Predictive classification and community reports are different evidence classes.

How do a prediction and a community report differ?

A prediction interprets characteristics; a report records what a submitter says occurred. This guide contrasts those evidence classes, not live outputs from the named vendors. Read scope and date separately instead of averaging unlike signals.

Source availability depends on the current deployment and each returned record. These review dates do not establish when a particular IP was observed. Method axis-scope-2026-09-15 · Score ipjury-score-v3.

People line up a predictive IP classifier next to a community abuse database and ask which is right. The question does not resolve: the two produce different classes of evidence, and disagreement between them is frequently the expected result rather than an error.

This guide describes the two evidence classes generically. IPQS and AbuseIPDB are examples in the title, not live integrations in this checker. This page does not run either service for your address or certify its output, and it does not reproduce their internal methods.

What each class measures

Predictive classification

Infers characteristics — hosting, proxy, VPN, bot likelihood, fraud propensity — from infrastructure attributes and historical patterns. It is generated by the vendor, may classify an address without a direct event record for it, and refreshes on the vendor's schedule. It answers: what does this address look like right now?

Community abuse reporting

Collects submissions from operators who saw traffic they considered abusive, usually with a category and a timestamp. It exists only where someone chose to report, is written by independent parties applying their own standards, and accumulates rather than being recomputed. It answers: has anyone said this address did something, and when?

How each one fails

Both classes have characteristic failure modes, and knowing them is most of the skill in reading either.

• Prediction over-applies its priors. A classifier may apply a network prior when it has no direct observation. Its coverage and fallback behavior must be read from the particular product’s documentation. Datacenter space and carrier-grade NAT are where this hurts most: a virtual machine running a personal service, and a mobile exit shared by thousands, both sit in ranges whose aggregate behaviour looks nothing like theirs.
• Prediction may not expose all its inputs. Inspect the explanation actually provided rather than assuming either full transparency or complete opacity.
• Reports carry reporter bias. Reporting depends on who runs detection and who bothers to submit. Addresses touching many monitored servers accumulate reports; identical behaviour aimed at unmonitored targets accumulates none. Volume measures exposure as much as conduct.
• Reports go stale. Addresses change hands. A report describes a moment, and unless it decays or is reviewed it keeps describing an occupant who may be long gone.
• Reports are often unverifiable. A submission is an assertion. A submitted category is not independent verification. Look for supporting detail and collection limits rather than assuming a report proves who caused an event.
• Absence proves little in either. No flag and no reports mean the two systems hold nothing — a statement about their coverage, not about the address.

Why averaging them destroys information

Combine a predictive flag with a report count and the output can no longer separate four situations calling for four responses: an address that only looks unusual, one that only has history, one with both, one with neither. The average also inherits both failure modes at once, so a hosting address with a stale report becomes indistinguishable from a consumer address with a recent corroborated one. The compression is irreversible; nothing downstream can recover which input moved the result.

How to read both together

Keep them on separate lines and ask separate questions. From the classification: what type is asserted, and is it driven by anything more specific than the network the address lives in? From the reports: how many, from how many distinct reporters, in what categories, how recent — and do they concern the exact address or its neighbours? Even agreement needs compatible scope and independent evidence; duplicated or unrelated signals do not establish corroboration. Where they conflict, the conflict is the finding, and usually points at which assumption is doing the work.

For the mechanisms behind those conflicts, see why IP scores disagree.