Skip to content
NewVerdictIQ Connector is here. One Docker image enriches your DNS logs with verdicts inside your network and forwards them to your SIEM.Install guide

IP Blacklist & Reputation

IP reputation feeds: known-bad, recently-bad, deny-list churn. Each fires with named evidence and a 3-question analyst Q&A trail.

See 7 IP Blacklist & Reputation signalsSee verdicts firing these
About

What IP Blacklist & Reputation captures

IP reputation feeds: known-bad, recently-bad, deny-list churn. Tier-1 SOC analysts use them to cut triage time on suspicious threat intelligence feed behavior; CTI teams pivot from them to the broader campaign graph.

Browse

7 signals in IP Blacklist & Reputation

Each row opens a leaf page with the signal's direction, named evidence, and 3-question Q&A trail. Use them as audit anchors when a verdict surfaces this subgroup.

IP Blacklist & Reputation7 signals
Verdict scenarios

How IP Blacklist & Reputation shapes the call

Three real-world situations where IP Blacklist & Reputation evidence dominates the decision. Verdict and explanation are how VerdictIQ would frame the outcome to an analyst, not raw signal slugs.

High riskVERDICT · BLOCK
The situation

A domain whose serving IPs are present on multiple major IP reputation deny-lists with recent listings.

VerdictIQ explains

“Decline. IP-level reputation hits across independent feeds are high-confidence external signal. Block until the listings clear.”

Medium riskVERDICT · REVIEW
The situation

A domain whose IPs appear on a single low-precision reputation feed with no recent reinforcement.

VerdictIQ explains

“Send to analyst review. One reputation hit alone isn't blocking-grade but warrants confirmation.”

Low riskVERDICT · ALLOW
The situation

A domain whose IPs are clean across all monitored reputation sources.

VerdictIQ explains

“Allow. The IP reputation surface is clean. No deny-list reason to delay.”

See full Verdict Gallery
Sibling subgroups

Other subgroups in Threat Intelligence Feed

4 more subgroups in this group, each bundling signals that share a different mechanism. Tap one to inspect its signal names.

See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail

See IP Blacklist & Reputation signals fire on your data

Free tier: 1,000 verdicts/month, LLM layer included.

Start FreeBack to Threat Intelligence Feed