How IP Reputation Scoring Works: Signals, Weights, and Bands

The 0–100 confidence score you see next to an IP address is not a single measurement but a weighted sum of independent signals. Knowing how it is built lets you give it the right weight in your own decisions.

The signals that feed the score

On IP-DB.com the score is the sum of five components, each with its own ceiling, and the total is capped at 100:

• Threat feeds (up to 90 points) — how many independent blocklists carry the address, weighted by each list's reliability. Corroboration is what counts: a second independent source adds nearly as much as the first, a list that only republishes others (an aggregator) adds its weight once, and several lists published by one operator count as a single vote. Feeds alone stop short of 100 — reaching it takes a second kind of evidence.
• Community reports (up to 35 points) — ten points per distinct reporter, three for each extra report from the same person.
• DNSBL listings (up to 20 points) — ten points for every mail blacklist that lists the address at lookup time.
• A recently lifted listing (up to 35 points) — when an address has just left every feed, half the score it had on the way out, fading to zero over 60 days. It never applies while the address is still listed, so the same evidence is not counted twice.
• The /24 neighbourhood (up to 20 points) — zero until 2% of the surrounding block is listed, then 0.4 points per percent. Neighbours alone can never push an address past "low".

Two more signals are shown next to the score but deliberately kept out of it: the network type (residential, hosting, VPN, Tor) — using a VPN is not abuse — and Spamhaus ASN-DROP, which is a statement about who runs the network rather than about the address.

Why "how many sources" beats "how many entries"

This is the decisive part of the formula: independent sources that corroborate each other are stronger evidence than many entries from one source. Fifty hits in the same feed are not the same as one hit in fifty different feeds. The same holds for community reports: ten different users carry far more weight than ten reports from one user. The structure also makes it hard to inflate a score by manipulating a single source.

The bands and what they mean

• 0–9, clean: no records in any feed. Treat as ordinary traffic.
• 10–39, low: a weak or isolated signal. Log it; don't block.
• 40–74, suspicious: several signals overlap. This is the band for extra verification, rate limits, or manual review.
• 75–100, critical: strong, mutually corroborating evidence. A sensible threshold for automated blocking.

Turning the score into decisions

Rather than one threshold, build a graduated response: log only in the low band, add friction in the middle band (extra verification, delay, rate limit), block in the high band. The harder a decision is to reverse — closing an account, declining a payment — the higher the threshold should sit, and the more account history, device data, and transaction size should weigh alongside the score.

When a high score misleads

• Shared hosting and CGNAT — hundreds of legitimate users can sit behind one address.
• Recycled blocks — a block that changes hands carries its former owner's history for a while.
• Stale records — an incident from two years ago does not weigh like yesterday's; check when the record was last seen.
• Category mismatch — an address listed for spam is not necessarily a risk to your web application.

So read the breakdown next to the number: IP-DB.com shows separately which feeds matched, how many distinct users reported the address, under which categories, and when each record was last seen.

Why different services score differently

Every provider uses different feeds, weights them differently, and applies different time windows. Two services returning 40 and 80 for the same address is not a contradiction — it is the same evidence under a different calibration. When setting your own thresholds, don't treat one provider's number as absolute truth; measure what each band actually produces in your own traffic.

Programmatic access

The score and its components are also returned by the API, so you can apply your thresholds inside your own application and log decisions together with the feed and report breakdown. To assess many addresses at once, use the bulk lookup.