IP & Domain Reputation Sources

Overview

IP and domain reputation sources answer one narrow, high-value question: has anyone else already seen this address doing something bad? DNSBLs (Spamhaus, and dozens of smaller free lists) exist mainly to protect mail delivery; broader reputation/threat feeds (AbuseIPDB, GreyNoise, Cisco Talos, VirusTotal) extend the same idea to scanning, botnet C2, proxy and general abuse signals. Distinct from attack-surface management (`attack-surface-management-asm`, which discovers what you OWN) and from protective DNS / secure web gateways (`secure-web-gateway-dns-security`, which blocks a USER's outbound traffic toward a bad destination): this area is sources that answer whether YOUR OWN addresses — the ones your mail servers and edge devices send from — already show up as bad in someone else's data. Pricing ranges from fully free community feeds to enterprise threat-intel subscriptions; several of the strongest sources here are free. CMDash's own IP-reputation module (Essentials+) consumes several of these exact sources — free DNSBLs including blocklist.de, plus AbuseIPDB and GreyNoise Community — to track the tenant's own declared and derived addresses; it does not appear as a vendor row in this area because it operates no reputation feed of its own, only aggregates and tracks others'.

A dirty IP or domain reputation silently kills mail delivery and gets a company's own infrastructure blocklisted by everyone else before anyone internally notices.

Advantages

• Several of the strongest sources (GreyNoise Community, most DNSBLs) are free, so baseline coverage costs nothing
• A DNSBL listing is one of the few reputation signals with an immediate, visible business consequence (blocked mail) — problems here don't stay abstract
• Aggregating multiple independent sources catches what any single one misses; no DNSBL or feed has full coverage

Trade-offs

• No two sources agree — the same IP can be clean on one feed and listed on three others, so a single-source check is not a verdict
• Shared/cloud IP ranges get listed for a neighbor's abuse, not your own — delisting takes real evidence, not just a request
• Commercial threat-intel feeds add real cost for signal that overlaps the free sources

Open-source option

blocklist.de and FireHOL's aggregated ipsets are both genuinely free and self-usable, and AbuseIPDB's and GreyNoise's free tiers cover most of the rest of the commercial gap. CMDash's own IP-reputation sweep already consumes several of these exact free sources — see this area's `long` description for why CMDash itself is not listed as a vendor here.

Vendors & tools in this area

Last updated 2026-09-28 · Next refresh 2026-10-26 (weekly) · Changelog