IP Reputation Services

IP Reputation Service brings up-to-date, actionable threat intelligence to security operators charged with fending off modern attacks. Powered by Webroot’s Threat Intelligence platform, the service integrates seamlessly with Web Application Firewalls to optimize performance, reduce the number of false positives, block malicious bots and adjust the authentication and security policies based on user context and behavior.

IP Reputation Service optimizes the efficiency of your WAF policy by leveraging up-to-date threat intelligence:

  • Threat intelligence: The Webroot platform analyzes, classifies and scores URLs, IPs and files using advanced machine learning and behavioral analysis. A contextual analysis engine correlates data for increased granularity and accuracy.
  • Near real-time: Your WAF uses up-to-date information on which IP addresses to trust and which ones to be weary of based on how attackers use them. Good intelligence helps admins to make better decisions and improve security and efficiency.
  • Reputation score: The service correlates intelligence across linking IPs, URLs, files, mobile applications and billions of records to establish a reputation score identifying the risk of an attack originating from a given source IP.
  • Threat categories: IP addresses can belong to one or several of the following threat categories: Windows Exploits, spam sources, Denial of Service, Phishing, Reputation, Mobile Threats, Anonymous Proxies, Botnets, Scanners, Web Attacks. IP Reputation Service detects and blocks them.
  • Accurate: False positives are avoided by collecting data from plus than 37 million sensors, identifying suspicious IPs, gathering and correlating evidence, placing IPs on “trial”, and releasing them once their “isolation“ service has been served.
  • Dynamic: 100 000 new IP addresses are added to the list and 38% of IPs are removed every day as a result of evaluating more than 4 Billion IP addresses, 27+ Billion URLs, 20+ Billion mobile apps and more than 60 Million E-Mail domains.
  • Actionable: Both the IP reputation score and threat category can be used to determine how to handle requests from various IPs. Security and authentication policies can be different for trustworthy and questionable IP addresses.
  • User Reputation: User Reputation Scoring tracks users, evaluates their trustworthiness based on behavior (within the application) and context, including geolocation and source IP, in order to stop illegal and dangerous activities.