IP Reputation

For each IP address, the lookup returns: risk score (0–100), threat category (botnet C2, spam source, phishing host, scanner, Tor exit node, proxy/VPN, malware distribution), geolocation and ASN, whether the IP appears on major blocklists, recent malicious activity observations, and if applicable, threat actor associations. This gives analysts an immediate, evidence-based assessment without manually cross-referencing multiple threat feeds.

Common use cases include: triaging SIEM alerts by quickly checking whether source IPs in security events are known-malicious, enriching firewall logs to prioritize blocked connection investigations, validating whether email sources are spam or phishing infrastructure before opening attachments, and investigating suspicious IPs in phishing headers or malware network traffic. High-reputation IPs from your corporate range can also be checked to verify they haven't been listed as spam sources.

Your corporate IP may have a low reputation score if: a compromised endpoint is sending spam or participating in a botnet, your email server is misconfigured and sending email that gets marked as spam, your IP range was previously assigned to a different organization with poor security practices, or a penetration test or vulnerability scanner was run from your network without notifying threat intelligence providers. A low score doesn't always mean compromise — it requires investigation.

SOCRadar IP Reputation aggregates data from over 200 threat intelligence sources that update continuously. New malicious IPs are typically reflected within minutes to hours of their first detection. However, reputation scores can also age — an IP that was malicious six months ago but has since been cleaned may still show residual low scores. The tool shows recency information for each finding so analysts can weigh current versus historical data appropriately.