IP Reputation Is Dead. GreyNoise Just Proved What Our Behavioral Engine Has Known Since December.
GreyNoise analyzed 4 billion malicious sessions over three months. The finding: 78% of them evaded IP reputation checks entirely.
Not because the attackers were sophisticated. Not because the blocklists were outdated. Because the traffic came from your neighbor's WiFi.
The Residential Proxy Problem
39% of the malicious sessions in GreyNoise's study originated from home networks. Real residential IP addresses. Real ISPs. Addresses that have never been on a blocklist because they belong to real people who unknowingly installed a free VPN or ad blocker that sells their bandwidth.
The attacker routes through Grandma's Comcast connection in Ohio. Your IP reputation system checks AbuseIPDB — clean. Checks Spamhaus — clean. Checks VirusTotal — clean. Passes. The scan completes. The credentials get stuffed. The next request comes from a different grandmother in a different state.
89.7% of these residential IPs stay active in malicious operations for less than a month. By the time the reputation databases flag them, the attacker has rotated to the next unwitting proxy node. 683 different ISPs. China, India, Brazil leading the source regions.
GreyNoise's conclusion: stop relying on IP reputation as a primary signal. Shift to behavioral detection.
We shifted in December.
5.37 Million Behavioral Decisions
Our OZ decision engine doesn't ask "is this IP on a list?" It asks "is this IP acting like an asshole?"
Sequential path probing — hitting /wp-login.php, then /wp-admin, then /xmlrpc.php in order. That's not a human browsing. That's a scanner. The IP might be clean on every reputation database in existence, but the behavior is a tell.
Login page fixation — 47 requests to /api/v1/auth with different credential pairs in 90 seconds. Residential IP, zero abuse score, never been blocked anywhere. But the behavior screams credential stuffing.
Timing signatures — requests arriving at perfectly regular intervals with zero jitter. Humans don't click every 2.000 seconds. Bots do. Even when they route through residential proxies, the timing is machine-precise.
5,374,056 autonomous decisions since we started. Each one a behavioral classification: is this traffic legitimate, suspicious, or hostile? Not based on where it comes from. Based on what it does when it gets here.
The Stealthy Outliers
We built an entire detection category for the gap GreyNoise identified. We call them "stealthy outliers" — sessions that score zero on AbuseIPDB and clean on traditional reputation, but exhibit hostile behavior.
The most dangerous cluster: VT-validated stealth threats. VirusTotal flags the IP (someone submitted it as malicious), but AbuseIPDB shows zero reports. The IP is known-bad by one system and invisible to another. That's a residential proxy that got caught by one researcher but hasn't made it into the crowd-sourced databases yet.
Our behavioral engine catches them regardless. The IP is clean. The behavior isn't.
What the Numbers Say
| Signal | What It Catches | What It Misses |
| IP reputation alone | Known bad actors, repeat offenders | 78% of attacks (GreyNoise) |
| Behavioral scoring alone | Pattern-based attacks, scanners, credential stuffing | Slow-and-low APTs, zero-day exploitation |
| Both together | Known bad + behavioral anomalies + stealthy outliers | Sophisticated nation-state with custom tooling |
IP reputation is necessary. It catches the lazy 22%. But if it's your only signal, you're blind to everything that matters.
The Precursor Advantage
Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →
Our PreCog system takes behavioral scoring one step further — it identifies infrastructure activation patterns 1-5 hours before the attack materializes. When a residential proxy network starts spinning up new nodes in a specific geographic pattern, the precursor signal fires before the first scan hits your perimeter.
GreyNoise found that 89.7% of residential IPs churn within a month. We found that the churn itself is the signal. When a batch of new residential IPs appears from the same ISP in the same region within the same hour, something is staging. You don't need to know the IP is bad — you need to know the pattern is wrong.
1.97 Million Blocks
IP reputation feeds our blocklist. Behavioral scoring feeds our autonomous response. Together: 1,970,283 block events. Each one a threat stopped before it reached the network.
But 78% of those blocks aren't triggered by reputation. They're triggered by behavior. The residential proxy with the clean IP that started brute-forcing SSH at 3 AM gets blocked on the third attempt, not because we recognized the IP, but because the behavior pattern matched.
What GreyNoise Recommends (and What We Already Do)
| GreyNoise Recommendation | Our Implementation |
| Behavioral detection over IP reputation | OZ decision engine — 5.37M decisions |
| Sequential probing pattern analysis | Path-sequence scoring in behavioral profiler |
| Device fingerprinting that survives IP rotation | User-agent + TLS fingerprint + timing analysis |
| Focus on login page targeting (1.3% of sessions) | Auth endpoint monitoring with credential stuffing detection |
| Account for residential proxy rotation | Precursor surge detection — batch IP appearance patterns |
We're not claiming GreyNoise is late. They did the research. They quantified the problem. 4 billion sessions is a dataset we can't match. What we're saying is: the solution has been running since December 2025, making millions of behavioral decisions, and the academic validation just arrived.
The Feed
Our STIX feed carries behavioral indicators alongside traditional IOCs. When we block a residential proxy for hostile behavior, that behavioral signature goes into the feed. Not just the IP (which will be useless in a month), but the pattern — the path sequence, the timing signature, the fingerprint cluster.
275+ organizations in 46 countries consume this feed. They're not just getting a list of bad IPs that expire in 30 days. They're getting behavioral signatures that work regardless of source IP.
https://analytics.dugganusa.com/api/v1/stix-feed?format=splunk&api_key=YOUR_KEYIP reputation is dead as a primary signal. Behavior is the signal that survives rotation. We've been building on that thesis since day one.
GreyNoise studied 4 billion sessions and found 78% evade IP reputation. Our behavioral engine has made 5.37 million autonomous decisions since December without IP reputation as the primary signal. The stealthy outlier cluster — VT-flagged but AbuseIPDB-invisible — is the residential proxy gap in action. We catch them on behavior, not address.
The question isn't "is this IP bad?" The question is "is this IP acting like an asshole?" Our engine answers that 5.37 million times and counting.
The cheapest, fastest, most accurate threat feed on the internet.
275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.
Look up an IOC → · Audit your brand on AIPM → · See pricing →
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=ip-reputation-is-dead-greynoise-just-proved-what-our-behavioral-engine-has-known-since-december