Response fields
scoring
The 0 to 100 fraud score, its confidence and the signals behind it.
An explainable 0–100 risk score from 40+ weighted signals, including exonerating signals and CGNAT caps.
| Field | Type | Description |
|---|---|---|
fraud_score | number | 0–100 composite risk score. Exonerating signals subtract (residential ISP −20, verified crawler −30); CGNAT ranges are capped. |
confidence | number | Overall confidence in the verdict, 0.0 to 1.0, based on how much evidence is available for this IP. |
recommended_action | string | "allow" (0–25), "review" (26–50), "step_up" (51–75), or "block" (76–100). |
detection_methods | string[] | The exact signals that fired for this IP: the score's reasoning, machine-readable. |
A field with no value comes back as the string "none", or 0 for numbers. The API never returns null.
Example
The scoring group for 8.8.8.8, from a real lookup on 24 October 2026. Values change as the data is refreshed.
{
"scoring": {
"fraud_score": 10,
"confidence": 0.25,
"recommended_action": "allow",
"detection_methods": [
"datacenter_ip"
]
}
}