Bulk IP Reputation & Blacklist Checker

Checking many IPs for blacklists and reputation

Reading logs after an attack or reviewing a firewall rule, you rarely have one address — you have a list. The bulk check screens it in one pass and answers the four questions people ask most about each address: what is its score, how many blacklists carry it, where is it, and what kind of network is it on.

• fail2ban and firewall logs — see which of the addresses you blocked are known attackers.
• Web server access logs — separate IPs sending suspicious requests from hosting and VPN addresses.
• Email headers — look up the sending IPs of a spam run on blacklists.

For the list-by-list breakdown of one address use the IP blacklist check; for fraud risk, the IP fraud score. To turn the results into a firewall block, see the guide to blocking malicious IPs.

Frequently Asked Questions

How many IPs can I check at once?

Up to 100 addresses per pass on the web, 10 passes an hour. For more, call the API in a loop — a free key gets 1,000 checks a day.

What does the bulk check look at?

For each address: the reputation score, matches on 44 threat-intelligence blocklists, community reports, country and connection type (residential, hosting, VPN, Tor). Live DNSBL and RDAP queries are skipped for speed; click an address to see them in its full report.

Can I export the results?

Yes. The CSV button under the results downloads them as a file Excel and Google Sheets open directly.

What format should the list be in?

One IPv4 or IPv6 address per line. Duplicate lines count once; private/reserved addresses and invalid lines are skipped and counted.