What is IP reputation?
IP reputation is a collection of security and network classifications associated with an address or the infrastructure around it. Depending on the provider, signals can include known malicious activity, VPN or proxy use, Tor infrastructure, hosting/datacenter classification, risk scores and descriptive threat categories.
What does a risk score mean?
A numerical risk score is a provider's summary of underlying observations and classifications. It can be useful for sorting or triage, but the number is only meaningful when read together with the evidence. A transparent category such as known VPN infrastructure, bot activity or a recent malicious observation is more informative than an unexplained score alone.
Why can reputation change?
IP addresses are reusable network resources. Residential addresses can move between subscribers, cloud addresses can be reassigned to new customers, and VPN or hosting services can rotate infrastructure. Threat feeds also update on different schedules. A classification that was reasonable yesterday can become stale.
Why do reputation providers disagree?
Providers have different visibility, data partners, detection rules and thresholds. One feed may observe spam while another focuses on brute force, phishing or proxy infrastructure. Differences do not automatically mean one provider is wrong; they can reflect different evidence and timing.
How should reputation be used?
For routine security work, treat reputation as one input alongside authentication logs, request behavior, ASN/network type, timestamps and application context. For high-impact decisions, avoid relying on one IP flag as the sole basis for blocking, accusing or identifying an individual.
Reputation versus blacklist checks
A reputation report is broader than a single blacklist. The separate threat/blacklist page focuses on malicious categories returned by the configured intelligence source, while this page combines those signals with anonymity and network classifications.