All DDoS Definitions
DDoS Testing Definition

IP Reputation

IP reputation is an application- and network-layer defensive control that scores source addresses against threat-intelligence feeds, then blocks or challenges traffic from hosts with a recorded history of abuse. Feeds aggregate signals such as prior attack participation, open-proxy and Tor exit-node membership, known botnet command-and-control nodes, and crowd-sourced abuse reports. Edge platforms apply the score before a request reaches the origin, dropping or rate-limiting low-reputation sources cheaply.

IP reputation: score the source, then allow, challenge, or block Threat-intelligence feeds Prior attack participation Tor and open-proxy exits Known botnet C2 nodes Crowd-sourced abuse Reputation engine matches source IP, returns a score Allow, high reputation clean history, pass through Challenge, unknown prove human before serving Block or rate-limit, low recorded abuser, drop cheaply A first-pass filter that removes obvious bad actors before costlier inspection runs. Weakness: a fresh residential proxy with no history scores neutral and slips through. A test measures both the false negatives from clean-looking IPs and the false positives from shared NAT and VPNs. BlackNeuron™
Diagram: IP reputation scores a source against threat-intelligence feeds, then allows, challenges, or blocks it

Why it matters in DDoS testing

Reputation filtering is a first-pass control that removes obvious bad actors before more expensive inspection runs, but it degrades against fresh residential proxies and hijacked IPs with clean histories. A test measures both the false-negative rate (attack traffic from clean-looking IPs) and the false-positive risk (legitimate users behind shared NAT or VPNs). How major edge providers source and weight reputation differs, a point examined in the AWS Shield and Cloudflare comparison.