IP reputation scoring system

1. If BitNinja detects a malicious request from an IP address, then it will be on the account-level challenge list
2. After generating an incident at four unique BitNinja accounts, the IP will be globally challenglisted
3. If there are more than 50 incident logs about a globally challengelisted IP address, we will send an abuse email to the email address associated with the IP address
4. After 500 incidents, the IP address will be blocklisted globally
5. After 5000 incidents, the IP will be listed on the Essential list, which means that the IP address can not be delisted and BitNinja won’t log the requests from this IP address.

Any manual IP delisting is automatically broadcasted. BitNinja agents do refresh automatically every 3 seconds, so this process takes around this amount of time.