IP Reputation Check

What the score does not prove

The score sums reports filed by other operators over the last 90 days. It is evidence of what people said, not of what happened. Four things it does not establish:

• Zero is not clean. Nobody reported it in the window. Freshly rotated infrastructure scores zero by construction, and that is what a targeted campaign uses. An absent report is not a clearance.
• A high score may not be about the host you care about. One address can be thousands of people. Behind carrier-grade NAT, a university edge or a cloud NAT gateway, one compromised machine earns the whole address a reputation and the next request is somebody else. usageType and the mobile flag are the hint.
• Reports are not adjudicated. They are what a reporter's detection concluded. Research scanners, vendor crawlers and mail servers in a backscatter argument all accumulate reports for behaviour that is not an attack on you.
• The flags are inference, not observation. Proxy, hosting and mobile come from ip-api.com classifying the range, so they describe the allocation. "Hosting: true" means a datacentre block — equally true of a VPN exit node, a CI runner and a customer's production server.

"AbuseIPDB not configured" is literal: the report history needs a server-side API key, and without one you get network and flag data only. It is reported rather than hidden, because an empty panel and a reputation of zero are different facts — conflating them is how an unchecked address ends up in a report as clean.

Order a list with it, do not reach a verdict

Reputation is a weighting input. It answers "is there a reason to look harder at this address first?", not "was this connection malicious?" — that depends on what the connection did, which lives in your own logs.

The ASN and organisation are often more informative than the score. An unreported address in a block that exists only to host disposable VPS instances is a different proposition from one in a well-run ISP's residential range, and that judgement needs no report filed first.

When to use something else

For many addresses, or for domains and file hashes too, threat-intel-lookup queries multiple sources and is scriptable. ioc-extractor pulls the addresses out of a log or email, refangs the defanged ones and filters the noise. For who owns the range and when it was allocated, use the WHOIS lookup. For where this fits in working an alert, soc-analyst-workflow puts reputation in its place, and the log-triage-analyst prompt insists on the benign explanation first — the habit a reputation score most often breaks.