Abusive Networks: How Ranges Are Scored and Tiered
Abusive networks are blocks of IP address space, usually expressed as CIDR ranges, that independent threat-intelligence sources flag as hosting spam, malware, botnet or exploitation infrastructure, and ipto ranks them by how strongly those sources agree. Instead of a flat blocklist, each range gets a 1 to 10 score and a risk tier, so you can decide how aggressively to act on it.
What counts as an abusive network
A single misbehaving address is an incident. A whole range that keeps showing up in threat feeds is a pattern, and the pattern is usually more useful to a defender than any one address because attackers rotate through addresses faster than feeds can list them. The abusive networks page tracks ranges rather than hosts for that reason. An entry such as a /24 means all 256 addresses in that subnet are implicated: the block is allocated to, or actively used by, hostile infrastructure, not just one flagged host inside an otherwise clean allocation.
The data is rebuilt from public sources on a six-hour cycle, the same cadence as the other threat feeds. The ranges currently come from three inputs: the IPsum aggregated threat list, Spamhaus DROP and Spamhaus EDROP. Each of those is itself a combination of other signals, which is why ipto treats agreement between them as the thing worth scoring. The page can be searched by subnet, filtered by tier or by source feed, and paged 200 entries at a time. The same data is available as JSON from /v1/abuse with tier, source, q and page query parameters.
How scores and tiers are assigned
Scoring is deliberately simple to audit. IPsum publishes, for each address, the number of independent blocklists that include it. ipto only keeps addresses listed by at least 3 lists, and the score is that count, capped at 10. Spamhaus DROP entries start at 10 because they cover space that is hijacked or run by criminal operators, and EDROP entries start at 9. When the same range appears in more than one source, the highest score wins, so a Spamhaus listing always outranks an IPsum count for that range.
The tier is derived directly from the score:
- Critical (8 to 10): the highest-confidence group. These are typically blocks run by criminal infrastructure operators or hijacked space being actively misused, with spam, malware delivery or credential harvesting expected.
- High (5 to 7): flagged hostile across multiple feeds without necessarily being organized criminal infrastructure. Bulletproof hosting customers and spam-friendly ISPs fall here.
- Medium (3 to 4): flagged by several feeds but with lower corroboration. This is where shared hosting environments and blocks with historical abuse that may have changed hands tend to appear.
Use the tier for broad policy and the raw score when you need to rank a long list. Because the score is capped at 10, a range cannot become more critical by appearing on yet another list, which keeps the scale stable over time.
Range-level versus single-IP blocking decisions
Single-address checks answer a narrow question: is this specific IP flagged right now? The IP abuse checker and the abuse_score field returned by the IP lookup do that, using the same ranges, and the score travels with the range so no second query is needed. Range-level data answers a different question: should anything from this neighborhood of the internet be trusted?
A reasonable policy ladder is:
- Critical ranges: drop at the perimeter, or reject SMTP connections before content analysis, since no message-level scoring rehabilitates a sender in a hostile block.
- High ranges: apply strict rate limits or a CAPTCHA to login and API traffic, where credential stuffing and scraping tools commonly operate.
- Medium ranges: log and step up verification instead of blocking outright.
- Any tier: when a SIEM alert fires on an address inside a Critical range, escalate it automatically because the surrounding context changes the priority.
Combine the range signal with network context from the ASN lookup. If three flagged ranges all belong to the same autonomous system, the decision may belong at the ASN level, and the lookup shows the owner, country and announced ranges.
Caveats on shared networks
Range blocking has a collateral cost. A shared hosting or cloud allocation can contain one abusive tenant and hundreds of legitimate ones, and a block applied to the whole prefix hits all of them. That is why Medium-tier entries deserve review before any blanket policy, especially on consumer-facing services where an over-block means a lost customer. Ranges also change hands: a block listed for old abuse may now belong to a clean owner, and the six-hour refresh only helps as fast as the upstream feeds update.
Another limit is coverage. The ranges are IPv4 CIDR blocks and single addresses from the three sources above; they do not cover every hostile network, and a clean result is not a guarantee of trust. ipto also does not detect residential proxies, so traffic relayed through home connections will not show up here. Treat the tier as one input alongside VPN, Tor and datacenter flags, which you can browse on the threat feeds page. For background on why agreement between sources matters, see the post on blacklist corroboration.
Trying it on ipto
Open the abusive networks page and filter by Critical to see the worst ranges, or search a prefix you already suspect. From code, call GET /v1/abuse?tier=critical&page=0 and cache the response, which is served with a five-minute cache lifetime. Per-address lookups with abuse_score and is_abuser are free with no signup, up to 1,000 requests per day.