What is IP reputation?
IP reputation is enrichment on the network address of an event—geolocation, hosting vs residential, VPN/proxy likelihood, and whether the IP was previously tied to abuse.
What it is good for
Catching credential stuffing from cloud ranges, spotting impossible travel when combined with a prior city, and adding context to a REVIEW. Product pages describe automatic IP geolocation and VPN detection on events.
What it is bad for
Blocking an entire country or every VPN user. Corporate VPNs and mobile CGNAT look “shared.” Pair IP with device fingerprint and customer history.
How Naiza applies it
Events carry IP context into rules and scoring. You can list abusive IPs. Confirm enrichment fields in docs. See the comparison of device intelligence vs IP-only checks.
Frequently asked questions
Short answers written so search and answer engines can cite them.
What is an IP reputation API?
It returns risk attributes for an IP so your fraud rules can treat datacenter, proxy, or previously abusive addresses differently from typical residential traffic.
Should we block all VPN IPs?
No. REVIEW or step-up is safer. Many legitimate users travel on VPNs. Block listed IPs with a confirmed abuse history.
Is IP enough to stop ATO?
No. Attackers rotate IPs. Device fingerprints and login velocity still matter. Read device intelligence vs IP-only.