IP Address Lookup & Reputation Database

An IP reputation database is a record of whether an IP address has been involved in malicious behaviour. IP-DB combines 42 open threat-intelligence feeds, community abuse reports and live DNSBL queries into a single 0-100 confidence score for each address. The higher the score, the more independent evidence there is that the address has been used for brute-force attacks, port scanning, spam or botnet traffic.

Type the address into the search box at the top of this page. The result page shows its confidence score, which blocklists it appears on, DNSBL matches, the WHOIS/RDAP owner, its ASN, country and any community reports. No account is needed. You can run the same check on up to 100 addresses at once with the bulk tool, or from your own code through the REST API.

From three places: 42 open threat-intelligence feeds pulled every half hour, live DNSBL checks run at query time (Spamhaus ZEN, SpamCop, Barracuda, SORBS), and abuse reports filed by users. Every feed is listed individually on the Data Sources page with its coverage, licence and the weight it carries in the score.

Lookups through the web interface are free and need no account at all. The REST API has a free tier of 1,000 checks a day — create an account, generate a key, and you are done. Higher volumes are listed on the Pricing page.

First fix what caused the listing: close the vulnerability on the server, clean up compromised accounts, shut any open relay or proxy. Our record updates automatically once the upstream feed drops the address. If you believe the listing is wrong, write to us through the contact form with the details — a review usually takes one business day.

Yes. The Integrations page carries copy-and-run configurations for FortiGate threat feeds, Palo Alto External Dynamic Lists, pfSense, Wazuh, fail2ban and nftables. If you are writing your own automation, the REST API returns JSON and can check hundreds of addresses per call.