A malicious IP is any IP address that has been positively associated with malicious activity. Most firewalls and cybersecurity tools use a metric called IP reputation, which evaluates an IP’s trustworthiness using parameters and characteristics like: