IP Reputation Checker
Check whether an IP address has been reported for attacks, spam or scanning, which blocklists carry it, and who operates the network it belongs to.
When to check an IP
Run it on addresses from your firewall, web server or SSH logs that are hammering a login page, on the sending IP of a suspicious email, or on a new server before you trust it with outbound mail.
Pair it with the reverse IP lookup to see what is hosted on the same address.
Frequently asked questions
How is the verdict decided?
Mainly from AbuseIPDB's abuse confidence score, built from reports by thousands of server operators over the last 90 days. 75% or higher is marked malicious, 25% or higher, or any blocklist hit, is marked suspicious.
An IP I trust shows reports. Is it compromised?
Not necessarily. Shared addresses such as VPN exits, mobile carrier NAT and cloud hosting are reused by many customers, so one bad tenant can attract reports for an address you also use. Check the report dates and the usage type.
Does checking an IP alert its owner?
No. The lookup queries reputation databases only and sends nothing to the address itself.
What should I do with a malicious result?
If it is hitting your server, block it at the firewall or WAF and keep the logs. If it is your own address, find the infected host or misconfigured service first, then request delisting from the blocklists that carry it.
Free to use within a daily limit per visitor. Use it on systems you own or are allowed to test, see the acceptable use policy.