IP Quality Detection Checklist for Security Teams

IP quality detection isn't a single check — it's a systematic assessment across multiple dimensions of data, each of which reveals a different facet of risk. Security analysts, fraud teams, and developers who work with IP intelligence regularly need a reliable framework for ensuring they're not missing any critical signals. This checklist covers every major category of IP quality data and how to interpret it.

Category 1: Reputation and Abuse History

The historical record of what an IP has done is often the most predictive signal of what it will do next.

• Check the IPQS fraud score — values above 75 warrant immediate scrutiny; 25–75 requires contextual judgement
• Query AbuseIPDB for report count, confidence score, and most recent report date
• Check Spamhaus SBL, XBL, PBL, and CSS listings
• Verify against Barracuda BRBL and SURBL
• Note abuse categories — distinguish between spam history (lower web risk) vs malware/DDoS/hacking (higher risk for all services)
• Weight recent reports (last 7 days) significantly higher than older history

Category 2: Proxy, VPN, and Anonymisation Detection

Anonymisation tools don't make traffic inherently malicious, but they do change the risk profile and mean you're assessing the proxy/VPN, not the actual end user.

• Check VPN detection databases — is this a known commercial VPN exit node?
• Check open proxy databases — is this a publicly accessible proxy?
• Check Tor exit node list — is this IP currently active as a Tor exit?
• Check residential proxy databases — is this a known residential proxy node?
• If VPN/proxy is detected, assess whether your use case cares — some services legitimately block all anonymised traffic, others only flag it
• Note the proxy type — Tor carries the highest anonymisation risk; residential proxies the highest fraud risk

Category 3: Network and ASN Classification

The network a request comes from tells you as much about likely intent as the IP's individual history.

• Identify the ASN and organisation name — who operates this network?
• Classify as: residential ISP, mobile carrier, datacenter/cloud, corporate/enterprise, educational, government
• Check ASN reputation — is this ASN known for hosting abusive infrastructure?
• Verify ASN country matches expected traffic origin
• For consumer-facing services: flag datacenter and hosting ASNs as elevated risk
• For API/server-to-server: datacenter ASNs are expected and not a risk signal

Category 4: Geolocation Accuracy and Consistency

Where the IP geolocates matters, but consistency across signals matters more.

• Record IP geolocation at country, region, and city level
• Cross-check against user-provided location or billing address if available
• Cross-check against browser timezone and Accept-Language headers
• Note geolocation confidence — is this a mobile carrier IP (low confidence) or fixed residential (higher confidence)?
• Flag significant discrepancies between stated and observed location
• Consider satellite internet and CGNAT as legitimate sources of geolocation inaccuracy

Category 5: Connection Type and Behaviour

How a connection behaves often reveals as much as what it is.

• Classify connection type: broadband, mobile, dial-up (rare), satellite, corporate proxy
• Check for request velocity anomalies — is this IP making requests at a rate no human could sustain?
• Look for pattern regularity — perfectly regular inter-request timing is a bot signature; humans are irregular
• Check User-Agent consistency — does the User-Agent match expected browser behaviour for the stated connection type?
• Look for header anomalies — are standard browser headers missing or malformed?

Category 6: Threat Intelligence Cross-Reference

Real-time threat intelligence catches active threats that reputation databases haven't catalogued yet.

• Check against active malware C2 IP lists
• Check against honeypot hit databases (IPs observed interacting with decoy infrastructure)
• Check VirusTotal for any active malware or phishing associations
• Check Shodan for exposed services that might indicate compromised infrastructure
• Cross-reference with any relevant sector-specific threat sharing (ISAC feeds, FS-ISAC for financial services, etc.)

Category 7: PTR and DNS Consistency

• Look up the PTR record — does a reverse DNS entry exist?
• Verify forward DNS matches the PTR (FCrDNS check) — important for email, indicative for general traffic
• Check if the hostname pattern reveals infrastructure type (EC2, DigitalOcean droplet, known VPN provider)
• For mail sending: missing or inconsistent PTR records are a hard deliverability problem

Scoring and Action Framework

After running through the checklist, aggregate the findings into a risk decision. A useful framework:

• All green — Clean history, residential ISP, consistent geolocation, no proxy flags, matching DNS. Allow without friction for virtually any use case.
• Minor flags — Commercial VPN, or minor stale abuse history, or minor ASN elevation. Consider soft friction (CAPTCHA) for sensitive operations; allow for standard ones.
• Moderate flags — Datacenter IP with moderate fraud score, or active proxy, or multiple minor signals converging. Require step-up authentication for sensitive operations; block high-value transactions.
• Major flags — High fraud score, active blacklisting, Tor exit, or confirmed malicious activity. Block or heavily scrutinise all non-trivial operations.

Run this checklist regularly on IPs in your infrastructure (to catch compromises early) and in real time on incoming traffic via automated API calls for any security-relevant operation.