How to Check Proxy IP Fraud Score and Geo Accuracy

You are comparing providers on a trial and you have limited hours. Ask three questions, in this order:

Only the third question is a purchase decision. The first two are diagnostics that tell you why the third came out the way it did, and which of the two fixable problems you have: a geo problem, which a competent network operator can correct, or a reputation problem, which usually means you bought the wrong proxy class.

Run them in that order and a trial takes an afternoon. Skip straight to question three and you get a number with no explanation, which is useless the moment you want to negotiate or escalate.

A fraud score is not a property of an IP address. It is a classifier output, produced by a specific company, from signals that company happens to collect. Common inputs are the ASN class the address sits under, whether the range appears in public abuse feeds, open ports and known proxy ports, historical association with chargebacks or fake signups, and the velocity of distinct accounts seen behind the address.

Different vendors publish different fields on different scales:

Field names, scales and band definitions above are taken from each vendor's own published documentation as of September 2026. Vendors revise thresholds without much announcement, so read their current docs before you hard-code a cutoff.

Here is the part most buying guides skip. A datacenter IP will be flagged as hosting infrastructure by every one of these vendors, and that flag is correct. The address is registered to a hosting ASN, and no amount of vendor quality changes the classification. If your requirement is a clean "not a proxy" verdict, you are not shopping for datacenter proxies at all, and the honest comparison is residential versus datacenter proxies rather than one datacenter vendor against another.

What genuinely varies between datacenter providers, and what your test should isolate, is narrower: abuse history on the specific ranges, the behaviour of neighbouring addresses in the same /24, and whether the range appears on the public cloud-provider lists that many sites block wholesale. Those lists matter on their own, since a range that lands on one is blocked before any scoring vendor is consulted. See what cloud provider IP ranges are, with the wider background in what IP reputation is and why it matters.

"The IP is German" can mean three different things, and they routinely disagree:

Layer three is the only one that pays. Layers one and two exist to explain layer three.

The mechanism connecting them is the piece almost no proxy comparison mentions: RFC 8805 geofeeds. A network operator publishes a CSV listing its prefixes with their intended country, region and city, then advertises that file from a geofeed: attribute in its RIR whois record, the practice described in RFC 9092. Database vendors ingest those feeds on their own refresh cycles. That is how a provider corrects its own geolocation, and it is why corrections take days to weeks rather than minutes.

Turn that into a buying question. Ask a prospective provider two things: are the ranges I am buying covered by a published geofeed, and how long does a geo correction take to reach MaxMind and IP2Location? A provider that runs its own address space can answer both. A provider reselling someone else's allocations can answer neither, which means it cannot fix a geo problem you report, only swap you onto different addresses and hope. For the underlying model of how addresses get allocated and announced, BGP and RIR IP allocations covers it, and what geo-targeting means in proxies covers the product side.

Sample size determines what your test can even see. With 50 addresses, a single failure reads as 2 percent, so you cannot distinguish a 1 percent bad rate from a 3 percent one. Decide up front what failure rate would change your decision, then sample enough to detect it.

A practical rule for a trial: gather 50 to 100 distinct exits per country you actually care about, and never fewer than the thread count you plan to run. Testing 20 addresses before buying a 500-thread plan tells you almost nothing about the pool you will be using.

Collect the sample by rotating through the gateway and recording what comes back:

import collections
import requests

GATEWAY = "http://USER:PASS@gateway.sparkproxy.io:11000"
PROXIES = {"http": GATEWAY, "https": GATEWAY}

seen = collections.Counter()
for _ in range(400):
    try:
        ip = requests.get("https://api.ipify.org", proxies=PROXIES, timeout=15).text.strip()
        seen[ip] += 1
    except requests.RequestException:
        continue

print(len(seen), "distinct exits from 400 calls")
sample = list(seen)

Port 11000 rotates per request. If a check needs several requests to land on the same exit, use the sticky-session port 11002 instead, or 13000 for SOCKS5. Two things to watch while collecting. A pool that returns the same dozen addresses across 400 calls is far smaller than advertised for your country. A pool that returns a fresh address on every single call gives you no way to re-test the same IP a week later, so record the addresses, not just the count.

Start with registration, which is free and needs no key:

import requests

def rdap_country(ip: str) -> str:
    r = requests.get(f"https://rdap.org/ip/{ip}", timeout=15)
    r.raise_for_status()
    return r.json().get("country", "?")

Then the commercial databases. Query at least two, because agreement between two independent vendors is the signal, not the value from either one alone. MaxMind's GeoLite2 files have required a free account and a license key since December 2019, and IP2Location's LITE databases are free with attribution, so both are testable at zero cost:

import geoip2.database
import IP2Location

mm = geoip2.database.Reader("GeoLite2-Country.mmdb")
i2l = IP2Location.IP2Location("IP2LOCATION-LITE-DB1.BIN")

def db_countries(ip: str) -> dict:
    return {
        "maxmind": mm.country(ip).country.iso_code,
        "ip2location": i2l.get_country_short(ip),
    }

Now the layer that decides everything. Send a request through the proxy to the real target and read whatever country signal it exposes. Sites behind Cloudflare often return a CF-IPCountry header when the operator enables it. Retail sites usually redirect to a country path or switch currency. Search engines change result composition.

def target_country(url: str, proxy: str) -> str:
    r = requests.get(url, proxies={"http": proxy, "https": proxy}, timeout=30,
                     allow_redirects=False)
    if "cf-ipcountry" in r.headers:
        return r.headers["cf-ipcountry"]
    loc = r.headers.get("location", "")
    return loc.split("/")[3].upper() if loc.count("/") > 3 else "?"

Put the three results side by side and read the pattern:

That last row is the most common outcome of a failed trial and the most commonly misdiagnosed. People see blocks while targeting a country and conclude the geo is wrong. It usually isn't.

Pull scores for the whole sample, not for the three addresses you happened to copy out of a terminal. AbuseIPDB is a reasonable first vendor because the key is free and the field means one specific thing, namely how many people reported this address:

import os
import requests

def abuse_score(ip: str):
    r = requests.get(
        "https://api.abuseipdb.com/api/v2/check",
        headers={"Key": os.environ["ABUSEIPDB_KEY"], "Accept": "application/json"},
        params={"ipAddress": ip, "maxAgeInDays": 90},
        timeout=15,
    )
    d = r.json()["data"]
    return d["abuseConfidenceScore"], d["totalReports"]

Then report a distribution, never an average. A mean of 4 across 60 addresses hides one address sitting at 100, and that address will be the one your scheduler hands the important job to:

import statistics

scores = sorted(abuse_score(ip)[0] for ip in sample)
print("median", statistics.median(scores))
print("p90   ", scores[int(len(scores) * 0.9)])
print("dirty ", sum(1 for s in scores if s > 25), "/", len(scores))

Three habits separate a useful score pull from a decorative one.

• Check the /24, not only the address. Several scoring vendors and plenty of site operators treat a whole /24 as one entity. If two sampled addresses in the same /24 disagree wildly, assume the worse one sets the behaviour.
• Bound the age of the data. AbuseIPDB's maxAgeInDays matters: a report from 2023 describes a previous tenant, not the address you are renting today.
• Re-score the same addresses a week later. A pool that scores clean on day one and drifts by day twenty is churning ranges, which is a different and worse problem than a pool that starts slightly dirty and stays flat.

If scores come back poor across the board, the fix is rarely the scoring vendor. It is the range. What IP blacklisting is and how to avoid it covers the delisting side, and the ASN classification behind most of these verdicts is explained in what a datacenter ASN is.

Everything above is a proxy for this. Run the real pages.

OK_TOKEN = "add-to-cart"   # a string that only appears on a genuinely rendered page

def probe(url: str, proxy: str) -> str:
    try:
        r = requests.get(url, proxies={"http": proxy, "https": proxy}, timeout=30)
    except requests.RequestException:
        return "error"
    if r.status_code in (403, 429):
        return "blocked"
    if r.status_code >= 500:
        return "server"
    return "ok" if OK_TOKEN in r.text else "soft-block"

The soft-block branch is the whole point. A 200 response carrying an empty results grid, a consent interstitial or a stripped product page is the single most common false pass in proxy trials, and any harness that checks only status codes reports it as success. Pick a token that cannot appear on a challenge page, then assert on it every time.

Two rules make the resulting number comparable:

1. Run the incumbent in the same window. Absolute block rates move with the target's own posture on any given day. A 6 percent block rate means nothing alone and everything next to your current provider's number from the same hour.
2. Hold everything else constant. Same user agent, same header order, same request rate, same TLS client. Otherwise you are measuring your scraper, not the pool. If blocks persist with clean geo and clean scores, the cause is usually further up the stack, which is the ground covered in bypassing IP fingerprinting with clean datacenter subnets.

For the wider set of connectivity, latency and protocol checks to run alongside this, the complete guide to proxy testing has the full battery.

There is no universal acceptable score, only an acceptable score for what you are doing:

Read that table before you read a single score. A fraud score of 45 is a non-event for rank tracking and disqualifying for account signup. Buying the wrong class and then testing it hard is the most common way a trial wastes a week. A structured version of this decision lives in what to evaluate when selecting a proxy service.

The last column is the practical payoff of running all three tests. It converts "your proxies don't work" into a specific, answerable request, and a vendor's answer to that request tells you more about whether to buy than any number in the test.

Point the scripts above at gateway.sparkproxy.io. Port 11000 handles HTTP and HTTPS with per-request rotation, port 11002 holds sticky sessions when a check needs the same exit twice, and port 13000 speaks SOCKS5. Authenticate with credentials in the proxy URL, or add your test machine to the plan's whitelist slots. The network covers more than 1 million datacenter IPs across 80 or more countries, including over 50,000 US datacenter addresses, so a per-country sample of 100 is realistic to collect for the major markets.

Size the plan to the concurrency your block-rate harness proved you need, not to the number of addresses:

All four are unlimited bandwidth with 30 days validity. The speed figures are ceilings under the Fair Usage Policy, not a guaranteed sustained rate, and larger tiers exist above Plus for bigger deployments.

If the outcome of your testing is that you would rather not own the geo and reputation problem at all, the Scraping API takes the country as a parameter and handles exit selection, retries and rendering:

import os
import requests

r = requests.get(
    "https://scrape.sparkproxy.io/api/v1",
    headers={"X-API-Key": os.environ["SPARKPROXY_API_KEY"]},   # key format: sk-...
    params={
        "url": "https://example.com/de/products",
        "country_code": "de",     # geo-target the exit
        "render_js": False,       # 1 credit; True runs a real browser at 5 credits
        "premium_proxy": True,    # route through residential exits
    },
    timeout=60,
)
print(r.status_code, len(r.text))

Plain fetches cost 1 credit, JavaScript rendering 5, and screenshots or PDFs 10. There are 1,000 free credits with no card, enough to run the block-rate harness in this article against a few hundred real pages before committing to anything. Paid tiers start at $49 for 250,000 credits a month with 50 concurrent requests, then $99 for 1,000,000 at 100 concurrent, $249 for 3,000,000 at 200 concurrent, and $599 for 8,000,000 at 400 concurrent.