Fraud Score Across a Fleet of US Mobile Proxy Lines

Run ten lines through a fraud-score checker and you will get ten different numbers, some of them alarming. New fleet owners often read this as a problem with specific lines. It is not. The number is a property of how carrier addresses are shared and how checkers build their scores, and it moves on its own as addresses rotate. This article explains where the score comes from, why it varies across a fleet, and the handful of things that are actually worth checking per line.

One address, hundreds of subscribers

A mobile carrier does not give every phone its own public IPv4 address. It puts many subscribers behind one address with carrier-grade NAT, so the address a website sees for your line is at the same moment the address for a crowd of ordinary phones in the same region. That crowd is why websites treat carrier addresses gently: blocking one would block many real customers. It is also why any history attached to that address is the crowd's history, not yours.

When your line rotates, the SIM is handed another address from the same regional pool, and that address has its own crowd and its own history. Nothing you did on the previous address follows the SIM; nothing the previous crowd did follows you. A fleet of ten lines in one metro on one carrier is drawing from the same regional pool, so over a month the ten lines will see overlapping addresses, each with its own score at the time.

How checkers compute a score

Checker sites combine a few signals. They look up the address's owner and type, and a mobile carrier registration pushes the score up because mobile ranges are known to be shared and hard to attribute. They count reports and abuse complaints attached to the address, which for a busy carrier address is never zero. Some add signals like whether the address has recently been seen on many unrelated accounts, which, for an address shared by hundreds of phones, is simply true.

None of those signals describes your line specifically. They describe the category and the crowd. That is why the same address can score high on one checker and moderate on another, and why the score can change within an hour when the crowd behind it changes.

Why ten lines show ten numbers

Each line holds a different address at any moment, drawn from the carrier's regional pool, so each is carrying a different crowd's recent history. A line that rotated five minutes ago may land on an address that has been quiet, and another on one that has been busy. Lines on different carriers draw from different pools with different checker reputations. Lines in different metros draw from different regional pools. Variation across a fleet is the expected result, not a sign that some lines are worse than others.

If you log scores per line over a week, you will see them move independently, and you will see the same address reappear on two lines at different times with different scores. The score belongs to the address at the moment; the line is just holding it.

What the score means for how websites treat you

Large websites do not read third-party checker scores. They run their own risk models, and those models know that mobile ranges are shared crowds, which is why they tend to tolerate a carrier address with behaviour that would get a hosting address challenged. What they do read closely is consistency: does the time zone fit the address, does the account's behaviour fit its history, does the device fingerprint fit the browser. A line with a high checker number and a consistent profile behaves better than a line with a low number and a sloppy profile.

So the lever a team controls is not the number. It is the profile on each line: locale set to the line's metro, one account per profile, one client per line, no sharing of a line across unrelated work.

What is worth checking per line

There are three checks that do tell you something about a specific line, and they take a minute each. The first is the owner: the lookup should show AT&T Mobility (AS20057), T-Mobile USA (AS21928) or Verizon Wireless (AS22394, sometimes AS6167). The second is the state: it should match the line's metro, allowing for the Boston quirk where AT&T reads as New York. The third is the type: it should read mobile or cellular, not hosting or business.

If a line fails one of those, something is wrong and support should hear about it at [email protected] or on the Telegram bot. If a line passes all three but shows a high fraud number, nothing is wrong; that is a carrier address doing what carrier addresses do.

• Owner is the carrier's mobile network, not a hosting company.
• State matches the line's metro (country always United States).
• Connection type reads mobile or cellular.

A fleet-level routine

For a team, the useful routine is to run the three checks when a line is first set up and after any move, and to stop looking at the fraud number altogether. If a platform challenges an account, look at the profile first: locale, fingerprint, behaviour and whether anything else shares the line. Rotating the line gives a fresh address in seconds, which is a fair thing to try, but it is rarely the number that caused the challenge.

Keep notes per line in the dashboard label or your own sheet: carrier, metro, what runs on it. When the fleet is tidy, the fraud number stops being a worry, because every other signal around the line is consistent.

Frequently asked