IP Reputation: How Scores Are Calculated, and Why a New Server Arrives With a Record

IP reputation is unavoidable for anyone making risk decisions, and it is also the most misused input. Almost everything it consumes is history: how often this address was reported, how much abuse this ASN has produced, whether this range once belonged to a proxy pool. That explains two things — why the same phone moves dozens of points when it switches networks, and why the server you just rented is rejected on its first form submission. First how the number is produced and how to use it, then why a new address arrives carrying the previous tenant's record, and what you can do about it.

A "fraud score" is not a verdict — it is a probability estimate. Understanding what goes into it helps you keep your own score clean and interpret others correctly.

1. What a score measures

A fraud score condenses many weak signals into one number (usually 0–100). Inputs typically include the ASN type (datacenter, residential, mobile), proxy/VPN/Tor flags, abuse history, and velocity — how many accounts or requests share the IP.

2. Why the same IP can score differently

Different vendors weight signals differently and refresh their data at different rates. A residential IP used by a proxy network may look clean to one provider and risky to another. Always treat the score as one input, not the truth.

3. Keeping your own score clean

• Avoid sharing your IP with abusive neighbours — dedicated or clean residential ranges help.
• Do not run scrapers or bulk sign-ups from the same IP as your real users.
• If you run a VPN, expect a higher baseline and design your product accordingly.
• Monitor your score over time, not just once.

4. Using scores responsibly

Combine the score with context: account age, payment method, request patterns. Use it to add friction — challenges, step-up verification — rather than to silently punish users, because false positives are expensive.

5. Scores carry historical baggage

A score is not computed from the present moment. It leans on history: whether this address was reported before, how much abuse this ASN has produced, whether this range was once rented to a proxy service. An address can therefore change hands and keep the previous owner's record. A freshly purchased VPS often gets blocked on its first form submission, and the reason is usually not you — it is whoever held the address six months ago.

6. Using a score to make decisions

Treat it as a tier, not a switch. Below 30, let it through. Between 30 and 70, add light friction: email verification or a short submit delay. Above 70, require strong verification or a manual review. And log the reason behind every block, because the question you will have to answer in a few months is "why does this customer keep failing to sign up", not "how many did we block".

A last point that gets missed: a score grades what the address looks like right now, not who the person is. The same phone switching between wifi and mobile data can move dozens of points. Treat the number as an identity label and you will eventually hurt the wrong people.

A freshly provisioned server feels like a clean slate. It is not. The address was almost certainly used by someone else before you, and if they sent spam, ran scrapers or hosted phishing, the reputation is still attached — in blocklists, in fraud scoring and in the mail filters that will decide whether your first transactional email ever arrives.

7. Why the address arrives with baggage

IPv4 space is finite and has been recycled for decades. Hosting providers reassign an address within days of a cancellation, and the cheapest VPS ranges are precisely where large volumes of short-lived, disposable servers live. Nobody vets a departing customer's behaviour, so a /24 that carried a botnet last quarter is offered to you as ordinary stock.

8. Ten minutes of checking, in this order

• Look up the IP on Spamhaus ZEN, Barracuda and AbuseIPDB. Check the surrounding /24 as well — some lists work at prefix level, and a clean IP inside a dirty range is still a risk.
• Read the RDAP record for the network and find the abuse contact. A provider that publishes a real abuse desk and answers it is a provider that keeps its space tidy; one that publishes nothing is telling you something.
• Check whether the range belongs to a residential-proxy operation or a bulletproof hoster. Those ASNs are scored as risky by everyone, no matter what you do with the address.
• Test what a mail receiver would see: does the PTR exist, does it match the forward record, does the IP appear in any DNSBL that Gmail or Microsoft consults.

9. What to do when the address is dirty

Ask the provider for a reassignment before you deploy. Most will swap an address on request, and a few will charge a small fee. If they refuse, or if every address in the pool is listed, that is the answer to a different question: this is not a provider you want to send mail from.

For the blocklists, use the removal form — but only after you know what caused the listing. Spamhaus in particular will re-list quickly, and repeated delist requests from an address that keeps sending the same traffic look exactly like what they are.

10. Reputation is earned per address and per /24

Cleaning a listing does not create a reputation; it removes a negative one. Positive reputation builds slowly, from consistent volume, consistent content and a clean bounce rate. For mail, that means starting with a few dozen messages a day and growing over two or three weeks rather than announcing a launch to ten thousand addresses on day one. For a web service, it means not sharing an address with a scraped-content site, a proxy panel or anything that attracts abuse reports.

11. The IPv6 shortcut is not one

It is tempting to skip IPv4 reputation entirely by going v6-only, and the address space is so large that a fresh /64 is genuinely clean. But receivers score IPv6 separately, so a new /64 has no reputation at all — the same as a new domain. And most filtering treats an IPv6-only sender with suspicion, because a lot of throwaway abuse infrastructure is exactly that. Dual-stack is still the boring, correct default.

12. Keep watching, because it changes

A range can be clean when you deploy and listed six months later, because a neighbour got compromised or because a sub-allocation was sold to someone with different habits. Put a weekly check on the address and the /24 in front of you, and alert on any new listing. Ten minutes now saves a week of "why is our mail going to spam" later.

ipbox.one shows the ASN, organisation and network class behind the address your connection is using, and a score when a risk provider is configured. Without one it does not invent a number; it says the verdict is heuristic, which is considerably more honest than a precise-looking score.