It’s 2 a.m., the SIEM has fired 400 times since midnight, and the analyst on call is staring at one alert with one IP address in it. The question in their head is simple: is this IP dangerous, and what was it trying to do?
That question is answered by IP reputation. Most SOCs need a fast, contextual IP reputation lookup wired into their SIEM long before they need a full cyber threat intelligence (CTI) platform with actors, campaigns, and attribution. Full CTI earns its keep when you have the analysts to exploit it. IP reputation earns its keep on every single alert.
Let’s look at what each one actually gives you, where IP reputation runs out, and what to ask before you buy any feed (ours included).
Two different questions
The industry uses “threat intelligence” for everything from a text file of bad IPs to a team of analysts writing reports on a ransomware group. In practice, a SOC asks two very different questions.
| IP reputation | Full CTI | |
|---|---|---|
| Question it answers | “Is this IP dangerous right now, and what has it been doing?” | “Who is behind this, what do they want, what will they do next?” |
| When you need it | On every alert, in seconds, ideally inside the SIEM or SOAR | During an investigation, a threat assessment, a board report |
| Who uses it | Tier-1 analysts, automation, firewalls | Tier-3 analysts, threat-intel teams, CISOs |
| What makes it good | Freshness, context per IP, very few false positives | Depth, attribution, analyst write-ups |
| Cost of using it | Low: a lookup or an enrichment rule | High: someone has to read it and act on it |
Both are useful. The trap is buying the second one when your day-to-day pain is the first.
Where IP reputation earns its keep
Few organizations send their raw internet-facing traffic (web server logs, firewall accepts) to the SIEM: it costs too much and drowns the signal. The IPs that reach the SOC arrive inside alerts instead: a VPN or Entra ID login from an odd place, an IDS or WAF event, an EDR flagging a connection, a spike on an API. For each of those, the useful answer is short. Is this IP malicious? What did it do elsewhere? Is it still active? Is it aimed at organizations like mine?
A good IP reputation source lets you:
- Triage faster: the analyst sees “malicious, HTTP exploitation and SSH brute force, last seen 40 minutes ago, mostly targeting finance” next to the alert, instead of opening five tabs.
- Automate the boring part: enrichment rules can close or downgrade alerts on known mass-scanners and escalate the ones coming from IPs that pick their targets.
- Decide at the door: check an IP before you grant access to a VPN, an Entra ID login, an API, or a checkout page.
- Block before the alert exists: the internet-facing noise you never send to the SIEM still hits your servers. The same data, served as a blocklist, stops a chunk of it at the firewall.
All it takes is good data in the right place, and no threat-intel team.
Where full CTI earns its keep
Does IP reputation replace a threat-intel platform? No. Nothing that looks at IP addresses alone can.
If you’re tracking a specific group, investigating a breach, or briefing your board on the threats to your sector, you need what IP reputation doesn’t carry: malware families, phishing infrastructure, actor profiles, the “why” behind a campaign. That’s where full CTI platforms and the people who run them shine.
Attribution is the part I’d spend the least on. Whether it’s a famous APT or a kid with a rented botnet behind that IP, will you let it in? Will it change the action you enforce at the door? Rarely. And in an AI era, where anyone can industrialize an attack, the “attribution game” makes less sense than ever.
The honest split for most organizations: IP reputation for the volume, full CTI for the few cases that deserve an investigation. And if you only have budget and staff for one, the volume is where the hours go.
Not all IP reputation is equal: three questions to ask any vendor
1. Where does the data come from? A lot of IP reputation is built on honeypots: decoy machines that nobody legitimate talks to, so anything hitting them is suspicious. Fine for internet-wide scanning. But a honeypot has nothing worth stealing, so it rarely sees the attacks aimed at real businesses. Data that comes from production servers sees both the background noise and the targeted activity (we wrote about this trade-off here).
2. Do you get behavior, or just a verdict? “Malicious, score 87” is enough for a firewall. An analyst needs more: look for what the IP did (behaviors, ideally mapped to MITRE ATT&CK), which CVEs it exploited, which countries and industries it targeted, and how its activity evolved over the last day, week, and month.
3. How does an IP get off the list? IPs change hands. A residential address that was part of a botnet last month may be a customer today. Ask how false positives are handled, whether known-good services (CDNs, DNS resolvers, search engines) are excluded, and whether entries expire when the bad behavior stops. A feed that only ever grows will eventually block someone you care about.
How we built CrowdSec’s IP reputation
Since you’re reading this on our blog, here’s how we answer those three questions.
The data comes from production servers. More than 250,000 active CrowdSec Security Engines (open source) protect over 500,000 servers worldwide, and together they send us more than 40 million signals a day. When one of them blocks an attack, it shares the metadata (which detection rule fired, when, and the attacking IP) and keeps the logs to itself. Only unmodified, versioned detection rules count, and an IP is only flagged once many independent machines across many different networks report it, which is our main defense against poisoning.
You get the behavior. Over the past 3 months alone, more than 22 million IPs were reported, and every one of them comes with a verdict (malicious, suspicious, known, benign, safe) plus 30+ fields of context: behaviors and MITRE ATT&CK techniques, CVEs exploited, targeted countries and industries, background-noise level, the reputation of its /24 range and AS, first and last seen, and scores for aggressiveness, threat, trust and anomaly over the last day, week and month.
It’s early. 36% of the IPs on our high-threat list are exclusive to CrowdSec, compared with all other CTI sources, and we flag malicious IPs 1 to 10 weeks before other vendors. On the 2 a.m. alert, that’s the difference between “unknown” and “we’ve seen this one, here’s what it does”.
IPs leave when the bad behavior stops. Known-good services are excluded, and entries expire when reports dry up, which is why the blocklists we build from this data are curated to zero false positives.
Now the candid part: we only see what hits internet-exposed servers. CrowdSec is IP reputation for ingress traffic, built from real attacks. Will it give you phishing domains, malware hashes, or an actor’s biography? No. If that’s what you need, pair it with a CTI platform: we integrate with MISP, OpenCTI, and the major SIEMs and SOARs for exactly that reason.
Try it on your own data
The fastest way to judge any IP reputation source is to throw your own logs at it.
- One IP: paste it in the free CrowdSec IP lookup.
- A whole log file: run IPDEX on it and see how many of the IPs hitting you we already know, and what they were doing.
- In your SIEM: a free CTI API key gives you 120 lookups a month to test an integration. Splunk, QRadar, Microsoft Sentinel, MISP, OpenCTI, Cortex XSOAR, and TheHive are covered in the integration docs.
Already doing this in your SOC? We’d love to hear how you split IP reputation and full CTI: hop onto our Discord and tell us.
