# Why We Give You the Data, Not a Score

**URL:** <https://community.ipinfo.io/t/why-we-give-you-the-data-not-a-score/7430>\
**Category:** General\
**Created:** [September 29, 2026, 1:35pm UTC](https://community.ipinfo.io/t/why-we-give-you-the-data-not-a-score/7430 "2026-09-29T13:35:24Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Abdullah](https://yyz1.discourse-cdn.com/flex035/user_avatar/community.ipinfo.io/abdullah/32/4973_2.png) [@Abdullah](https://community.ipinfo.io/u/Abdullah)\
**Post date:** [September 29, 2026, 1:35pm UTC](https://community.ipinfo.io/t/why-we-give-you-the-data-not-a-score/7430/1 "2026-09-29T13:35:24Z")

</div>

![image](https://canada1.discourse-cdn.com/flex035/uploads/ipinfo/original/2X/b/b8bfba5af4e7fdfdde3923f0805ef7d52b2bf4b1.jpeg)

> A single number is convenient. Visible signals let your team build a model that fits your own traffic.

IP scoring is popular because it is convenient. A single number, usually from 0 to 100, tells a team whether to allow or block a request. At IPinfo, we chose a different approach: we provide the underlying data and let you build the model. Here are our reasons.

 ![image](https://canada1.discourse-cdn.com/flex035/uploads/ipinfo/original/2X/6/6a583378a3c462174342cec928a66364eff9f809.png)

## **A score hides its reasoning**

When an IP address receives a score of 100, the natural question is why. Often the answer is not visible. Take Tor exit nodes, which are commonly marked as fully abusive. The label may be accurate for some environments, but a number alone does not tell you what was observed or whether it applies to your traffic.

With data, the reasoning is visible. If an IP is a VPN, a hosting provider, a residential proxy, or a public WiFi hotspot, you can see that and decide what it means for your system.

## **Threats are not uniform**

SSH brute forcing and API reverse engineering are very different behaviors. A single score has to compress both into one number, so it fits no specific case very well.

Consider a hospital’s HR system. A targeted attacker logging into an admin portal is unlikely to look like a typical automated bot. A careful actor is more likely to use a VPN or a public WiFi hotspot. A score built mainly from crowdsourced abuse reports, which often come from web server logging agents, may not reflect that pattern. Identifying the nature of the IP gives the security team more to work with.

## **Scoring needs context that only you have**

A meaningful threat score requires knowledge of your users, your applications, and your normal traffic. That knowledge sits inside your organization. A third-party provider looking from the outside cannot fully model your threat environment.

This is why teams with mature security operations tend to build their own scoring. They take multiple signals, such as anonymization status, network type, and geolocation, and weight them according to their own risk tolerance.

A third-party provider looking from the outside cannot fully model your threat environment.

## **False positives and gaps**

A generic score can produce both kinds of error. Legitimate users on shared or privacy-focused networks may be blocked, and problematic traffic from a network that scores low may pass through. Either outcome can weaken a security posture. When the team owns the model, it can tune the balance for its own case.

## **Where IP intelligence fits in a fraud stack**

Device fingerprinting is a useful tool, and it works best alongside IP data. A few considerations:

- Device identifiers can change over time, while IP addresses tend to be relatively stable. Even with residential proxy rotation, there is context that the addresses are residential proxies.
- Fingerprinting takes time and can be costly at high traffic volumes.
- Fingerprinting can be bypassed through API reverse engineering or behavior mimicking.

Mature teams combine fingerprinting, IP intelligence, captchas, autonomous security tools, and SIEM. IP intelligence often serves as the foundation because it needs no prior context from the visitor, offers many variables to work with, and is cost effective for getting started.

 ![image](https://canada1.discourse-cdn.com/flex035/uploads/ipinfo/original/2X/8/890586638686f4b87dd8562ef3be472b164bf7db.png)

## **Our approach**

We report what we identify, including VPNs, proxies, and public WiFi hotspots, and we do so transparently. Our own network of servers gives us a broad base of observations. You take that data, combine it with your logs, and build a scoring model that reflects your threats.

A single score could be easier to sell, but we believe transparent data serves our customers better and reflects how sophisticated security teams work.