If you have ever checked an unfamiliar IP address and wondered whether it was associated with suspicious activity, you may have come across Scamalytics. The service provides IP fraud intelligence designed to help businesses assess the risk associated with internet connections.
Rather than being a consumer antivirus program or a general website reputation checker, Scamalytics focuses heavily on IP-based fraud signals. Its tools can provide information about an IP address, including a fraud score, location, ISP, proxy status, VPN indicators, Tor status, and other network information.
Scamalytics says its products have been used in production since 2011 and that its IP intelligence is used by organisations such as fintech companies, banks, payment processors, identity-verification providers, adtech companies, e-commerce businesses, and online platforms.
This makes Scamalytics particularly relevant to companies that need to make quick decisions about whether an online visitor should be allowed through, asked for additional verification, or referred for manual review.
What Is Scamalytics?
Scamalytics is a UK-based fraud-intelligence company that provides tools for assessing the potential risk associated with internet traffic and user activity.
One of its best-known features is the Scamalytics Fraud Score, a numerical score from 0 to 100. The score is intended to represent the level of fraud risk associated with an IP address based on Scamalytics’ own intelligence and fraud-related signals.
The company offers both a public IP lookup service and products designed for businesses. Its business products include an API, an on-premises MMDB database, and bulk IP lookup capabilities.
For ordinary users, the online IP checker can be useful for understanding how a particular IP address is classified. For businesses, the API and database products can be integrated into existing fraud-prevention systems.
How the Fraud Score Works
The most important part of Scamalytics is its 0–100 fraud score.
According to Scamalytics, the score is based on fraud feedback gathered from a global network of operators that report confirmed fraudulent activity. That intelligence can then be applied to an IP’s surrounding network environment, including related subnets, autonomous system numbers and hosting blocks.
The score is not simply a measurement of where an IP address is located. It is intended to incorporate information connected with observed fraudulent behaviour.
Scamalytics explains that a score of 70 means approximately seven out of ten users seen from that IP have been associated with fraudulent activity, while a score of 0 represents no known fraud risk. The company also stresses that this is an approximation and that businesses should calibrate their own thresholds against their internal fraud data.
That distinction is important. A high score should be treated as a risk signal, not automatically as proof that a particular individual is a scammer.
Understanding the Score
Scamalytics currently groups its scores into four broad risk categories.
| Fraud Score | Risk Level | Typical Suggested Response |
| 0–19 | Low | Allow access |
| 20–59 | Medium | CAPTCHA or additional checks |
| 60–89 | High | Step-up authentication or SMS verification |
| 90–100 | Very high | Block or manually review |
These recommendations come from Scamalytics and are intended as starting points rather than universal rules.
For example, an online store might decide that a medium-risk visitor can continue shopping but needs additional verification during account creation. A financial service may use a stricter threshold because the consequences of fraudulent activity are much greater.
The right threshold depends on the business, its customers, and its tolerance for fraud and false positives.
What an IP Lookup Shows
A Scamalytics IP lookup can provide considerably more information than a simple country lookup.
Depending on the IP and available data, the service can show information about the operator, ISP, organisation, ASN, geographic location, datacenter status, proxy indicators and external blacklist results.
The service also provides information related to anonymisation technologies. Its business API documentation lists detection for VPNs, Tor, public proxies, web proxies and server or datacenter infrastructure.
This information can help a security or fraud team understand why an IP has been given a particular risk classification.
For example, an IP that belongs to a datacenter and is associated with anonymisation services may require a different level of scrutiny from an ordinary residential connection.
VPN and Proxy Detection
VPNs and proxies are not automatically illegal or fraudulent. People use them for legitimate reasons such as privacy, remote work, security testing, travel, and accessing services while away from home.
However, fraud teams may consider anonymised traffic a useful risk signal because scammers can use VPNs and proxies to hide the apparent origin of their connections.
Scamalytics therefore includes proxy and anonymisation information in its IP intelligence. Its product documentation specifically mentions datacenter infrastructure, VPNs, Tor, Apple iCloud Private Relay, Amazon AWS and Google Cloud among the types of infrastructure covered by its detection capabilities.
This is one reason an IP score should not be interpreted in isolation. Using a VPN does not prove that someone is fraudulent. It is simply one factor that may contribute to a broader risk assessment.
Geolocation Information
Another useful part of an IP lookup is geolocation.
Scamalytics says its API can return information such as country, region, city, postcode, coordinates and timezone through its geolocation data.
Geolocation can be useful when a company wants to compare the apparent network location with information supplied by a customer.
For example, a business might notice that an account claiming to operate from one country is repeatedly connecting through infrastructure in another region. That situation does not automatically indicate fraud, but it may justify additional verification.
IP geolocation should also be treated carefully because IP-based location is not equivalent to a person’s precise physical location.
Main Scamalytics Products
Scamalytics provides several ways for organisations to access its intelligence.
The first is the online IP lookup tool, which allows users to enter an IP address and see its fraud score and supporting information.
The second is the Fraud Risk API. This is designed for businesses that want to incorporate IP risk information into live workflows. Scamalytics states that its API is designed to respond in 50 milliseconds or less, with API nodes in Europe and the United States.
The third option is the on-premises MMDB. Instead of sending each IP address to an external API, organisations can keep the database within their own infrastructure. Scamalytics says the database is updated daily.
There is also a bulk IP lookup option intended for analysts who need to examine IP addresses without writing integration code.
Benefits for Businesses
One of Scamalytics’ main advantages is that it can turn complicated IP-related information into a relatively simple risk signal.
A business running an online registration system may receive thousands of new account requests every day. Checking each connection manually would be impractical. An automated fraud score can help the business decide which requests deserve closer attention.
For e-commerce companies, IP intelligence can contribute to payment and account-risk screening.
financial businesses, it can provide another signal alongside identity verification, device information and transaction monitoring.
For online platforms, it can help identify potentially suspicious traffic before it reaches a moderator or fraud investigator.
The major benefit is therefore not simply the score itself. It is the ability to incorporate IP intelligence into an automated risk-assessment process.
Pricing and Free Usage
Scamalytics offers a free usage level for its API and bulk lookup service, alongside paid plans.
At the time of writing, the published pricing page lists 5,000 monthly requests as a free tier. Paid examples include 25,000 requests for $25 per month, 50,000 for $50, 100,000 for $100, and 500,000 for $150 when paying monthly. Annual pricing is also offered, with unused monthly lookups not carrying over.
The exact plan that makes sense depends on how much traffic a business processes.
For someone who only wants to investigate occasional IP addresses, the public lookup tool may be enough. A company processing large numbers of registrations, logins or transactions may need the API or MMDB option.
Because pricing and product packages can change, businesses should check the current official pricing before making a purchasing decision.
Privacy and Data
Privacy is an important consideration for any service involved in fraud detection.
Scamalytics states in its privacy policy that Scamalytics LTD is the data controller and identifies its registered UK address. Its policy explains that the company may process different categories of information depending on the service and circumstances, including IP addresses, user-agent information, device identifiers and, for its wider anti-fraud services, information associated with user profiles and behaviour.
The company also publishes information about its approach to UK and EU GDPR requirements.
Businesses considering Scamalytics should therefore review the current privacy documentation and determine how its processing fits with their own legal and compliance obligations.
Is Scamalytics Accurate?
No fraud-detection system should be considered perfect.
Scamalytics itself states that its network has visibility into many millions of internet users per month but does not have visibility into the entire internet. It also explains that its statements concern web connections to websites and applications rather than every type of internet connection.
This limitation matters.
An IP address can be shared by many people. Mobile networks can place numerous customers behind related infrastructure. VPN services can make unrelated users appear to originate from the same network. Businesses can also use cloud and datacenter infrastructure for completely legitimate purposes.
Consequently, a Scamalytics result should be one input into a wider fraud decision rather than the sole reason for rejecting a customer.
Limitations to Keep in Mind
The biggest limitation is the possibility of false positives.
A legitimate user can sometimes connect through a VPN, corporate gateway, cloud service, mobile network, or another infrastructure type that receives additional scrutiny.
There is also a difference between detecting a risky network and identifying a fraudulent person. An IP address can be associated with suspicious activity without proving that every person currently using it is involved in fraud.
Scamalytics’ own documentation recommends that businesses fine-tune their thresholds using their own fraud data.
That is sensible because a dating platform, online retailer, bank and gaming website may face very different fraud patterns.
Scamalytics for Everyday Users
Most individual internet users will not need a Scamalytics API.
However, the public IP checker can be useful when someone wants to understand how their connection appears from a fraud-risk perspective.
For example, a user troubleshooting why an online service is requesting additional verification might check whether their IP is classified as a VPN, proxy, datacenter connection or elevated-risk address.
A result should not automatically cause concern. A risk score is an assessment of an IP connection, not a personal accusation.
If an ordinary residential connection receives an unexpectedly high score, the user may want to check the details shown by the lookup and, where appropriate, contact the relevant service provider or website.
Scamalytics and Personal Profile Information
Because Scamalytics is a technology company and fraud-detection service, it is sometimes searched in the same way people search for individuals online.
However, details such as age, height, family, physical appearance, personal net worth, siblings or a personal social-media profile are not relevant to Scamalytics as a company.
There is no reason to present invented personal-profile information for a software and fraud-intelligence provider. The more useful information is its purpose, products, technology, pricing, privacy practices and limitations.
For professional research, relying on verifiable company information is much more useful than adding unrelated personal details.
Is Scamalytics Worth Using?
For organisations that need IP-based fraud intelligence, Scamalytics can be a useful component of a broader fraud-prevention system.
Its strongest feature is the combination of a proprietary risk score with additional information such as proxy detection, geolocation, ISP-level risk and external intelligence sources.
The API can also make the service practical for automated workflows, while the MMDB option is suited to organisations that prefer local processing and high-throughput infrastructure.
However, businesses should avoid using a single IP score as an automatic verdict. A stronger fraud system combines IP intelligence with device signals, account history, payment information, behavioural patterns and other appropriate checks.
For that reason, Scamalytics is best viewed as a risk signal and intelligence layer rather than a complete fraud-prevention solution by itself.
Final Verdict
Scamalytics is an IP fraud-intelligence service designed to help businesses assess the potential risk associated with internet connections. Its central feature is a 0–100 fraud score supported by information about networks, proxies, VPNs, Tor, geolocation and other indicators.
The service offers several access methods, from an online lookup tool to API integration, bulk lookups and an on-premises MMDB database.
Its biggest strength is the ability to turn complex network intelligence into a practical risk signal. Its biggest limitation is that no IP-based score can conclusively determine whether a specific person is fraudulent.
Used carefully and combined with other fraud signals, Scamalytics can be a valuable tool for organisations that need to identify suspicious traffic while keeping legitimate users moving through their systems.
FAQs
Is Scamalytics a legitimate service?
Yes. Scamalytics presents itself as a UK fraud-intelligence company providing IP risk data, an API, MMDB data and lookup services. Its official terms identify Scamalytics LTD as the company operating the service.
What does a Scamalytics score mean?
The score ranges from 0 to 100 and represents Scamalytics’ assessment of fraud risk associated with an IP address. A higher number indicates greater observed or inferred risk.
Does a high Scamalytics score mean someone is a scammer?
No. A high score does not prove that a particular person is fraudulent. IP addresses can be shared, reassigned or used through VPNs, proxies and corporate networks.
Can Scamalytics detect VPNs and proxies?
Yes. Its IP intelligence includes detection and classification of VPNs, Tor, public proxies, web proxies and other anonymising or datacenter infrastructure.
Is Scamalytics free?
Scamalytics provides a free online IP lookup and currently lists a 5,000-request monthly free tier for its API/bulk lookup offering, with paid plans available for higher usage.
