Threat-intelligence scores and new IP space: what AbuseIPDB-style ratings tell you

A block can be clean on every mail blacklist and still cause trouble because of its threat-intelligence scores. Ratings such as AbuseIPDB’s confidence score feed firewalls, fraud tools and login protection, and they follow an address from one holder to the next. This article explains what these scores measure, where they bite and how to assess new IP space before you put it into service.

What these scores actually measure

Threat-intelligence ratings summarise behaviour that has been observed or reported from an IP address. The sources differ:

• Community reporting. AbuseIPDB collects reports from administrators and automated tools, including fail2ban integrations, about attacks they see: port scans, SSH and RDP brute-forcing, web application attacks, spam and similar activity. It turns them into an abuse confidence score from 0 to 100.
• Vendor telemetry. Services such as Cisco Talos and IBM X-Force Exchange assign reputation ratings based on what their own sensors and customer deployments observe.
• Scanner classification. GreyNoise and similar services separate internet-wide scanning that looks benign, such as research projects, from activity that looks malicious.
• Aggregators. VirusTotal and similar platforms show what several vendors say about an address in one place.

None of these measures who holds an address. They describe what came from it, or what people reported came from it, over a period of time.

How the scores change over time

Reputation of this kind is time-sensitive. Recent reports generally count for more than old ones, and scores fall when the activity stops. How quickly depends on the service and on how many independent sources reported the address.

Two practical consequences follow:

• A poor score on newly acquired space is usually a record of the previous holder’s customers. If the activity has genuinely stopped, it will fade.
• Unlike many blacklists, threat-intelligence services do not always offer a removal route. Some vendors accept dispute or reclassification requests, but often the main remedy is clean behaviour over time.

This also means a score can get worse after you take over a block. If a former user’s compromised server is still pointed at the addresses, or a new customer starts scanning, fresh reports arrive under your name.

Where poor scores cause problems

Threat scores are consumed far beyond the services that publish them. You may see effects in:

• Web application firewalls and CDN bot protection, which challenge or block requests from poorly rated addresses
• Login and account protection, including extra verification steps or refused sign-ins on SaaS and banking platforms
• Fraud and payment checks, where IP risk is one input into transaction scoring
• Firewall blocklists, where operators automatically drop traffic from addresses above a score threshold
• Security monitoring, where your traffic triggers alerts in a customer’s or partner’s tools

For a hosting provider, this shows up as customer complaints about CAPTCHAs and blocked API calls. For a company using the space for VPN gateways or office internet access, it shows up as staff locked out of the services they need.

Reading scores on a block you are about to take on

Look up every address in the block, not a sample. Several services offer bulk or subnet lookups, subject to their plan limits. Then read the results with these questions in mind:

1. How many addresses are affected? A handful of scored IPs is normal on space that has been in use. Scores spread across a whole /24 point to systematic abuse.
2. What categories appear? Scanning and brute-force reports suggest compromised or abused servers. Phishing, malware distribution or botnet command-and-control indicate a more serious history.
3. How recent is it? Reports from the past few weeks mean the activity may still be going on, possibly by a current user of the space.
4. How many independent reporters? Many sources agreeing carries more weight than one prolific reporter.
5. What do IP-type databases say? Space classified as VPN, proxy or anonymising infrastructure can be filtered even with no abuse reports at all.

Treat the answers as part of the deal. Recent, widespread or serious findings justify asking the seller or lessor to explain the history, offering a different range, or adjusting terms.

Bringing new space into service

If the block is acceptable but not spotless, a careful start helps old history fade instead of renewing it:

• Update the RIPE Database objects, reverse DNS and abuse contact so the space clearly belongs to you and abuse reports reach the right people.
• Put lower-risk services on addresses with residual history, and keep the cleanest addresses for mail, VPN egress and customer-facing systems.
• Watch for traffic still arriving for the previous user’s services, which can reveal what the space was used for.
• Monitor scores during the first weeks of use so that a new problem is caught before it builds up.
• Respond quickly to abuse reports. A visible, responsive abuse process is the best long-term protection for a range’s reputation.

How TACS can help

Our IP security audit checks each address in a block against threat-intelligence sources as well as blacklists, and explains which scores matter for your intended use. If you are sourcing space through Lease IPv4 or Buy IPv4, we can run that check on candidate blocks before you commit.