IP reputation is a security score or classification that estimates whether an IP address is likely to be benign, suspicious, or abusive. It is built from signals such as past spam, phishing, brute-force attempts, malware hosting, bot activity, geolocation, and whether the address belongs to a datacenter, VPN, or residential network.
Defenders use IP reputation to filter traffic, prioritize alerts, and add risk to authentication decisions. It is useful, but not definitive: attackers can rotate through large pools of addresses, including residential proxies, to make malicious traffic look ordinary. Good defense treats reputation as one input among many, combined with device fingerprints, behavior analysis, and login anomalies. That layered approach helps catch abuse without blocking legitimate users who happen to share an IP range.