What is IPsum?
IPsum is an aggregated IP threat intelligence project maintained by a security researcher that combines data from multiple independent blocklists to produce a reputation score (1–8) for each IP address. Higher scores indicate more sources have flagged the IP as malicious. IPsum is widely used by security professionals as a lightweight, high-confidence blocklist and is frequently imported into firewall rules, SIEM systems, and threat hunting workflows.
Why IPsum flags legitimate domains
- Your IP appeared in two or more independent threat intelligence feeds aggregated by IPsum
- A compromised application on your hosting was flagged by multiple security sensors simultaneously
- Your shared hosting IP block appeared in attack logs across multiple independent monitoring networks
- Your IP's threat reputation cascaded from a previous tenant whose activity was widely documented
- Your server was involved in a distributed attack campaign logged by multiple feed operators
What a listing means for your business
Because IPsum aggregates multiple independent feeds, a high IPsum score signals to security teams that an IP is broadly flagged across the industry, not just by one source. This makes IPsum a particularly trusted signal, and firewall rules importing IPsum typically block aggressively on any positive score.
How BrandsDefender gets you delisted
We verify that your domain is clean, prepare the evidence IPsum needs, file the false positive dispute through the right channel and follow up until the flag is removed. No cure, no pay.
Frequently asked questions
How is IPsum different from a single-source blocklist?
IPsum aggregates from many independent sources. An IP needs to appear in at least one source to be listed, and the score increases with each additional source. This cross-validation makes IPsum a high-confidence signal used aggressively in firewall rules.
Does removing an IP from IPsum require removing it from all source feeds?
IPsum recalculates based on current feed data, so the listing goes away once the underlying source feeds are cleaned. Our team identifies which upstream feeds are contributing and manages the removal from each.