Some attackers are taking advantage of the lack of IPV4 address space by either purchasing or renting blocks of IP space with good reputations that have been built up over the course of several years. The number of IP addresses required for large scale botnets to operate effectively can be considerable. If they do find them, the IP addresses often are blacklisted quickly by reputation systems and are then useless for the attackers. The better the reputation of the server, the longer the attacker may be able to use the server without detection by the large-scale Web-scanning engines.
Source: https://threatpost.com/attackers-adjusting-tactics-evade-reputation-systems-100711/75730/