Trust score
How WorldIP.io computes a transparent 0–100 trust score for any IP, range, ASN or organization. trust-vectors v1.1.0 · experimental
The model
The score is additive and transparent. Every entity starts at a neutral baseline of 65, and each signal (“vector”) nudges it up or down by a fixed, explainable amount — so base + Σ(factors) = score. Every IP page lists the baseline plus each factor, so the number is auditable rather than a black box. It is an informational signal, not a definitive verdict.
Bands
Reserved / bogon space is not scored (shown as N/A).
Signals & weights
Threat-intel blocklists — multi-provider, tiered and deduped per provider. Per-tier caps (high ≤50, medium ≤25, low ≤10; overall ≤60) so stacked low-confidence hits can’t outweigh one high-confidence listing. Checked & clean → +5.
Exposure (Shodan) — known CVEs on exposed services (up to −35), malicious tags such as botnet/c2/malware (up to −50), and a large open-port surface (−8).
Reverse DNS — forward-confirmed PTR (FCrDNS) +10, a plain PTR +5, no PTR −5.
Routing (BGP) — multiple-origin (MOAS) anomaly −12, RPKI-valid +10, RPKI-invalid −20.
Allocation age — long-established (≥15y) +6, established (≥8y) +3, very recently allocated (≤2y) −3.
Allocation category
What the address space is for shifts the score. Categories are derived from organization and ASN names (keyword heuristics) and cascaded onto IP ranges. Unknown is neutral — we never penalize an entity just because we haven’t classified it.
Experimental — v1.1.0
This model is experimental: weights and category rules change frequently, and the trust-vectors version bumps on every update (currently v1.1.0). Planned refinements include a dedicated ASN-type source for broader category coverage and per-signal confidence weighting. The score is a transparent heuristic for triage and enrichment — not an authoritative reputation verdict.
