Scamalytics: How IP Fraud Scoring Works and Why Your Website Needs It

How this IP fraud detection tool works, why it matters for web developers, and how to integrate it into your PHP projects to block scammers in real time.

If you run a website — whether it’s an e-commerce store, a membership platform, or a network of content sites — you’re a target for fraud. Bots, fake signups, scraping, ad fraud, spam comments: the threats are constant. Scamalytics is a fraud detection platform that assigns a risk score to every IP address, helping you identify and block suspicious traffic before it causes damage.

In this guide, we’ll break down how Scamalytics works, what its fraud score actually measures, and — most importantly — how web developers can integrate it into their stack using the API. If you manage websites and care about traffic quality, this tool deserves your attention.

What Is Scamalytics?

Scamalytics is a UK-based security company founded in 2011, originally built to fight romance scams on dating platforms. Over the years, it has evolved into a full IP fraud detection service used across banking, payments, classifieds, e-commerce, and content publishing.

The core product is simple: you submit an IP address, and Scamalytics returns a fraud score from 0 to 100 along with rich metadata. A score of 0 means very low risk; a score close to 100 signals highly suspicious activity. The platform combines data from multiple sources — geolocation databases, proxy/VPN detection, blacklists, and machine learning models — to generate this score.

What Scamalytics Detects

Detection	What It Means
Fraud Score (0-100)	Overall risk level based on aggregated signals and machine learning
Proxy / VPN Detection	Identifies IPs using proxies, VPNs, or Tor exit nodes to mask identity
Geolocation Data	Country, city, ISP, ASN — flags mismatched locations that indicate fraud
Blacklist Status	Checks against Spamhaus, Firehol, and other known fraud databases
Connection Type	Distinguishes residential, mobile, data center, and hosting provider IPs
Bot Detection	Identifies automated traffic, scrapers, and credential-stuffing attacks

Why Scamalytics Matters for Web Developers

If you’re a developer managing websites — especially multi-site networks — you already know that bad traffic costs money. It inflates server costs, skews analytics, pollutes databases with fake data, and can tank your SEO if Google detects spammy behavior on your site.

Scamalytics gives you a programmable layer of defense. Unlike passive security plugins that only block known IPs from static lists, Scamalytics uses real-time scoring based on live data. This makes it far more effective against evolving threats.

Concrete Use Cases for Site Owners

• • Block fake signups — Check the IP at registration and reject or flag scores above a threshold (e.g., 50+).

• • Protect comment sections — Automatically moderate or hide comments from high-risk IPs instead of relying solely on CAPTCHA.

• • Filter ad fraud — If you monetize with ads, fraudulent traffic can get your accounts banned. Scamalytics helps you clean your traffic before it becomes a problem.

• • Defend APIs — Rate-limit or block API calls from data center IPs and known bot networks.

• • Improve analytics accuracy — Filter out bot traffic at the server level for cleaner data in Google Analytics and Search Console.

How the Scamalytics API Works

The API is a straightforward REST endpoint. You send a GET request with the IP address, and you receive a JSON response with the fraud score and all associated metadata. Here’s the basic structure:

GET https://api11.scamalytics.com/v3/{username}?key={api_key}&ip={ip_address}

The JSON response includes the fraud score, risk level, geolocation, ISP, proxy type, VPN status, Tor detection, and blacklist flags. Everything you need to make an automated decision.

PHP Integration Example

Here’s a practical example of how you might integrate Scamalytics into a PHP backend to check visitors on registration or login:

<?php
function checkScamalytics(string $ip): array {
    $username = 'your_username';
    $apiKey   = 'your_api_key';
    
    $url = "https://api11.scamalytics.com/v3/{$username}?"
         . http_build_query(['key' => $apiKey, 'ip' => $ip]);
    
    $ch = curl_init($url);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 5,
        CURLOPT_SSL_VERIFYPEER => true,
    ]);
    
    $response = curl_exec($ch);
    curl_close($ch);
    
    return json_decode($response, true) ?? [];
}

// Usage: check visitor IP at registration
$ip     = $_SERVER['REMOTE_ADDR'];
$result = checkScamalytics($ip);
$score  = $result['score'] ?? 0;

if ($score >= 70) {
    // High risk — block or flag for manual review
    error_log("Blocked high-risk IP: {$ip} (score: {$score})");
    http_response_code(403);
    exit('Access denied.');
}

if ($score >= 40) {
    // Medium risk — add CAPTCHA or extra verification
    $_SESSION['require_captcha'] = true;
}

// Score < 40 — proceed normally
?>

Scamalytics Pricing: What You Get for Free

Scamalytics offers a generous free tier that’s more than enough for small to medium sites:

Plan	Monthly Lookups	Price
Free	5,000	$0/month
Starter	25,000	From $25/month
Business	100,000+	Custom pricing
Self-hosted MMDB	Unlimited	Flat fee (contact sales)

With smart caching (one lookup per unique IP per 24h), 5,000 free requests can easily cover a site with 50,000+ monthly visits. For larger networks, the self-hosted MMDB option is interesting: you host a local copy of their IP risk database, which means unlimited lookups with zero latency and no data leaving your server — a strong point for GDPR compliance.

Scamalytics vs. Alternatives: How It Compares

Feature	Scamalytics	IPQualityScore	MaxMind minFraud
IP Fraud Scoring	✅ 0-100	✅ 0-100	✅ 0.01-99
Free Tier	5,000/month	5,000/month	None (paid only)
VPN/Proxy Detection	✅	✅	✅
Self-Hosted Database	✅ (MMDB)	❌	✅ (GeoIP)
Dating/Social Focus	✅ Strongest	Moderate	Minimal
API Simplicity	Very simple REST	REST + SDK	REST + SDK
GDPR Self-Host	✅	❌	✅

Scamalytics stands out for its simplicity, generous free tier, and self-hosted option. IPQualityScore offers more features for complex use cases (email verification, phone scoring), while MaxMind minFraud is better suited for transaction-level fraud in e-commerce. For most web publishers and PHP developers, Scamalytics hits the best balance of ease, cost, and effectiveness.

SEO Impact: Why Fraud Detection Protects Your Rankings

Here’s an angle most articles about Scamalytics miss entirely: bad traffic can hurt your SEO. Here’s how:

• • Inflated crawl budget waste — Bots that hit thousands of pages consume crawl budget that Google should be spending on your real content.

• • Engagement signal pollution — Bot traffic with 0-second sessions and 100% bounce rates can drag down your site’s behavioral signals.

• • Spam content injection — Automated signups and spam comments create low-quality pages that Google may index, diluting your site’s authority.

• • Ad revenue risk — If you rely on Google AdSense or similar networks, invalid traffic can trigger account reviews or bans.

• • Google Discover eligibility — Sites with visible spam or bot-generated content are less likely to appear in Discover feeds.

By integrating Scamalytics at the server level (before the page even renders), you ensure that only legitimate traffic interacts with your site. This keeps your Core Web Vitals clean, your analytics accurate, and your content eligible for high-value Google surfaces like Discover and News.

Practical Architecture: Scamalytics in a Multi-Site Setup

If you manage a network of sites (multi-thematic publishing, for example), you can centralize Scamalytics checks in a shared middleware layer:

1. 1. Centralized API gateway — Build a lightweight PHP service that all your sites call to check IPs. It handles caching (MySQL or Redis) and API key management in one place.

1. 1. Score-based routing — Score 0-30: normal access. Score 30-60: serve a CAPTCHA challenge. Score 60+: block or redirect to a honeypot page.

1. 1. Logging and analytics — Store every check result in a MySQL table. Over time, you build your own fraud intelligence dashboard — which IPs hit which sites, what patterns emerge, and how much bot traffic you’re actually filtering.

1. 1. WordPress integration — Use a mu-plugin that fires on init to check the visitor’s IP via your centralized gateway. No need for a heavy plugin — 30 lines of PHP is enough.

Limitations to Keep in Mind

Scamalytics is a powerful tool, but no fraud detection system is perfect. Some hosting providers have criticized the platform for flagging entire IP ranges as high-risk, which can generate false positives. Legitimate users behind shared VPNs (corporate networks, privacy-conscious individuals) may also receive elevated scores.

The best approach is to use Scamalytics as one signal among several — not as an absolute gatekeeper. Combine it with behavioral analysis (time on site, mouse movements), CAPTCHA challenges for medium-risk scores, and manual review for edge cases. A tiered response system (as shown in the PHP example above) is always safer than a hard block.

Frequently Asked Questions About Scamalytics

Is Scamalytics free to use?

Yes. Scamalytics offers a free tier with 5,000 API lookups per month. You can also use the web-based IP checker on scamalytics.com at no cost for manual checks. Paid plans start at $25/month for higher volumes.

What does a Scamalytics fraud score mean?

The fraud score ranges from 0 (very low risk) to 100 (very high risk). It’s calculated using geolocation data, proxy/VPN detection, blacklist checks, and machine learning models. A score above 50 generally warrants extra scrutiny.

Can I integrate Scamalytics with WordPress?

Yes. There’s no official plugin, but integration is straightforward via a mu-plugin or functions.php hook. A simple PHP function that calls the API on the init action is enough to check visitor IPs in real time.

Does Scamalytics detect VPNs and proxies?

Yes. Scamalytics detects VPNs, public proxies, Tor exit nodes, and web-based anonymizers. The API response includes the specific proxy type detected, allowing you to make nuanced decisions.

Is Scamalytics GDPR-compliant?

The self-hosted MMDB option is the most GDPR-friendly: your server reads the database locally, and no IP data is sent to Scamalytics. For the API version, IP addresses are transmitted to their servers, so you’ll need appropriate disclosures in your privacy policy.

How does Scamalytics compare to Cloudflare’s bot protection?

They serve different layers. Cloudflare operates at the CDN/edge level and blocks traffic before it reaches your server. Scamalytics works at the application level, giving you granular, score-based decisions within your code. They complement each other well — Cloudflare as the first wall, Scamalytics for surgical precision inside your app.

Final Thoughts

Scamalytics fills a gap that most web developers don’t realize exists until it’s too late: the space between passive firewall rules and full-blown enterprise fraud systems. It’s simple to integrate, generous on pricing, and powerful enough to make a real difference in traffic quality — which directly impacts your SEO, your revenue, and your server performance.

If you’re running PHP-based sites and want a practical, developer-friendly fraud detection layer, Scamalytics is one of the best tools to add to your stack in 2026.

---

Want to protect your sites from fraud? Start with the free Scamalytics IP checker, then integrate the API into your PHP backend for automated protection.