I would guess that is a little bit of journalistic summarization, and what the author means is that the IPs used in the attack had a reasonable reputation. That's what made me wonder whether they were talking about residential proxies.