What is an IP reputation score?
An IP reputation score is a risk rating that security systems, email providers, and web services use to determine whether an IP address is trustworthy or likely to be a source of abuse.
Factors that influence IP reputation
Download CSV| Factor | What it measures | Impact on score | Data source |
|---|---|---|---|
| Spam activity | How much email spam is coming from it | Very high | DNSBL / reputation feeds |
| Malware traffic | Command & control servers or hosting malware | Very high | Threat intel feeds |
| Open ports | Services that are exposed | Medium | Port scans |
| Proxy / VPN usage | Signs of anonymization | Medium | Heuristics |
| Shared hosting | Multiple users on the same IP | Low-Medium | ASN analysis |
| IP age | Recently assigned IP addresses | Medium | RIR data |
| User reports | Complaints from actual people | Medium | Abuse desks |
| Blacklist listings | On active blocklists | High | Blacklist aggregation |
| Traffic patterns | How often requests come in | Medium | Behavioral models |
IP reputation vs IP blacklists
- Blacklists are straightforward-you're either on it or you're not.
- Reputation scores give you a sliding scale of risk.
- An IP can have a bad reputation even if it's not on any blacklist.
How reputation scores are used
- Email filtering and making sure your mail gets delivered
- Catching fraud and stopping bots
- Throttling requests and controlling who gets access