A network's reputation summarises how much of its address space appears on public blocklists and phishing lists, relative to its size. It describes what those lists report today. It is an estimate, not a judgement of the company that runs the network.
Each current listing of an address or address block on a public blocklist counts once, weighted by what the list reports: botnet control servers weigh most, then compromised machines, then spam sources, then scanning and brute-force activity. A listed block counts once, not once per address, because a list reports that abuse was seen there, not that every address is bad.
Phishing sites count by the distinct addresses that serve them, so one server holding many reported domains counts once. Pages on shared website builders and sites behind a content delivery network are shown but not counted, because they describe the platform's users rather than the network itself.
Lists that describe how an address is used rather than abuse, such as the Tor exit relay list, are shown for context and never count.
The total is divided by the amount of IPv4 space the network announces, counted in blocks of 256 addresses, so a large network is not penalised for being large. A network announcing less than 256 addresses is shown as "Not enough data", because a single listing would decide its rating.
| Band | Weighted listings per 256 addresses | Score |
|---|---|---|
| Good | under 0.05 | 96 to 100 |
| Fair | 0.05 to 0.5 | 61 to 95 |
| Poor | 0.5 to 2, and at least 2 weighted listings | 14 to 60 |
| Bad | 2 or more, and at least 5 weighted listings | 0 to 13 |
The minimum counts stop one or two listings from putting a small network in the lowest bands. A network that a list names as a whole, rather than by address, is rated Fair at best. "Good" means no meaningful listings on the lists we track; it is not an endorsement.
Ratings are recalculated daily. A rating is not published for a day on which any of the lists could not be read, so a missing list never looks like an improvement. Each list and its licence is named on the data sources page.
Listings come from the lists themselves, and each listing links to that list's own removal process. Once a list removes an address, the rating updates within a day. If you believe we have attributed a listing to the wrong network, tell us at [email protected].