Two IP addresses can both arrive "flagged as a proxy." One was observed relaying traffic once, three weeks ago. The other has been observed daily, through this morning, behaving exactly like known proxy infrastructure. A score that cannot express that difference is not telling you much — and an IP confidence score exists precisely to express it.
What is an IP confidence score?
An IP confidence score expresses how certain a data provider is that an IP address's classification — proxy, and which network type — is currently correct, based on the strength of the evidence behind the observation.
Confidence is a property of evidence, not of the IP itself. In Solarflare's dataset, every record carries a confidence value of low, medium, or high, and the value compresses three specific inputs: how many independent observations support the signal, how recent those observations are, and how cleanly the address's behavior matches known proxy infrastructure patterns. An IP seen relaying traffic repeatedly, recently, and in a pattern typical of proxy networks earns high confidence. An IP seen once, a while ago, with an ambiguous behavioral fit stays low. Nothing about the score says the IP is dangerous — it says the label is well-supported. That framing matters because everything you do downstream, from blocking to step-up verification, should scale with how sure the data is, not just with what the data says.
Confidence score vs. fraud score: what's the difference?
Most of what the industry calls an "IP fraud score" or "IP risk score" answers a different question. A confidence score answers: how sure are we of the label? A fraud or risk score answers: how bad is this actor? The two get conflated constantly — usually into a single 0–100 number — which is a large part of why practitioners observe that no two vendors' scores mean the same thing.
| Confidence score | Fraud / risk score | |
|---|---|---|
| Question answered | How certain is this classification? | How risky is this actor or event? |
| Underlying evidence | Observations of the IP itself: count, recency, behavioral match | Blend of signals: IP, device, velocity, history, business context |
| Who sets thresholds | The data provider, from observation strength | Your risk team, from business tolerance |
| Failure mode when misread | Treating a weakly-evidenced label as fact | Inheriting a vendor's risk appetite as your own |
The practical consequence: a confidence score is an input to your risk decision, not a substitute for one. Your rules decide how much risk a signup or payment can carry; confidence tells you how much weight the proxy signal deserves inside that decision.
What evidence feeds a confidence score?
Observation count
How many times has the address been seen operating as a proxy? Continuous active network testing interacts with proxy networks and records which exit IPs actually relay traffic. One sighting could be noise — a device that briefly joined a pool, an ambiguous interaction. A persistent pattern of independent observations is a different class of evidence, and the score should reflect that.
Recency
When was the address last seen relaying? Proxy assignments rotate: devices leave pools, ISPs reassign addresses, operators cycle their exits. Evidence therefore decays — an observation from this week supports a strong claim about the present; one from months ago supports a weak one. This is the same reason the dataset carries first_seen and last_seen on every record, and it is the heart of the static IP database vs real-time data distinction.
Behavioral-pattern match
Does the observed behavior actually look like proxy infrastructure — the relaying patterns known proxy networks produce — or merely like an anomaly? An address can do something odd once without being part of a proxy pool. Requiring a clean behavioral match before granting high confidence is what keeps one-off oddities from being labeled with certainty they haven't earned.
Why low/medium/high instead of a number?
Categorical bands map cleanly to actions and refuse false precision. A three-level score admits what the evidence can actually distinguish: weak, moderate, strong. A 0–100 scale implies the data can meaningfully separate a 73 from a 78 — a distinction that almost never justifies different treatment and that invites teams to burn tuning time on thresholds the underlying evidence cannot support. Low vs. high, by contrast, always justifies different treatment. Fraud rules are threshold machines; giving them values that were designed as thresholds — rather than making every consumer invent their own cut-points over a continuous scale — moves the calibration burden from every customer to the party that actually holds the evidence.
What should you do at each confidence level?
| Confidence | Action | Rationale |
|---|---|---|
| High | Hard block or hold | Evidence is dense, recent, and behaviorally clean — strong enough to act on directly |
| Medium | Combine with other signals; add friction or route to review | Meaningful evidence, short of certainty — context decides |
| Low | Step-up verification — never a hard block | Evidence exists but is thin or stale — challenge, don't wall off |
The mapping's logic is symmetric and worth internalizing as a whole. High confidence means many recent, independent observations with a clean behavioral match — the label is well-supported, so a hard block spends almost no false-positive budget. Low confidence means the label rests on thin or aging evidence, so the right response is one a legitimate user can survive: an email, SMS, or 2FA challenge that costs a real customer thirty seconds and costs a credential-stuffing operation its economics. Medium sits between, which is exactly when corroborating signals — network type, velocity, account history — should tip the decision. The rule of thumb: spend friction in proportion to evidence, and reserve irreversible actions for well-evidenced labels. Teams applying this to login and signup flows will find the worked version in using confidence scores in account-takeover workflows.
How do confidence and network type interact?
Borderline residential IPs are the hard case: the weakest evidence meets the highest false-positive stakes, because a wrong call lands on someone's home connection. This intersection is where scoring systems earn their keep — and where they need maintenance. Solarflare's own changelog records a concrete example: the v0.7 release retuned confidence thresholds specifically to reduce false positives on borderline residential IPs, while keeping high-confidence responses stable for teams using hard-block rules. Thresholds are not set-and-forget; the population of residential, datacenter, and mobile proxies shifts, and the scoring that classifies it has to shift with it. The operator's side of this problem — measuring and reducing proxy detection false positives — has its own guide.
What a confidence score can't tell you
- Which proxy provider an IP belongs to. The useful signal is that an address has been observed behaving as proxy infrastructure — provider attribution is deliberately not part of the product.
- Whether the user is a fraudster. Proxy use is a risk signal, not proof of intent — corporate gateways and privacy VPNs produce innocent proxy traffic every day.
- Anything beyond its freshness. Confidence is only as good as the recency of the observations behind it, which is why it travels with last_seen rather than replacing it.
For the umbrella picture — where confidence fits among network types, detection methods, and response design — start with the proxy detection guide.
Confidence is what makes IP data actionable
A proxy flag without confidence semantics forces you to hedge every decision; a flag with them lets you write rules that are aggressive exactly where the evidence is strong. That is the difference between data you can act on and data you have to second-guess. The pricing FAQ covers the scoring semantics in more detail, and a sample dataset is the fastest way to see the low/medium/high distribution against your own traffic.
Frequently asked questions
- Is a high confidence score the same as a high fraud score?
- No. High confidence means the proxy classification is well-evidenced — many recent observations with a clean behavioral match. A fraud score expresses how risky an actor or event is. An IP can be a confidently-classified proxy carrying low business risk, and vice versa.
- Why would an IP's confidence change over time?
- Because the evidence changes. New observations strengthen the signal; silence weakens it as recency decays; and the address itself can leave a proxy pool or be reassigned. Confidence tracks the current strength of evidence, not a permanent verdict.
- Should I block every IP flagged as a proxy?
- No. Block on high confidence, challenge on low, and let context decide medium. Blanket blocking ignores evidence strength and guarantees false positives on shared and recycled addresses — especially mobile ranges behind CGNAT.