# What is IP reputation?

Source: https://kavralab.com/glossary/ip-reputation/

**IP reputation** is an assessment of how trustworthy an IP address is, based on who owns it, what kind of connection it is (home, mobile, hosting, VPN, proxy or Tor) and what has been seen from it before, such as spam, attacks or fraud. Security tools use it to decide how much to trust a request before looking at anything else.

## How IP reputation is built

Every request carries an IP address, which makes it the first and cheapest signal a site can check. Reputation services collect facts about addresses from many sources and turn them into categories or scores. Some facts describe what the address is. Others describe what it has done.

The facts about what an address is change slowly and are fairly reliable: registry records say which organization and [ASN](https://kavralab.com/glossary/asn/) it belongs to, and whether that network is an internet provider, a mobile carrier or a hosting company. The facts about behavior change quickly: an address sending spam this week may belong to a normal household next month.

- **Ownership and type**: home broadband, mobile carrier, business, hosting or cloud.
- **Anonymizers**: known VPN servers, [Tor](https://kavralab.com/glossary/tor/) exit relays, open and commercial proxies.
- **Abuse history**: spam traps, attack reports, blocklists and honeypots.
- **Local history**: what your own site has seen from that address and its neighbors.

## What IP reputation catches, and what it misses

| Traffic source | Caught by IP reputation? | Why |
|---|---|---|
| Bots on cloud servers | Usually | Hosting ranges are well known |
| Tor exit relays | Yes | The exit list is public |
| Commercial VPN servers | Mostly | Server ranges are tracked, though they change |
| [Datacenter proxies](https://kavralab.com/glossary/datacenter-proxy/) | Mostly | Owned by hosting networks |
| [Residential proxies](https://kavralab.com/glossary/residential-proxy/) | Rarely | Exits are real home IPs that rotate constantly |
| Mobile proxies | Rarely | Carrier IPs are shared with real phone users |
| Account takeover from the victim's city | No | The IP looks like any local customer |

## Why IP reputation alone is not enough

IP reputation was built for a world where attackers came from servers. That world is gone. Fraud operators now rent clean home and mobile IPs by the gigabyte, rotate them for every request and pick exits in the victim's own city. A reputation list can only flag an address after it has behaved badly somewhere, and a rotating proxy exit may never be used twice for the same target.

The opposite problem matters as much. Mobile carriers and large internet providers put many customers behind a single address. Blocking an address with a bad history can lock out real customers who happen to share it today. And a VPN or datacenter address is normal for remote workers, corporate networks and verified crawlers.

## IP reputation vs device reputation

**IP reputation**

- Available on the very first request
- Shared by everyone behind the address
- Changes when the IP is reassigned
- Easy to escape by switching proxy

**Device reputation**

- Needs a script or SDK on the device
- Specific to one physical or virtual device
- Follows the device across networks
- Hard to escape without changing hardware

## Using IP reputation well

Treat IP reputation as one layer of evidence, keep it fresh, and combine it with what the device and behavior show. Kavra draws on 30+ public reputation feeds and adds its own proxy intelligence, continuously measuring the real exit IPs of commercial residential and mobile proxy networks. That network view is weighed together with device, browser integrity, behavior and account history. See [residential and mobile proxy detection](https://kavralab.com/detect/residential-proxies/) and [VPN and Tor detection](https://kavralab.com/detect/vpn-and-tor/).

## FAQ

### How do I check the reputation of an IP address?

Start with public lookup tools: registry data shows who owns the address and its network, and public blocklists and abuse databases show whether it has been reported for spam or attacks. Commercial IP intelligence adds VPN, proxy and hosting labels. For fraud decisions, compare these results with what your own site has seen from that address.

### Can a good IP address get a bad reputation?

Yes. If a device on the connection is infected with malware, used as a residential proxy exit, or shares a mobile carrier IP with abusive users, the address can land on blocklists. The household may have done nothing wrong. That is why reputation should be weighted and time-limited rather than treated as a permanent verdict.

### What is a good IP reputation score?

There is no universal scale. Each provider defines its own categories or numbers, usually from low risk to high risk, and they are not comparable across vendors. What matters is what the score is based on, how fresh it is, and whether your system uses it as one input among many instead of a pass or fail gate.

---
Kavra Lab: bot and fraud detection that explains every decision. Book a demo: https://kavralab.com/contact/