What IP Reputation Actually Means

'IP reputation' is a category label, not a measurement. When a provider's marketing claims 'clean IPs with high reputation' or when a target returns a reputation-based block, neither statement refers to a single number from a single system. They refer to an unspecified combination of signals from an unspecified subset of the databases that maintain IP metadata.

Multiple independent databases maintain separate signals for each IP. Different targets query different databases. A provider that cleans its IPs from database A cannot clean them from database B — it may not even know database B is the one the target is querying. This is why reputation-based blocks don't always clear after switching providers.

Commercial IP intelligence services — MaxMind GeoIP, IPinfo, Proxycheck.io, IPQualityScore, IPAPI — maintain databases that map IP addresses to ASN classification, geolocation, proxy/VPN detection flags, and fraud risk scores. Each database has its own data sources, update cycles, and scoring methodology. They are not synchronized. An IP that scores clean on one service may score high-risk on another depending on what abuse signals that service has indexed for that IP.

Threat intelligence feeds — Spamhaus, AbuseIPDB, Emerging Threats — track IPs associated with spam, credential stuffing, scraping, and malware distribution. Entries are submitted by network operators and security researchers. Removal from these feeds requires contacting the feed operator and demonstrating the abuse has stopped — a process that takes days to weeks and isn't guaranteed. An IP purchased from another operator may carry Spamhaus entries that predate the purchase.

Target-proprietary reputation is the signal operators cannot audit or reset. Major platforms maintain internal IP scoring built from their own traffic history: how many requests an IP has made, whether it triggered challenges, what account behavior it's associated with. This scoring is invisible, not published, and persists across provider changes. Switching to a different residential provider doesn't clear what a target's internal system has recorded about the IPs that provider's customers were previously using.

ASN classification is the most stable reputation signal — it is a structural property of the IP's registration, not a dynamic score. A datacenter IP's commercial ASN classification does not change regardless of how the IP is used. Moving to a residential IP type changes this signal permanently. Switching between datacenter providers does not — the new provider's IPs carry the same commercial ASN classification.

Per-IP abuse history is tied to the IP address, not to the customer using it. When a proxy provider rotates to a fresh IP — one that hasn't appeared in abuse databases — the history score for that specific address is clean. The history follows the IP when it's recycled through different customers or purchased by different providers. This is why 'fresh IPs' are a real differentiation in provider marketing: IPs that haven't been in active proxy rotation have no accumulated abuse history.

Shared pool contamination is the real-time reputation risk. On a shared proxy IP, every customer's traffic contributes to the IP's behavior pattern as seen by targets. One customer running aggressive scraping against a target raises the IP's risk score for all customers using the same address. Providers mitigate this through pool segmentation — grouping customers by use case to reduce cross-contamination — but shared IPs in any pool carry this structural risk.

If the new provider sources IPs from the same upstream ASN block as the previous provider — which is common in ISP proxy and datacenter markets where IP supply is limited — the new IPs carry the same ASN classification and may carry overlapping abuse history. The target's IP intelligence layer sees the same origin signals. The block condition is unchanged.

'Clean IP' claims from providers refer to what the provider can clean: their own platform's usage history, and the abuse databases they actively monitor and remediate. They do not refer to target-proprietary scoring, threat intel feeds the provider doesn't submit to, or database entries from before the provider acquired the IPs. A provider can truthfully claim clean IPs on the databases they manage and have no visibility into the database the target is actually querying.

Block rate unchanged after switching to a new provider with 'clean' IPs means the reputation signal the target uses is not what the provider cleaned. The next diagnostic step is identifying which signal — ASN, specific blocklist, target-proprietary — before switching again.

Shared IPs accumulate reputation from all customers on the same address simultaneously. Reputation degradation is faster, less predictable, and outside the operator's control. The benefit is cost — shared IPs are cheaper per unit because the infrastructure is distributed across more customers. For workloads where the target's IP scoring has a wide acceptance threshold, shared pool contamination rarely becomes the binding constraint.

Dedicated IPs isolate reputation to a single customer's traffic. Degradation is entirely the operator's own — slower on moderate-volume workloads, faster on aggressive ones. The premium is worth it when shared pool contamination demonstrably increases block rates on the target. Paying dedicated pricing for a target with a wide IP acceptance threshold is cost overhead with no operational benefit.

Fresh IPs — addresses that have not been in active proxy rotation — carry no accumulated abuse history in the databases that update based on observed traffic. They do carry ASN classification, geolocation, and any history from before they entered proxy rotation. 'Fresh' is a partial clean, not a full reset. The freshness advantage degrades quickly under heavy use as the IP accumulates new history.