Metrics providing the capability to rank results in this way are often based on a range of website characteristics, including webpage content and technical configuration features of the associated domain name.

This study considers the case of website hosting characteristics, with a specific focus on the IP address at which the website is hosted. The IP address – and, by extension, the associated hosting service provider – can be an important factor to consider, as hosting providers can vary in their level of attractiveness to infringers, based on a range of factors such as their compliance to takedown requests.

The analysis presented in this case utilises data from an IP address ‘blacklist’, compiled using insights from any identified association of the address in question with content found to be infringing, such as use for spamming or malware distribution. The construction of a threat-score component based on the host IP-address is then presented, calculated using the proximity of the IP address in question to other addresses explicitly included in the blacklist. The algorithm is based on the subdivision of IP-address space into ‘netblocks’, across which patterns in the frequency of infringing content are also considered.

You can download the study here.