# What is an IP address threat level

An IP address threat level is ClickGuard's rating of how risky an IP address is. ClickGuard checks each IP against anti-fraud, geolocation and blacklist services to learn whether it's an anonymous proxy, a known attacker or another source of fraud, and uses the result to decide which sources to block.

Source: https://www.clickguard.com/help/glossary/what-is-ip-address-threat-level
Published: 2026-04-18
Updated: 2026-04-18
Author: Nikola Pejic

ClickGuard analyzes many aspects of an IP address in order to assess if an IP address is a known threat. This includes fetching IP information from various anti-fraud, geo-location, and blacklist services.

That means ClickGuard is able to learn if an IP address is:

-   an **anonymous proxy** (exit address for anonymizing services such as HTTP/Socks proxies, VPNs, or Tor)
-   a **fake crawler** (Suspicious web scraper impersonating popular and legitimate crawlers)
-   a **port scanner** (port scanning as in a common way to search for exploitable security vulnerabilities in running network services)
-   an **attack source** (a known source of various cyber attacks), including the type of the attack (web, mail, SSH, FTP, SIP, etc.)
-   **hosting a bot** (part of a malicious botnet), including botnet type (bad, brute force, scan, spam, referrer spam, etc.)
-   **blacklisted** for any other fraud or abuse-related reason  
      
    

By cross-referencing the information about an IP address across multiple services ClickGuard is able to determine the threat level and classify it as:  

-   **low** - the default for IP addresses not associated with bad behavior
-   **medium** - high probability for unwanted ad clicks
-   **high** - high probability for abusive, disruptive, and fraudulent ad clicks

See also: [How ClickGuard detects VPN, proxy, and Tor traffic](https://www.clickguard.com/help/faq/how-clickguard-detects-vpn-proxy-tor).

## Related articles

- [How ClickGuard detects VPN, proxy, and Tor traffic](https://www.clickguard.com/help/faq/how-clickguard-detects-vpn-proxy-tor.md)