What is IP reputation, and how do you check it?

IP reputation is the record of what an IP address has done and what kind of network it belongs to. It builds from confirmed abuse, the connection type, the behavior of neighboring addresses and how recent all of that is. Mail servers, firewalls and signup forms read it before they trust a request. To check it, look the address up in a reputation service and read the record behind the score.

#What builds an IP address's reputation?

• Confirmed abuse. Attacks seen by sensors and reported by others, each with a category such as brute force, scanning or spam.
• Connection type. Data center, home, mobile, VPN, proxy or Tor exit, which tells you what kind of traffic to expect.
• Neighbors. The share of the surrounding /24 that is flagged. A /24 is the block of 256 addresses that share their first three numbers (RFC 4632).
• History. When the address was first and last seen doing harm, and how often.
• Ownership. The network operator, its autonomous system number and its abuse contact.

FFraud's method adds one rule on top: an address joins its public list only after at least two independent confirmations. One report is a claim; two from unrelated sources make a record.

Why neighbors matter

Bad addresses cluster. In FFraud's open data, 75.2 percent of 1,555,562 listed IPv4 addresses share their /24 with at least one other listed address. In 518 of those networks, at least half of the 256 addresses are listed, and in 11 every address is (build of October 23, 2026, 07:30 UTC).

Hosting and proxy space shows the effect clearly. In a random sample of 100 listed hosting, proxy and VPN addresses, the median /24 around them was 88.9 percent flagged (FFraud API, October 23, 2026). A quiet address in a block like that inherits a warning.

#How long does IP reputation last?

There are two schools. The IETF's guidance for DNS blocklists says listings "SHOULD be considered temporary" and should expire on their own unless the reasons for listing still exist (RFC 6471). FFraud keeps a confirmed score when an address goes quiet, because attackers rest their servers between campaigns. It marks recent abuse separately, with a flag that covers the last 30 days.

The sampled addresses were far from quiet. Of the same 100, 86 addresses had been seen within the past day, 97 carried the recent abuse flag, and the median address had been seen 863 times. A record can also outlive its owner: cloud providers return released addresses to a shared pool for the next customer (AWS EC2 docs).

#How do I check the reputation of an IP address?

1. Paste the address into an IP reputation check or an IP blacklist check.
2. Read the record, not only the number: the abuse category, the last time it was seen, the share of its /24 that is flagged, and the owner.
3. For mail delivery problems, also check the DNS blocklists your recipients use and the provider's own tools, such as Google Postmaster Tools.
4. In code, request the same record from an API and store the fields you act on.

Two public addresses show how different records look. The Tor exit is on the Tor Project's own exit list, and the answers come from FFraud's API on October 23, 2026, at 07:59 UTC.

curl https://api.ffraud.com/public/ip/185.220.101.34

The answer carries recent_abuse, subnet_abuse_ratio, the threat tags and the network owner (API reference). Store the fields with the decision, so a later review can see why an address was blocked.

#What is IP reputation confused with?

Most ranking guides on this term are about email. Sender reputation is what mailbox providers track for sending servers, and Google's Postmaster Tools reports it with spam rate and authentication. DNS blocklists grew out of the fight against spam and share lists of addresses through DNS (RFC 5782).

An IP fraud score compresses the record into one number. Single numbers age badly: Cloudflare retired its 0 to 100 IP threat score, and its docs now say the score is always 0 and "no longer being populated" (Cloudflare docs, April 2026).

#Questions people ask

To read the full record of any address, use the free IP reputation check.