IPQuery risk score
A transparent weighted sum of selected classification flags.
Definition
IPQuery’s risk_score adds fixed weights for active flags: proxy 50, Tor 50, VPN 30 and hosting 20. Mobile is reported separately and does not add to the score. The response preserves the existing API’s scoring behavior.
Worked example
Each true flag contributes its weight; each false flag contributes zero. The example below shows the actual flags and their individual contributions. Mobile does not add to the score.
{
"ip": "1.1.1.1",
"risk": {
"is_proxy": false,
"is_tor": false,
"is_vpn": false,
"is_datacenter": true,
"is_mobile": false,
"risk_score": 20
}
}How this score is calculated
- Public proxy
false - 50 × 00
- Tor
false - 50 × 00
- VPN
false - 30 × 00
- Hosting
true - 20 × 120
- Weighted sum
- 20
Mobile contributes zero. The maximum possible sum is 150; this is not a percentage or probability.
Selected fields from one complete single-IP response. Values describe the address looked up, not the reader’s connection.
API fields
risk.is_mobileboolean- Mobile or Cellular classification in the Enterprise fields.
risk.is_vpnboolean- Address matches a listed VPN range or a reviewed VPN-operated ASN.
risk.is_proxyboolean- Address matches a listed proxy IP, a reviewed proxy-provider network or a privacy relay exit range.
risk.is_torboolean- Enterprise Tor classification or the retained legacy Tor list matches the address.
risk.is_datacenterboolean- Hosting classification or a retained datacenter override matches the address.
risk.risk_scoreinteger- Weighted sum: proxy 50, Tor 50, VPN 30, hosting 20. This is not a probability.
Interpretation
The score is not a probability, a confidence estimate or a verdict about a person. The weights do not replace application-specific decisions or the source limitations of each flag.
Matching rules and limits