A computer system comprising: one or more computer processors; and a tangible storage device storing one or more modules configured for execution by the one or more computer processors in order to cause the computer system to: determine an IP address for which a usage score is to be determined; access network usage datasets from each of one or more data sources, the network usage datasets comprising: a plurality of recorded network usage events, date and time of each of the plurality of recorded network usage events, an originating IP address for each of the plurality of recorded network usage events, and/or an event type of each of the plurality of recorded network usage events; determine which of the network usage datasets includes one or more occurrences of the IP address, wherein each occurrence indicates a usage by the IP address; for each of the data sources for which the IP address is a member of the corresponding network usage dataset: determine a quantity of occurrences of the IP address in the network usage dataset; determine a recency of each occurrence of the IP address in the network usage dataset, wherein recency is determined based on an amount of time between date and time of respective occurrences and a current time; determine a weighting factor for each of the data sources indicating authority of each of the data sources; and determine the usage score for the IP address based at least on the determined quantity of occurrences, the recency of occurrences, and the weighting factor for each of the data sources. one or more computer processors; and a tangible storage device storing one or more modules configured for execution by the one or more computer processors in order to cause the computer system to: determine an IP address for which a usage score is to be determined; access network usage datasets from each of one or more data sources, the network usage datasets comprising: a plurality of recorded network usage events, date and time of each of the plurality of recorded network usage events, an originating IP address for each of the plurality of recorded network usage events, and/or an event type of each of the plurality of recorded network usage events; determine an IP address for which a usage score is to be determined; access network usage datasets from each of one or more data sources, the network usage datasets comprising: a plurality of recorded network usage events, date and time of each of the plurality of recorded network usage events, an originating IP address for each of the plurality of recorded network usage events, and/or an event type of each of the plurality of recorded network usage events; determine which of the network usage datasets includes one or more occurrences of the IP address, wherein each occurrence indicates a usage by the IP address; for each of the data sources for which the IP address is a member of the corresponding network usage dataset: determine a quantity of occurrences of the IP address in the network usage dataset; determine a recency of each occurrence of the IP address in the network usage dataset, wherein recency is determined based on an amount of time between date and time of respective occurrences and a current time; determine a weighting factor for each of the data sources indicating authority of each of the data sources; and determine the usage score for the IP address based at least on the determined quantity of occurrences, the recency of occurrences, and the weighting factor for each of the data sources. determine a quantity of occurrences of the IP address in the network usage dataset; determine a recency of each occurrence of the IP address in the network usage dataset, wherein recency is determined based on an amount of time between date and time of respective occurrences and a current time; determine a weighting factor for each of the data sources indicating authority of each of the data sources; and determine the usage score for the IP address based at least on the determined quantity of occurrences, the recency of occurrences, and the weighting factor for each of the data sources.