What is IP Reputation?

IP reputation is a classification of an IP address’s likelihood of association with malicious activity – botnets, phishing, spam, scanning, or web attacks – derived from continuously updated threat-intelligence feeds. Security policies use this classification, alongside IP geolocation, to allow, alert on, or block traffic before it reaches the network.

Key takeaways

• IP reputation flags addresses linked to botnets, phishing, spam, or scanning.
• Versa Networks updates its IP reputation feed daily and in real time.
• Nine predefined categories drive allow, alert, or block actions per address.
• IP-filtering profiles combine reputation with geolocation and address lists.
• URL reputation can override IP reputation to avoid blocking shared hosts.

On this page: Why it matters · How it works · Types · IP reputation & Versa · FAQ

Why is IP reputation important?

Not every threat looks malicious in an individual packet – a scanning host or a botnet command-and-control server often behaves normally at the protocol level even though its history marks it dangerous. IP reputation closes that gap: it screens traffic against a maintained record of addresses observed hosting attacks, malware, or fraud, blocking or flagging matches before a session reaches sensitive applications.

This matters because it stops known-bad traffic cheaply and early, at the edge, instead of pushing every session through deeper, costlier inspection. Combined with geolocation, it lets policy account for where traffic originates – useful when an organization has no legitimate business with certain regions. Because the feed updates daily and in real time, protection keeps pace with fast-moving threats without manual block-list upkeep.

What is IP reputation?

IP reputation is one of several ways VOS devices filter traffic by address, alongside FQDN-based address objects and externally pushed dynamic address objects. Rather than resolving a domain name, it checks the source or destination IP address against a feed of known-bad addresses Versa Networks maintains and updates daily and in real time.

Administrators build IP-filtering profiles that reference predefined reputation categories and attach an enforcement action to each: allow, alert, drop the packet, drop the session, reject, or a custom action such as a captive-portal redirect. Profiles can combine reputation with geolocation rules, deny and allow lists, and DNS reverse-lookup checks, applying match criteria against the source, the destination, or both. A lookup tool in Director and Concerto shows an address’s reputation and geolocation before a rule is written.

Types of IP reputation

Versa’s predefined reputation feed groups addresses into nine categories, the building blocks for custom IP-filtering profiles. Botnets covers command-and-control infrastructure and compromised “zombie” hosts. Denial of service flags sources tied to DoS or DDoS floods. Phishing covers hosts serving fraudulent sites or click and gaming fraud. Proxy identifies addresses providing proxy services, often used to mask a request’s true origin. Reputation is a general malware-association category. Scanners flags reconnaissance: port probes, domain scanning, and password brute-forcing. Spam sources covers spam relayed through proxies and anomalous SMTP activity. Web attacks covers cross-site scripting, SQL and iFrame injection, and cross-domain attacks. Windows exploits flags sources distributing malware, shellcode, and worms. An older Network category is deprecated, kept only for backward compatibility.

IP reputation & Versa

VOS devices ship with Versa’s predefined reputation feed built in, so IP-filtering profiles work against botnets, phishing, scanning, and the other categories out of the box, whether the profile protects a Secure Web Gateway path or sits in front of the Next-Gen Firewall. Versa also ships ready-made profiles – Block Bad Traffic, Block DoS, Block Scanners, Block Spam, and the broad Versa Recommended Profile – so teams enable a sane baseline without building one.

When defaults aren’t enough, administrators build custom profiles combining reputation actions with geolocation rules, deny and allow lists, and address reverse lookup. A Prioritize URL Reputation option lets URL-level trust override an IP-reputation block – useful when a legitimate site shares an address with a flagged one, such as behind a CDN. Director and Concerto expose a reputation-lookup tool for checking any address’s classification and geolocation.

Frequently asked questions

What predefined IP reputation categories does Versa provide?

Nine categories: botnets, denial of service, phishing, proxy, reputation (general malware association), scanners, spam sources, web attacks, and Windows exploits. A tenth, Network, is deprecated and kept only for backward compatibility. Administrators enable any combination of these categories when building an IP-filtering profile.

How often does Versa update its IP reputation feed?

Versa updates the feed both daily and in real time, so newly identified botnet nodes, phishing hosts, and scanning sources are reflected in enforcement without an administrator manually editing block lists. VOS devices consume it automatically once a profile references reputation-based actions.

Can IP reputation and URL reputation conflict?

Yes. Blocking purely on IP reputation can catch legitimate sites sharing an address with a malicious one, common behind CDNs. The Prioritize URL Reputation setting resolves this by letting a trustworthy URL reputation override an IP-reputation block, evaluated against a configurable risk-priority threshold.

What enforcement actions can a security policy apply based on IP reputation?

Actions include Allow, Alert (allow and log), Drop Packet, Drop Session, and Reject, plus custom actions such as a captive-portal redirect, an override PIN prompt, or a justification page. Administrators assign a distinct action to each reputation category or geolocation rule in a profile.

Can an administrator look up the reputation of a specific IP address?

Yes. Director and Concerto include a reputation-lookup tool: enter an organization and an IP address, and the interface returns its current classification and geographic location – useful for checking a rule’s effect before or after deployment, or for investigating traffic.

More on IP reputation

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about IP reputation, these are worth looking at next.