Risk Checks Explained
What each of the 24 items on the risk card checks, what a record means and what to do about it.
How to read the three states
Every cell on the card is in one of three states. Before reading a result, separate "nothing found" from "could not check".
Record found
At least one source returned a match. Records marked as historical were found earlier and could not be re-verified this time.
Valid result
This lookup got a complete result and nothing matched within the range checked. It means no record was found, not that the address is guaranteed safe.
Unverified
The source did not return a complete, valid result this time. The item counts as neither a match nor a pass.
Results come from several sources recorded at different times. They summarise existing evidence and are not a judgement of whoever is using the address now. Items in the same group may come from one source, so they are not independent confirmation of each other.
Proxy y anonimato
Whether this IP is an anonymising exit that hides the visitor's real network. A match does not mean malicious, but platforms treat the traffic as coming from an unknown origin.
Proxy
- What it checks
- Whether sources identify this IP as a proxy exit, meaning other people's traffic leaves through it.
- If there is a record
- Platforms do not see the visitor's own network. Sign-up, login and payment are more likely to trigger CAPTCHAs, SMS verification or outright refusal.
- What to do
- A self-hosted proxy being identified is common; switch to an unflagged exit if it matters. If you are not using a proxy, the address was probably used as one before, and the record expires over time.
Proxy residencial
- What it checks
- The address belongs to a home broadband or mobile network but is identified as an exit of a residential proxy pool, carrying traffic from third parties who rent it.
- If there is a record
- These exits are widely used for bulk sign-ups and automation, so platforms usually treat them more strictly than ordinary datacenter proxies. What other tenants do on the same exit also counts against the address.
- What to do
- A match is expected for a purchased residential proxy; focus on whether the report and blocklist groups have records. On your own home line, check the router and devices for bandwidth-sharing or passive-income apps.
VPN
- What it checks
- Whether this IP is an exit node of a VPN provider.
- If there is a record
- Region-sensitive platforms such as streaming, payment and AI services may restrict access or add verification. Ordinary browsing is rarely affected.
- What to do
- Use an unidentified exit when you need to pass platform checks. If you use a VPN only for privacy, a match is the expected result.
Tor
- What it checks
- Whether this IP is on the public list of Tor exit nodes.
- If there is a record
- Most platforms block Tor exits outright, or bar them from sign-up, login and payment.
- What to do
- The Tor exit list is public and cannot be hidden. Use another network when you need normal account access.
Relay
- What it checks
- Whether this IP belongs to a privacy relay service, such as the privacy exit built into a browser or operating system.
- If there is a record
- Relay exits are shared by many ordinary users, so platforms rarely treat them as malicious. Location becomes coarser, which occasionally causes a region mismatch or one extra verification.
- What to do
- Turn the relay off temporarily and retry if you hit a region restriction. Usually nothing else is needed.
Salida anónima
- What it checks
- Combined signs point to an anonymising exit, but it could not be classified as a proxy, VPN, Tor or relay.
- If there is a record
- Platforms still treat it as traffic that hides its origin, and verification gets stricter accordingly.
- What to do
- Compare the other five items in this group and the proxy port item to find the cause. If you are sure it is an ordinary line, wait for the record to update.
Abuso y automatización
Overall assessments from anti-fraud and reputation data, plus behaviour records such as automation and spam content.
Puntuación de fraude
- What it checks
- The overall risk assessment of this IP from anti-fraud data. The higher the score, the more likely the address is considered to be used for fraud.
- If there is a record
- Payment, sign-up, ad delivery and coupon flows consult scores like this. With a high score, orders are more likely to be declined or sent to manual review.
- What to do
- The score is an overall estimate, not a specific behaviour record. Check which other items have records; that is usually why the score is high.
Otros abusos
- What it checks
- A source flagged the address for abuse without placing it in a specific category such as crawler, spam content, compromised device or attack record.
- If there is a record
- External reputation databases already hold a negative impression of the address, and strict platforms raise verification.
- What to do
- This is a general flag, so read it together with the report and blocklist groups. When it is the only item with a record, the effect is usually limited.
Otras marcas
- What it checks
- Whether a threat intelligence source gave this IP a general suspicious or malicious flag with no more specific classification.
- If there is a record
- Corporate firewalls and security gateways that subscribe to threat intelligence may block access from this address.
- What to do
- Specific listings and attack records appear under the IP list and attack intelligence items. When those two are empty, this flag carries limited weight.
Rastreador
- What it checks
- Whether this IP has been observed doing automated scraping, or shows access patterns unlike a normal browser.
- If there is a record
- Websites are more likely to show it CAPTCHAs, rate-limit it or block it, especially content sites and e-commerce platforms.
- What to do
- If you run a scraper, lower its rate and follow each site's rules. If you do not, someone else on the same exit is scraping, which is common on shared exits.
Contenido spam
- What it checks
- Whether this IP has records of posting spam in comment sections, forums or blogs.
- If there is a record
- Community sign-ups, posts and comments may be rejected or held for review. This is not the same as sending spam email; see DNSBL for mail.
- What to do
- Anti-spam records usually expire over time, and some databases accept appeals. On a shared exit the record most likely comes from an earlier user.
Puertos proxy
- What it checks
- Whether recent public scan records show this IP with ports open that are specific to proxy software. Ports that ordinary websites also use are not counted.
- If there is a record
- An open port suggests the address may be offering a proxy service, which is one of the reasons many sources label an address as a proxy.
- What to do
- On your own server, add access control to the proxy service or bind it to localhost. On a home line, check whether a proxy program was installed on the router or a device.
Listas y honeypots
Whether this IP or its range appears on blocklists, and whether its route announcement is authorised.
DNSBL
- What it checks
- Whether this IP is listed on DNS-based blocklists, which mail servers mainly use to decide whether incoming mail can be trusted.
- If there is a record
- Mail sent from this address is likely to be rejected or filed as spam, and some websites and forums use these lists to block sign-ups.
- What to do
- Most lists offer self-service removal; fix the sending problem before you apply. Dynamic broadband addresses are listed as a matter of policy, which does not mean malicious behaviour.
Listas de IP
- What it checks
- Whether this IP itself appears on public or third-party blocklists.
- If there is a record
- Firewalls, CDNs and risk systems consume these lists widely. The more lists include the address, the wider it is blocked.
- What to do
- The result shows how many lists include it. Listings normally expire on their own; a long-standing listing means the problem is still active.
Listas de rango
- What it checks
- Whether the address range or network this IP belongs to is listed as a whole.
- If there is a record
- It reflects the reputation of the whole network, not anything this IP did. Platforms that block by range will block it along with the rest.
- What to do
- You cannot remove a single address; only the network operator can deal with it. Move to another range if it matters.
Lista negra del sitio
- What it checks
- Whether this site's own restriction list includes the IP, usually because it attacked or sent abnormal requests to this site.
- If there is a record
- This is a first-hand observation by this site and shows the address really did send abnormal traffic recently.
- What to do
- The list is reviewed regularly and entries lift once the abnormal traffic stops. If you believe it is a mistake, tell us through the feedback link at the bottom of the page.
Honeypot HTTP
- What it checks
- A honeypot is a trap site built to catch automated programs. This item shows whether a honeypot network recorded the IP, including bulk harvesting of email addresses.
- If there is a record
- Ordinary users never visit honeypots. A record means scanning, harvesting or spam programs ran on this address, and websites block it more readily.
- What to do
- Check the device for unknown programs. The record expires after a period with no new activity.
Autorización RPKI
- What it checks
- Whether the route announcement for this IP's range matches the authorisation registered by the address holder. This is a routing check, not a reputation record.
- If there is a record
- A mismatch means the announcing network is outside the authorisation, which may be a configuration error or a route hijack. Having no registered authorisation is common and not a problem.
- What to do
- Ordinary users need to do nothing. Network operators should compare the authorisation record with the network that actually announces the range.
Denuncias y ataques
Whether this IP has been reported or has attack records. This group says the most about what the address has actually done.
Registros de denuncias
- What it checks
- Whether anyone has reported this IP to a public abuse reporting platform, whether new reports are still arriving and how many reporters there are.
- If there is a record
- Reports are the most direct behaviour evidence. Recent reports from several unrelated reporters are unlikely to be false, and platforms tighten noticeably.
- What to do
- On your own server, check whether it was compromised or abused by someone else. For a purchased line with many recent reports, replace it. Records fade once reports stop.
Confianza de abuso
- What it checks
- How confident the reporting platform is that this IP is really being abused, based on the number and age of reports and how trustworthy the reporters are.
- If there is a record
- A high score means reports are both numerous and recent. Many server firewalls set their block threshold directly on this score.
- What to do
- The score falls after reports stop. If you need a faster recovery, fix the problem and then ask the reporting platform for a review.
Ataques a cuentas
- What it checks
- Whether this IP has records of credential stuffing, password guessing or bulk account registration.
- If there is a record
- Login and sign-up are the most heavily defended steps. An address with these records meets more CAPTCHAs and SMS checks, and new accounts are more likely to be linked and banned.
- What to do
- Do not sign up or log in to important accounts through this exit. If it is your own device, check it for malware.
Inteligencia de ataques
- What it checks
- Whether threat intelligence links this IP to specific attack activity: a known attacker, a botnet command server, malware delivery or a denial-of-service node.
- If there is a record
- This is the most serious kind of record on the card. Security products block it outright, and platforms treat accounts on the same exit as high risk.
- What to do
- Treat your own server as compromised right away: disconnect it, investigate and reinstall the system. Replace a purchased line.
Amenazas locales
- What it checks
- Whether this site itself recently observed attacks or scanning from this IP.
- If there is a record
- This is a first-hand record that depends on no third party, and shows the address is still sending malicious traffic.
- What to do
- Check the device for a running scanner. After the behaviour stops, the record disappears once the observation window ends.
Comprometido
- What it checks
- Whether there are signs that the device behind this IP has been compromised and joined a botnet or proxy network.
- If there is a record
- Others use the device without the owner knowing, and all the malicious traffic counts against this address. Avoid it for accounts and payments.
- What to do
- Update the firmware of routers, cameras and similar devices, change default passwords and run a full scan on computers. On a dynamic address the record may come from the previous user.