All DDoS Definitions
DDoS Testing Definition

IP Reputation

IP reputation is the control that decides what to do with traffic before reading any of it, by looking up the source address in threat-intelligence feeds and scoring its history. Whether that verdict still separates attackers from customers once a flood arrives is what a DDoS test measures.

Feeds aggregate signals such as prior attack participation, open-proxy and Tor exit-node membership, known command-and-control hosts and crowd-sourced abuse reports. Edge platforms apply the score early, so a low-reputation source is dropped, rate-limited or challenged cheaply, before more expensive inspection runs.

IP reputation: score the source, then allow, challenge, or block Threat-intelligence feeds Prior attack participation Tor and open-proxy exits Known botnet C2 nodes Crowd-sourced abuse Reputation engine matches source IP, returns a score Allow, high reputation clean history, pass through Challenge, unknown prove human before serving Block or rate-limit, low recorded abuser, drop cheaply A first-pass filter that removes obvious bad actors before costlier inspection runs. Weakness: a fresh residential proxy with no history scores neutral and slips through. A test measures both the false negatives from clean-looking IPs and the false positives from shared NAT and VPNs. BlackNeuron™
Diagram: IP reputation scores a source against threat-intelligence feeds, then allows, challenges, or blocks it

How the score is built

A reputation check is a lookup, not an inspection. The cost is one table or hash lookup per connection or request, which is why it usually sits at the front of an edge pipeline, ahead of WAF rules and the bot management classifier. Three properties of the inputs decide how it behaves:

  • Age. A feed records what an address did in the past. Lists refresh on cycles from minutes to days, and entries decay so that an address recycled to a new tenant is not punished forever. An attack from addresses that were clean yesterday arrives with a neutral score.
  • Granularity. In IPv4 one address can be one host or thousands of subscribers behind carrier-grade NAT. In IPv6 a single subscriber usually holds at least a /64, so scoring individual addresses is usually pointless and feeds score prefixes instead. The prefix length chosen decides how much innocent traffic shares a verdict.
  • Provenance. Some lists are curated and conservative; Spamhaus DROP, for example, lists only netblocks that are hijacked or run by criminals. Others are crowd-sourced and noisy. Mixing them without weights produces a score that blocks a university because one student ran a scanner.

IP reputation: a verdict on the source before anything is read incoming source addresses Reputation lookup score from feed history Next layers WAF, bot checks, origin clean or never-seen history: passed on listed abuser: dropped for one lookup BlackNeuron™
Animation of IP reputation: incoming source addresses hit a reputation lookup that scores feed history; listed abusers are dropped for the cost of one lookup, while clean or never-seen sources pass on to the costlier checks behind it

Why it matters under attack

Reputation works best against the attacks that need it least. Reflection floods come from open DNS and NTP servers whose addresses are widely catalogued, and a large botnet of compromised routers collects abuse reports quickly. Those sources score badly and are dropped for almost nothing.

The modern evasion is traffic from addresses with no history at all. A residential proxy DDoS rents consumer broadband and mobile addresses that look like customers because they belong to customers' networks. Freshly provisioned cloud instances arrive the same way. Against that traffic the score is neutral, and the decision falls through to whatever runs next.

The opposite failure lands on real users. Mobile carriers put thousands of subscribers behind one CGNAT address, and offices and VPN providers do the same. One infected handset can mark an address that a whole district shares, and blocking on reputation alone turns all of them away.

What a DDoS test measures about it

A test pushes the score from both sides and records:

  • Misses from clean sources. The false negative rate for attack traffic from never-reported addresses, and which downstream control catches what reputation lets through.
  • Collateral on shared addresses. How much legitimate traffic from NAT, VPN and cloud egress is challenged or blocked during the flood, when operators tend to tighten thresholds.
  • The action attached to a low score. A challenge sent to a reflection flood is wasted work; a hard drop on a CGNAT address is an outage for real people.
  • How fast the score learns. If the platform also scores from its own observations, how quickly a source that started attacking mid-run is downgraded, and whether its score recovers after the test stops.

The result is rarely "reputation works" or "reputation fails". It is the share of the load removed before the costlier layers have to carry the rest.

How major edge providers source and weight that score differently is one of the points set side by side in the AWS Shield and Cloudflare comparison.