IP Reputation: Transform Static IP Data and Behavior Patterns into Threat Insight

IP Reputation

Neustar IP Reputation transforms static IP data and behavior patterns into a global authoritative source of risk and threat insight data on IP addresses worldwide. Neustar IP Reputation decisioning data is based on insight from billions of queries we see each day across markets including financial services, streaming media/OTT content distribution, advertising, insurance, gaming, government, healthcare and more. This ensures that when a decision is made to identify an IP address as a security risk, that decision will be made using the most insightful IP risk and reputation data available.

An IP Address Is Not Just Another Number

With IP Reputation, an IP address is not just a number, it's a way to assess the risk associated with a device that is attempting to access your network, corporate resources and/or intellectual property. You may expect a known customer, partner or vendor to be accessing your site, but what if that's not who's behind the device? What if the request is part of an attempt to hide location and nefarious intentions by connecting via an anonymous proxy server? With risk insight from IP Reputation data, you can determine if the IP is being used by an actual human being or is non-human bot or server traffic. You can determine if the IP address has been associated with malicious activity in the past and is too risky to trust, the history of the IP address and the last time it was seen, and if its risk profile has changed since the last time it was seen.


Two Powerful Scores Help You Assess IP Risk

Real User Score

We assign a score between 1 and 5. To arrive at this score, we analyze usage patterns across key industries as well as collection of non-human activity (e.g. server and bot lists) to differentiate real end-user (human) traffic from non-human (server or bot) traffic. The higher the number (e.g. 5), the more likely the traffic is "non-human".

Human or Non-Human?

Score between 1 and 5


  • Differentiate real-user (human) traffic from non-human (bot/server) traffic

Data Collected

  • Usage patterns from internal Neustar Data Exhaust
  • Ingestion of known server and bot lists

Output: Real-User Score

  • The higher the number, the more likely the traffic is “non-human”

Risk Score

We assign a risk score between 1 and 100. This score provides insight about the risk of the IP address being associated with malicious activity from IP threat intelligence sources. The higher the risk score (e.g. 100), the more likely the IP has been associated with nefarious activity.

How Risky?

Score between 1 and 100


  • Insight about the risk of an IP being associated with malicious activity
  • Understand threat and risk insights

Data Collected

  • Data from leading threat intelligence sources, including internal Neustar Data Exhaust

Output: Risk Score

  • The higher the number, the more likely the IP has been associated with risky activity

Proprietary Neustar Intelligence Data Exhaust Provides More Risk Insight

As a leading provider of Marketing and Security services, Neustar is uniquely positioned to see network traffic patterns and threat actors across all verticals. By analyzing traffic behavior and identifying threats, we use this "Data Exhaust" to identify query patterns that indicate human or non-human behavior and increased risk. We then use that data and insight to enhance the Real User Score. Our powerful Data Exhaust adds yet another layer of intelligence to help teams confidently determine if traffic is originating from a real-user (human), or if it is non-human (bot/server) traffic.

Download PDF

Related Resources