Abuse IP Check & IP Reputation Database

An IP reputation database is a record of whether an IP address has been involved in malicious behaviour. IP-DB combines 45 open threat-intelligence feeds, community abuse reports and live DNSBL queries into a single 0-100 confidence score for each address. The higher the score, the more independent evidence there is that the address has been used for brute-force attacks, port scanning, spam or botnet traffic.

Type the address into the search box at the top of this page. The result page shows its confidence score, which blocklists it appears on, DNSBL matches, the WHOIS/RDAP owner, its ASN, country and any community reports. No account is needed. You can run the same check on up to 100 addresses at once with the bulk tool, or from your own code through the REST API.

From three places: 45 open threat-intelligence feeds pulled every half hour, live DNSBL checks run at query time (SpamCop and Barracuda on every lookup; PSBL, UCEPROTECT, Mailspike and more on the IP blacklist check), and abuse reports filed by users. Every feed is listed individually on the Data Sources page with its coverage, licence and the weight it carries in the score.

Lookups through the web interface are free and need no account at all. The REST API has a free tier of 1,000 checks a day — create an account, generate a key, and you are done. Higher volumes are listed on the Pricing page.

First fix what caused the listing: close the vulnerability on the server, clean up compromised accounts, shut any open relay or proxy. Our record updates automatically once the upstream feed drops the address. If you believe the listing is wrong, write to us through the contact form with the details — a review usually takes one business day.

Yes. The Integrations page carries copy-and-run configurations for FortiGate threat feeds, Palo Alto External Dynamic Lists, pfSense, Wazuh, fail2ban and nftables. If you are writing your own automation, the REST API returns JSON and can check hundreds of addresses per call.

It is an address that has been seen attacking or misusing other systems: brute-forcing SSH or login forms, scanning ports, sending spam, or running as a botnet node or open proxy. IP-DB records an address when an open threat feed lists it, when users report it, or when a DNSBL flags it, and turns that evidence into a single 0-100 abuse confidence score.

Report it in two places. First here: the Report This IP button on the address's page adds your report to the score everyone who checks it sees. Second, to the network owner: the same page's Network Information card lists an Abuse contact whenever the regional registry names one. Send your logs and timestamps there, because the network owner is the only party that can act on the host itself.

Yes. A free account gets 1,000 requests a day, 10,000 once your email is verified. /api/v1/check/<ip> returns the abuse score and its breakdown, matching blacklists, DNSBL listings, network type (residential, hosting, VPN, Tor), ASN, location and abuse contact as JSON, and /api/v1/feed.txt serves the whole list as plain text for firewalls.

Yes. Add the MCP server at https://ip-db.com/mcp as a connector in Claude, ChatGPT, Cursor or any other MCP client — no key needed. The assistant can then look up an IP's reputation and blacklist status, and a domain's WHOIS record, directly. For agents that call the REST API, the OpenAPI spec is at /openapi.json.