You may have run into this: an account that worked fine suddenly asks for extra verification, or a newly registered account gets restricted within days. The content is fine, the behaviour is normal, and yet something is clearly off. Often the answer lies somewhere you were not looking — your IP address.
Before you take any action at all, the platform has already formed an opinion about that address. That opinion is usually expressed as a risk score.
What a risk score actually is
There is no official standard and no shared algorithm. A risk score is one company's internal assessment of how trustworthy an IP address looks, and different platforms weigh things very differently.
In plain terms, it answers one question: is there more likely to be a real person behind this address, or an automated system?
Lower usually means cleaner — closer to what an ordinary home connection looks like. Higher means the address carries more characteristics associated with bulk operations and automation.
One thing to be clear about up front: a high score does not mean an address is malicious. A normal company server or a cloud development environment will both score high, and both are perfectly legitimate. The score measures how much an address resembles a typical consumer, not whether someone is doing something wrong.
The signals platforms actually look at
Network type: the heaviest weight
This matters more than anything else. Addresses fall into rough categories:
- Residential — assigned by consumer ISPs like Comcast, China Telecom or Vodafone, usually backed by a real home connection
- Mobile — assigned by cellular carriers
- Datacenter — held by AWS, Google Cloud, Cogent and hosting providers, used for servers
- Corporate — static ranges assigned to companies
Platforms scrutinise datacenter addresses for a simple reason: ordinary people do not browse social apps from a data centre. Bulk registration, automation scripts and scrapers overwhelmingly run in datacenters because that is where compute is cheap and easy to scale. So datacenter addresses inherit a baseline of suspicion.
ASN: who owns this block
An ASN (Autonomous System Number) identifies the network that owns a range of addresses. Look up the ASN and you know which ISP or hosting company an address belongs to.
Risk systems maintain classifications of ASNs: which belong to consumer ISPs, which to datacenters, and which have a history of abuse. This is the most direct way to determine network type.
There is a fuller explanation in this article.
Reverse DNS
Many addresses have a reverse DNS record. For datacenter ranges these often look like:
ec2-54-xx-xx-xx.compute-1.amazonaws.comThat leaves little doubt. Residential addresses, by contrast, frequently contain fragments like dsl, cable, dyn or broadband — or have no record at all.
How many people share it
The number of people behind a single address is itself a signal. A home connection serves a handful of people; some proxy services route hundreds or thousands through one exit address. When one address produces logins for many unrelated accounts in a short window, risk systems tend to notice.
Abuse history
If an address has previously been used for spam, credential stuffing or fraud, it may already sit in various blocklist databases. Those records follow an address for a long time — including after it changes hands.
This is why a freshly rented server address can arrive already tainted by whoever held it last.
Geographic consistency
An address that resolves to the United States paired with an Asia/Shanghai browser timezone and a zh-CN locale is a contradiction, and it is one of the first things risk systems check. Nothing is wrong with the address itself; it simply does not agree with the other signals.
That side of things belongs to the browser environment, which you can inspect with the environment check.
What a "native IP" means
You will hear this term often in cross-border commerce. It refers to an address whose registered location matches where it actually egresses.
For example: an address registered to the United States that genuinely routes out through a US network is native. Some addresses are labelled as one country while routing out from elsewhere. Once a platform detects that mismatch through latency and routing characteristics, trust drops accordingly.
That is why native addresses command more trust — and higher prices.
Tolerance varies enormously between platforms
This gets overlooked constantly: the same address can be fine in one place and a problem in another.
- TikTok and e-commerce platforms — strictest. These services suffer badly from bulk registration and fake engagement, so tolerance for datacenter addresses is low
- Social media — moderate. They notice, but typically ask for verification rather than blocking outright
- AI services — most tolerant. A large share of legitimate traffic arrives through cloud servers and API gateways, so datacenter addresses are the norm
So whether an address is "usable" depends entirely on the use case. A datacenter address scoring 40% is unremarkable for an AI service and worth caution for TikTok.
Three common misconceptions
"Changing IP solves everything."
The address is one signal among many. Browser fingerprint, timezone and behaviour patterns are all being observed simultaneously. Changing only the address while everything else stays the same accomplishes less than people expect.
"A low score means I am safe."
A low score only says the address looks like an ordinary consumer connection. It says nothing about whether an account might be restricted for other reasons — content, behaviour and account history all factor in.
"A checking tool's verdict is the platform's verdict."
Every third-party tool, this site included, produces an estimate. Internal risk models are far more complex and incorporate your account history, device information and behavioural patterns — data no external tool can see.
What this kind of check can and cannot tell you
Being clear about the boundaries is more useful than overstating the capability.
It can determine:
- Location, ISP and ASN for an address
- A rough classification of network type (datacenter, residential, unknown)
- Whether timezone and locale agree with the address
It cannot determine:
- Whether an address sits on a specific platform's internal blocklist
- The address's genuine abuse history, which requires commercial fraud databases
- How a platform actually rates your account
The score on this site is estimated from ASN and ISP names. The approach is sound — network type genuinely is the dominant factor — but it cannot see proxy blocklists or fraud records. Treat it as a quick diagnostic, not an authoritative verdict.
Checking your own setup
The most direct approach is to see what kind of address you are currently egressing from.
Open the IP lookup and the page will show your address, location, ISP and ASN automatically, along with a risk score and suitability ratings for several common scenarios.
If you are using a proxy, run the environment check as well. Many people focus on the address alone and miss that their browser may be leaking its real address through WebRTC. In that situation a site can see both your proxy address and your real one, which looks considerably more suspicious than using no proxy at all.
Summary
A risk score is fundamentally an answer to "does this address look like a real person?" Among the inputs, network type carries the most weight, followed by ASN ownership, reverse DNS, sharing level and abuse history.
The value in understanding this is not in working around risk controls. It is that when an account behaves strangely, you can identify which link in the chain is causing it instead of guessing.