IP Blacklist Abuse Score and Corroboration
An IP abuse score is a number that summarizes how strongly an address is associated with malicious activity across threat intelligence sources, and corroboration means weighting the score by how many independent feeds agree. An address listed by several unrelated sources is a much stronger signal than one that shows up on a single noisy list.
Why a single blacklist is not enough
Blacklists are built for different purposes and have different failure modes. One list may track spam senders, another botnet command servers, another scanners that probe for open ports. A list may be sensitive and flag too much, or conservative and lag behind. Some entries are stale because the address was reassigned to an innocent customer after the abuse stopped. If you block on any single feed, you inherit its blind spots and its mistakes. If you ignore all of them, you miss real attacks.
Corroboration is the standard answer: treat each feed as a witness and look for agreement. The reasoning is statistical. Independent sources rarely make the same mistake about the same address at the same time, so agreement raises confidence, while a lone listing deserves a lower score and a gentler response. This is also how the country-versus-city point from geolocation carries over to reputation: the more independent evidence supports a claim, the more you can rely on it.
How an IP abuse score is built from feeds
The IP abuse checker reports how an address is regarded across several threat intelligence sources and condenses it into an abuse score and a risk tier. Behind the scenes ipto aggregates public feeds including the IPsum aggregated blocklist and the Spamhaus DROP and EDROP lists. IPsum itself counts how many underlying blocklists mention an address, and ipto only includes addresses that appear on at least three of them, capping the score at 10. Spamhaus DROP and EDROP are curated lists of hijacked or criminal-controlled network ranges, so their entries score at the top of the scale. When the same range appears in more than one feed, the highest score is kept.
Scores map to risk tiers: 8 and above is critical, 5 to 7 is high, and anything lower is medium. The result also shows the network the address belongs to, which matters because abuse is often concentrated in a range or an operator, not a single host. The abusive networks page lists the most abusive ranges, and the threat feeds page shows the live VPN, Tor and high-risk lists, which refresh every 6 hours. In the lookup API, the result carries is_abuser alongside is_vpn, is_tor and is_datacenter.
What the score is not
This is a reputation score, not a mail-server DNS blocklist query, and it should not stand in for one when diagnosing email delivery to a specific receiving provider. It also cannot see behavior that no feed has recorded: a freshly compromised host with no history will score clean. And shared or reassigned addresses can carry the reputation of a previous user. Carrier-grade NAT makes the problem sharper, since one mobile address can serve many unrelated people. ipto does not detect residential proxy networks, so traffic routed through ordinary home connections will not be flagged by these feeds.
Reading disagreement between feeds
Corroboration is as useful when feeds disagree as when they agree. If a range appears in a curated hijack list but nobody else mentions individual hosts inside it, the likely story is an operator problem, not a compromised customer machine, and blocking the range may be right even though no single host has history. If one host appears in an aggregated list with a low count and nowhere else, it may be a short-lived infection that has already been cleaned. Keeping the source feed visible with each score, as the abusive networks listing does, lets an analyst see why a verdict was reached instead of trusting a bare number.
Acting on a score
Match the response to the confidence. For a critical score from a datacenter range hitting your login endpoint, blocking or a hard challenge is reasonable. For a middling score, add friction instead of rejecting: a CAPTCHA, an email confirmation or a lower rate limit. For no score, do nothing special, but do not treat it as a clean bill of health. Record the score with each decision so you can review false positives and tune thresholds.
Combine reputation with other signals before you escalate. The fraud score checker merges IP reputation, disposable-email detection, phone validation and User-Agent classification into a single 0 to 100 score, showing how much each signal contributed. That keeps the result explainable, which matters when a legitimate customer asks why they were challenged. For the related tradeoffs in free feeds, see VPN detection methods compared, and check the API documentation for the response fields. A free key allows 1,000 requests per day with no signup.