A computer system comprising: one or more computer processors; and a tangible storage device storing one or more modules configured for execution by the one or more computer processors in order to cause the computer system to: determine an IP address for which a threat score is to be determined; access network alert datasets from each of one or more data sources, the network alert datasets comprising: a plurality of recorded network threat events, date and time of each of the plurality of recorded network threat events, an originating IP address for each of the plurality of recorded network threat events, and/or an event type of each of the plurality of recorded network threat events; determine which of the network alert datasets includes one or more occurrences of the IP address, wherein each occurrence indicates a threat by the IP address; for each of the data sources for which the IP address is a member of the corresponding network alert dataset: determine a quantity of occurrences of the IP address in the network alert dataset; determine a recency of each occurrence of the IP address in the network alert dataset, wherein recency is determined based on an amount of time between respective occurrences and a current time; determine a weighting factor for each of the data sources indicating expected accuracy of respective occurrences indicated in the network alert dataset of the data source; and determine the threat score for the IP address based at least on the determined quantity of occurrences, the recency of occurrences, and the weighting factor for each of the data sources. one or more computer processors; and a tangible storage device storing one or more modules configured for execution by the one or more computer processors in order to cause the computer system to: determine an IP address for which a threat score is to be determined; access network alert datasets from each of one or more data sources, the network alert datasets comprising: a plurality of recorded network threat events, date and time of each of the plurality of recorded network threat events, an originating IP address for each of the plurality of recorded network threat events, and/or an event type of each of the plurality of recorded network threat events; determine which of the network alert datasets includes one or more occurrences of the IP address, wherein each occurrence indicates a threat by the IP address; for each of the data sources for which the IP address is a member of the corresponding network alert dataset: determine a quantity of occurrences of the IP address in the network alert dataset; determine a recency of each occurrence of the IP address in the network alert dataset, wherein recency is determined based on an amount of time between respective occurrences and a current time; determine a weighting factor for each of the data sources indicating expected accuracy of respective occurrences indicated in the network alert dataset of the data source; and determine the threat score for the IP address based at least on the determined quantity of occurrences, the recency of occurrences, and the weighting factor for each of the data sources. determine an IP address for which a threat score is to be determined; access network alert datasets from each of one or more data sources, the network alert datasets comprising: a plurality of recorded network threat events, date and time of each of the plurality of recorded network threat events, an originating IP address for each of the plurality of recorded network threat events, and/or an event type of each of the plurality of recorded network threat events; determine which of the network alert datasets includes one or more occurrences of the IP address, wherein each occurrence indicates a threat by the IP address; for each of the data sources for which the IP address is a member of the corresponding network alert dataset: determine a quantity of occurrences of the IP address in the network alert dataset; determine a recency of each occurrence of the IP address in the network alert dataset, wherein recency is determined based on an amount of time between respective occurrences and a current time; determine a weighting factor for each of the data sources indicating expected accuracy of respective occurrences indicated in the network alert dataset of the data source; and determine the threat score for the IP address based at least on the determined quantity of occurrences, the recency of occurrences, and the weighting factor for each of the data sources. determine a quantity of occurrences of the IP address in the network alert dataset; determine a recency of each occurrence of the IP address in the network alert dataset, wherein recency is determined based on an amount of time between respective occurrences and a current time; determine a weighting factor for each of the data sources indicating expected accuracy of respective occurrences indicated in the network alert dataset of the data source; and determine the threat score for the IP address based at least on the determined quantity of occurrences, the recency of occurrences, and the weighting factor for each of the data sources.