. An answer in the 127.0.0.x range means it is, and the last number tells you which list. Spamhaus refuses free queries that come through large public DNS resolvers. If you get 127.255.255.254, the query was blocked, so run it from your own resolver and try again.

Which list an IP is on matters more than whether it's listed at all. Here is how the main Spamhaus return codes apply to proxies:

Return code	List	What it means for a proxy
127.0.0.2	SBL	Known spam source or malicious network. Avoid.
127.0.0.3	CSS	Automatically detected spam sender. Risky beyond email.
127.0.0.4	XBL	Compromised host, such as a botnet machine or open proxy. Replace.
127.0.0.10 or .11	PBL	Range that shouldn't send email directly. Normal for residential IPs.

The PBL row confuses a lot of people. Home internet ranges belong on the PBL because home connections shouldn't deliver mail straight to mail servers. A residential proxy on the PBL is behaving exactly as expected, so you can ignore that listing unless you send email through the IP.

How to decide whether to keep, swap, or drop an IP

One number can't make the call. Combine the fraud score and blacklist result with two more checks. The ASN should match the proxy type you paid for, and a few real requests to your target should come back clean.

What you see	What to do
Score under 75, no SBL or XBL listing, ASN matches, target loads normally	Keep it
Score 75–89 or a CSS listing, target loads with occasional CAPTCHAs	Use for low-risk tasks and keep testing
Score 90+, an SBL or XBL listing, or a "residential" IP on a hosting ASN	Drop it and ask for a replacement
Clean score, but the target returns 403s or block pages	Swap the IP, then check your fingerprint and request rate

Your threshold depends on the job. Scraping public product pages can tolerate a score in the high 70s. Account creation, logins, and checkout can't, and IPQS itself recommends stricter settings for those high-risk actions.

Before you blame the IP, separate reputation problems from setup problems. A 403, a 429, or a CAPTCHA wall comes from the target and often points to reputation or request rate. A 407, 502, or 504 comes from the proxy chain and usually has nothing to do with the IP's history. Our guide to fixing 407, 502, 504, and ERR_TUNNEL_CONNECTION_FAILED covers those.

How to keep your proxy IPs' reputation clean

Reputation changes over time. An IP that passed last month can be flagged next week if you, or another user, push it too hard. A light routine keeps your pool healthy:

Recheck before big jobs. Run an IP reputation check on a sample of your pool before each large run, and on every IP you assign to an account.
Automate it. Fraud score APIs return JSON, so you can add a score check to your existing connectivity and speed script and drop IPs above your threshold.
Pace your requests. Rate-limit each IP and back off on 429s. Request bursts are what get IPs reported in the first place.
Keep identities stable. Use sticky or dedicated IPs for accounts, and pair each one with a consistent browser profile. Our SOCKS5 antidetect browser setup guide shows how.
Retire IPs that drift. If an IP's score or success rate keeps sliding, take it out of rotation.

Clean IPs cost less, too. Every blocked request still burns bandwidth, and every retry burns more. Filtering bad IPs early is one of the simplest ways to cut proxy costs.

FAQ

What is a good proxy fraud score? On the IPQS IP quality score, anything under 75 is generally fine. Average-risk proxies often score around 70–75, so don't expect zero. Treat 85 and above as a problem for logins and signups.

Is a proxy on a blacklist always bad? It depends on the list. A Spamhaus PBL listing is normal for residential IPs. SBL and XBL listings point to real abuse or a compromised machine.

Why do checkers give the same IP different scores? Each service uses its own data, and some let you change the scoring strictness. Compare IPs with one tool and the same settings.

How often should I check IP reputation? Check when you get new IPs, before large jobs, and whenever success rates drop. Recheck long-lived account IPs on a regular schedule.