Which things are the most important?
Really you don't know very much from an IP address. First thing to note is that an ip address is not the same thing as a user - particularly (and increasingly) with ipv4 addresses. If you've got a significant amount of traffic and identifiable patterns of fraud then you can start building your own reputation database.
Some key points are:
- don't use IP addresses - use netblocks from the whois lookup
- it may be advantageous to differentiate by geography - at least at the country level - there are free lists of net blocks by country
- beware of small networks (up to /10) they are usually servers not end users
- if you've got an authentication mechansim, then track what netblocks individual customers use - apply additional authentication when accessed from a network not seen in the N interactions / the last M weeks for this custmoer
- using reputation services may not have huge benefit - apart from spammer listings, these are usually populated by organisations running services which might be subject to big losses - if you're not running an online banking / payment system then you'll be targeted in a very different way
- use the time (at the client) to determine risk (does customer A usually access the system between, say 11pm and 6am?)
- if possible check the local time on the client matches the expected timezone for the IP address
- watch out for multiple users from the same IP address - once a user has authenticated at an IP address, apply additional checks for the next X units of time for different users from the same IP address
I've not specified exact values for M, N and X - ideally these should be adjustable by network - differentiating between home ADSL/Cable providers, mobile network providers, overseas locations and others.
Track authentication failures - these are your first level of abuse detection.