User Guide

WEB REPUTATION SCORES
CHAPTER 14: WEB REPUTATION FILTERS 311
WEB REPUTATION SCORES
Web Reputation Filters use statistically significant data to assess the reliability of Internet
domains and score the reputation of URLs. Data such as how long a specific domain has been
registered, or where a web site is hosted, or whether a web server is using a dynamic IP
address is used to judge the trustworthiness of a given URL.
The web reputation calculation associates a URL with network parameters to determine the
probability that malware exists. The aggregate probability that malware exists is then mapped
to a Web Reputation Score between -10 and +10, with +10 being the least likely to contain
malware.
Example parameters include the following:
• URL categorization data
• Presence of downloadable code
• Presence of long, obfuscated End-User License Agreements (EULAs)
• Global volume and changes in volume
• Network owner information
• History of a URL
• Age of a URL
• Presence on any block lists
• Presence on any allow lists
• URL typos of popular domains
• Domain registrar information
• IP address information
Note — IronPort does not collect personally identifiable information such as usernames,
passwords, or client IP addresses.