Most Abusive Networks

Network ranges in this database are not just individual bad actors — they are entire IP blocks whose operators have a documented track record of hosting spam infrastructure, malware command-and-control servers, botnet relay nodes, or mass-exploitation tooling. These are not single compromised hosts; they are network allocations that appear consistently across multiple independent threat feeds with no legitimate traffic pattern to offset them.

Scores are derived from cross-feed corroboration: the more independent sources that flag a network, the higher the score. A block that appears in one feed may be noise. A block that appears in five unrelated feeds is almost certainly hostile. ipto's scoring engine deduplicates overlapping ranges and assigns the highest-confidence score when multiple feeds cover the same network.

How scores work

Score range

1 to 10. The score represents the confidence level that the network range is malicious, derived from how many independent threat sources flag it and which categories of threats they report. Higher scores come from higher-authority sources or broader multi-feed agreement.

Score 8 – 10
Critical

Highest-confidence threat. These blocks are typically registered to criminal infrastructure operators, reported by authoritative routing security organizations, or represent hijacked IP space being actively misused. Expect spam, malware delivery, credential harvesting, or coordinated exploitation.

Score 5 – 7
High Risk

Confirmed hostile across multiple feeds but not necessarily part of organized criminal infrastructure. Commonly includes bulletproof hosting customers, spam ISPs that knowingly host abusive tenants, and bot herders operating from residential proxies or datacenter blocks.

Score 3 – 4
Medium

Flagged by multiple feeds but with lower corroboration. May include shared hosting environments where a small number of abusive tenants contaminate a larger allocation, or blocks with historical abuse that may have since changed hands.

Column definitions

Network Range

IPv4 CIDR block identified as abusive. A /24 entry means all 256 addresses in that subnet are implicated — the block is allocated to or actively used by hostile infrastructure, not individual flagged hosts within a clean range.

Score

1–10 severity score reflecting cross-feed corroboration depth. Scores are capped at 10 regardless of how many feeds agree, to keep the scale consistent.

Risk Level

Tier derived directly from score: Critical (8–10), High Risk (5–7), Medium (3–4). Use tiers for broad policy decisions; use the raw score when you need fine-grained ranking.

Use cases

Firewall rules

Block inbound connections from Critical and High Risk ranges at the network perimeter. These blocks have no plausible legitimate use case for reaching most production services.

Email filtering

Reject SMTP connections originating from abusive network ranges before content analysis. If the sending IP is in a Critical-tier block, no amount of content scoring will rehabilitate it.

API rate limiting

Apply aggressive rate limits or CAPTCHA challenges to API requests from High and Critical blocks. Credential stuffing and scraping tooling commonly operates from these ranges.

Threat intelligence enrichment

Cross-reference against your own SIEM/SOAR events. When an alert IP falls within a Critical network range, escalate automatically — the infrastructure context changes the response priority.

False positive consideration: a small number of shared hosting providers appear in Medium-tier entries because abusive tenants contaminate otherwise legitimate ASNs. Review Medium-tier blocks before applying blanket policies, particularly for consumer-facing services where over-blocking has user impact.