How this site works
IPThreat works by aggregating submissions from users around the world. As an attacker hits more and more servers, the threat score of that ip address will increase.
Threat score increases decay slowly over time. So if an attacker decides to play nice for a while, their score will drop. As soon as they start attacking again, their score will immediately go back up.
Phishing urls decay much more slowly in threat level.
All of the lists and data on this site are freely available--please follow the License.