IP scoring is such a difficult product to do reliably. When someone says we provide IP scoring, you have to ask them based on what and what is your methodology. Now, IP reputation scoring can be good if both the vendor and the customer know what they are looking for very specifically.

For example, there are abusive IP databases. Now, some abusive IP databases run global honeypots, and they can say these IP addresses tried to exploit the CVE patterns. Sounds good, so when you buy their product, you can say the scoring they are providing can help with blocking IP addresses that run automated CVE exploits that match this pattern. Those services act as beacons, rather than a flat, generic, and everlasting database of bad IP addresses.

Now, do you take that score and try to use it as a baseline for protecting your login portal or credit card fraud? Of course not! You have to go to specialized vendors who provide specialized scoring.

We do not do IP reputation because we provide IP metadata that we can verify, and we can discuss methodologies publicly. If you ask us to do IP reputation scoring, we can easily do that, as we run a global honeypot ourselves as well. But that will involve us providing explanations and education to folks that the score you see fits a very specific pattern of attack that is not generic.

For example, we sell residential proxy detection data, and the database contains 100 million IP addresses. Are all 100 million IP addresses bad? Of course not. But this is not our call to make; our customers have to see the metadata we provide as well, such as percent days seen, last seen, etc. Now, if an IP address is flagged for being 100 percent seen and the last seen date is fairly new, it fits a certain threat model which can be categorized as concerning.