The limits of IP reputation, explained

Most network-facing security controls check source IP addresses against a reputation list early on, usually before anything more expensive runs. Firewalls, WAFs, mail filters, bot management, and DDoS mitigation all lean on it. If the address has a history of malicious activity, drop or challenge the request. It is cheap, it is fast, and it clears a lot of low-effort malicious traffic, so there is little reason not to keep it.

The trouble, however, starts with what an IP address actually is.

An IP address identifies a route to a network interface at a moment in time. It does not identify a person, a device, or an intent. Reputation quietly papers over that gap by assuming an address will behave tomorrow the way it behaved yesterday, and that whoever is behind it will stay put. Neither assumption survives contact with reality, and there is a mature, cheap market built specifically to break both.

1. An address is shared infrastructure, not an identity

An IP address is almost never used by just one party. Carrier-grade NAT stacks thousands of mobile subscribers behind a single public address. Corporate gateways, universities, and cloud NAT services do the same thing at different scales. So when you block or trust an IP address, you are effectively making that call for everyone sitting behind it.

Residential proxy services turn this ambiguity into a marketable resource. For example, the cybercrime listing below offers residential IPs on real devices at 50 cents each, with more than 90,000 proxies spread across 100 countries.

Notice the promise that 90% are clean. What that really means is the seller has already run their inventory against the very public reputation lists you rely on and kept the addresses that pass. Your blocklist and their stock are drawn from the same pool. A clean residential address, then, tells you almost nothing. Block it and you risk hurting the real users who share it. Trust it and you welcome in precisely the traffic the proxy was bought to launder.

2. Reputation is a lagging indicator

Reputation only gets assigned after an address has already been caught misbehaving, which makes it a rear-view mirror by design. There is a gap between the moment an IP address turns malicious and the moment any feed notices it. And then there is a second gap after the abuse stops, when the address is still carrying a bad record even though it may have already been reassigned to a legitimate user.

What’s more, address inventory never sits still. Consumer DHCP leases rotate, and cloud addresses are handed out and reclaimed all day long, so the address that ran a scanner last week might be serving a legitimate startup's API this week. And all these lags have been turned into a paid service too: some hosting services are designed specifically to buy malicious infrastructure more time before reputation catches up.

In the listing above, a host advertising bulletproof VPS with Spamhaus ignored essentially sells the lag in your feed as a feature. The takeaway is that a reputation score is a statement about the past. Read it as a statement about the present and you lean on stale data in both directions: false confidence in addresses that have quietly gone bad, and stubborn penalties on addresses that have already been recycled to innocent users.

3. Attackers change IP addresses at will

Even a perfectly up-to-date feed rests on one shaky assumption: that the attacker will stay put long enough for a block to bite. They will not. Rotating residential proxies hand out a fresh source address on every request, and commodity VPN providers sell hundreds of exit points for the price of a coffee each month. Whole lists of them get passed around in the open.

This turns the economics of blocking upside down. Blocking only works if each address is scarce enough that losing it actually costs the attacker something. But that’s not the case: when anyone can cycle through thousands of clean addresses from a Telegram bot, blocking any single one barely registers. You, on the other hand, end up playing whack-a-mole against an endless supply of cheap IP addresses that are replaced faster than any IP blocklist can keep up with — while every false positive can cost you real users and real money.

4. A clean address can be a hijacked legitimate endpoint

The trickiest case of all is the one where the address is genuinely good, the device is genuinely real, and only the session is wrong. Remote access trojans (RATs) with a hidden desktop (hVNC) capability let an operator work directly through a victim's own machine.

On the listing below, a RAT offers hVNC alongside a built-in reverse proxy — exactly this kind of setup. The attacker's traffic leaves from the victim's real IP, on the victim's real device, inside a session the victim's own ISP would swear is legitimate. At the network layer, the fraud and the victim's ordinary browsing look identical. The reverse proxy is the giveaway: it routes traffic through a trusted endpoint, so it inherits the clean reputation. Once the attacker can reliably borrow a good address, a defense relying solely on IP address reputation is simply watching the wrong layer.

5. A support economy keeps bad infrastructure alive

Reputation also assumes that once something is flagged, it stays flagged. A whole service economy exists to make sure that does not happen. The following listing advertises a professional domain and abuse management service: direct lines to registrars, removal of HOLD status from domains, restoration of delegation, and handling of DMCA and abuse complaints.

This is basically reputation laundering offered as a managed service. The entire point is to shorten the time malicious infrastructure spends on any blocklist and to keep domains and addresses working long after they should have been pulled. As long as this market exists, a clean record can just as easily reflect how well the operator handles complaints as whether the infrastructure deserves to be trusted at all.

Where IP reputation actually belongs

This doesn't mean IP reputation is useless. It's still a low-cost way to filter out a lot of noisy traffic with minimal false positives, and that's worth keeping.

The point here is more specific. IP reputation is just one input in a bigger picture. It needs to work alongside behavioral, session, and device signals, not make decisions on its own. An IP address shows where a packet claims to originate, but it doesn't tell you who sent it or their intent.

This is also why Qrator's Anti-DDoS solution takes into account multiple signals beyond IP reputation to provide effective DDoS protection while minimizing false positives.