IP Reputation Scoring Explained: Feeds and Corroboration
IP reputation scoring is the practice of combining evidence from several threat-intelligence sources into a single score that estimates how likely an IP address is to be involved in abuse such as spam, scanning, credential stuffing or malware delivery.
The score is a summary, not a verdict. Understanding what goes into it, and where it is weak, is what lets you set sensible thresholds and avoid blocking legitimate customers. This article walks through the inputs, why corroboration matters, and how to turn a score into an action.
Why a single blocklist hit is a weak signal
Blocklists are built from different observations: spam traps, honeypots, abuse reports, scanning telemetry, botnet command-and-control tracking. Each has its own blind spots. A list built from spam-trap hits says nothing about port scanning, and a list built from honeypot connections may include shared addresses that were used for a short time by a bad actor and later reassigned to an innocent customer.
Addresses are also recycled. Cloud instances, mobile carrier gateways and carrier-grade NAT mean that one public address can front thousands of users, and one infected device behind it can taint the address for everybody. Listings may persist after cleanup because list maintainers expire entries on their own schedule. If you reject traffic purely because one list contains the address, you will block real people and you will not know how often.
That is the reason a score built from several independent sources is more useful than a boolean from one. See why corroboration improves blacklist accuracy for the longer argument.
Corroboration, weighting and recency
Corroboration means requiring or rewarding agreement between sources that observe different things. If an address shows up in a feed of known scanners and also in a feed of reported abusive sources, the combined evidence is stronger than either alone because the failure modes of the two are unlikely to coincide. Good scoring systems reflect that in three ways.
- Source diversity. Two lists derived from the same upstream data are one opinion counted twice. Independent sources count for more.
- Severity. A listing for active attacks is weighted above one for being a generic anonymising service. Different kinds of evidence belong to different risk categories.
- Recency. Evidence ages. A feed that refreshes every few hours reflects the present better than a static file, and a good policy lets old observations fade.
Scores are usually banded into tiers such as low, medium, high and critical, which map more naturally onto actions than a raw number does. The numeric scale is only meaningful inside one system, so never compare a score from one provider against another's without calibrating on your own data.
What ipto exposes
ipto's abuse checker reports how an address is regarded across threat-intelligence sources and condenses that into an abuse score and a risk tier, based on corroboration across several feeds and not on any single list. The same signal appears in the IP lookup as the is_abuser flag, alongside is_vpn, is_tor and is_datacenter. Threat feeds refresh every 6 hours, and the IP and ASN datasets refresh daily. You can try the IP abuse checker with any address, browse the underlying live threat feeds, or see which networks score worst on the abusive networks page.
Two limits are worth stating. First, ipto does not detect residential proxies, so traffic routed through consumer devices will not carry a proxy flag. Second, a reputation score describes an address, not the person using it. A clean score does not mean a visitor is trustworthy, which is why the fraud score checker combines the IP signal with email, phone and User-Agent evidence into a single 0 to 100 score with a visible breakdown.
Turning a score into a decision
The most common mistake is treating reputation as a block/allow switch. A better policy has graduated responses:
- Low risk: allow normally.
- Elevated risk: add friction that costs honest users little, such as a challenge, email verification or a lower rate limit.
- High or critical risk: block on sensitive actions like payment or account creation, but consider allowing read-only browsing.
Pair the score with context. A flagged address that sits in a hosting provider's network (check the owner with the ASN lookup) behaves differently from a flagged address in a residential ISP range, where the likelier explanation is a single infected device or a shared gateway. Log the score and your decision for each blocked request, review a sample regularly for false positives, and tune the thresholds using real outcomes such as chargebacks and support complaints instead of intuition.
Finally, give legitimate users a way out. A contact path or a manual review option for blocked sign-ups turns a false positive from a lost customer into a recoverable event.