IP reputation & threat intelligence for sysadmins, hosters & developers

Two paths, depending on how fresh you need the data. For broad coverage, pull the community blacklist feed directly, an hourly-refreshed text file you can drop into an ipset with a single cron job, no API key required. For per-IP scoring at the moment of a request, for example inside a fail2ban action or a custom firewall rule, call the REST API with a free account (1,000 checks per day). We publish working fail2ban filter examples and a ready-to-run iptables ipset script in the documentation, plus nginx and Postfix snippets. Most operators combine both: the feed for bulk blocking, the API for real-time decisions on traffic that is not yet on the list.

Every IP carries a confidence score from 0 to 100 that estimates how likely it is to be malicious. Five weighted components feed it: the number of reports, reporter diversity (independent sources count for more than one noisy reporter), recency (reports under 24 hours old weigh most), the severity of the threat category, and a bonus for reports confirmed by verified honeypots. Reports decay exponentially on a 30-day half-life, after 30 days a report carries half its weight, after 60 days a quarter, so an IP that stops attacking is delisted automatically. An IP needs at least five reports to exceed 50 and ten to pass 75. Add verbose=true to any check to see the full breakdown.

Plain-text and JSON exports are served from /wp-json/reportedip/v2/blacklist; add ?format=txt for one IP per line or ?format=csv for spreadsheets and SIEM imports. The same data is mirrored to Git at github.com/reportedip/reportedip-blacklist with a diff-friendly commit history, so you can track exactly which IPs were added or removed each day and pin a specific revision if you need reproducible builds. The feed is free for any use and attribution is appreciated. Entries are scored by the same confidence engine as the API, so a single threshold keeps your block list both current and low on false positives.

Yes. The DNS / RBL Zone add-on gives you a private, token-authenticated zone, <token>.bl.reportedip.de that any mail server, firewall or spam filter can query exactly like Spamhaus or any other DNSBL. It follows RFC 5782, covers both IPv4 and IPv6, and returns the usual 127.0.0.x response codes so existing Postfix, Exim or rspamd configurations work without custom glue. Because lookups happen over DNS they are cached by your resolver and add almost no latency to mail flow. The zone is rebuilt from the same scored dataset as the public feed, and each token has its own daily query quota.

Yes. ReportedIP is operated by a German company (CMS ADMINS, Munich) and all processing runs on German infrastructure under EU data-protection law (GDPR). Every sub-processor is EU-based: the managed reportedIP mail / SMS relay, Stripe Payments Europe (Ireland) for billing, and sevDesk (Germany) for invoicing. No personal data leaves the EU, and a data-processing agreement is available for business customers. IP addresses in reports are handled as the minimum necessary for the security purpose and aged out over time. For teams with a compliance requirement to keep threat-intelligence data inside the EU, this is the core reason they pick ReportedIP over US-hosted alternatives.

No. The IP check at the top of this page is open to everyone and needs no signup; it is rate-limited to 100 lookups per IP per day to keep it free and abuse-resistant. That is enough for occasional manual checks when you spot a suspicious address in your logs. For programmatic access, scripting, fail2ban actions, bulk work or anything that runs on a schedule, create a free account, which raises the limit to 1,000 checks and 50 reports per day and gives you an API key plus a usage dashboard. Higher tiers lift the quotas further and add bulk endpoints and multi-site management.

Three concrete differences. First, ReportedIP is EU-hosted with explicit GDPR compliance and EU-only sub-processors, with a data-processing agreement on offer. Second, the scoring is fully transparent: add verbose=true to any check and you see every component of the confidence score, report count, diversity, recency, severity, honeypot bonus, rather than an opaque number. Third, the clients are open source where they can be: the WordPress plugins (Hive and Hive Light), the honeypot server and the DNS checker are GPL-2.0 and auditable on GitHub or wp.org. Scoring is time-decayed on a 30-day half-life with a configurable honeypot weighting, so dormant attackers fall off automatically and synthetic intel stays trustworthy. See the full ReportedIP vs. AbuseIPDB comparison.

Yes. Any system can submit reports via POST /reportedip/v2/report with a free API key, a fail2ban-style automated reporter running on your own server is exactly the kind of contribution the network is built on. Honeypot operators get a special badge and their reports carry extra weight, because honeypot traffic is unsolicited and therefore high-signal, but you do not need one to take part. Reporter diversity is itself a scoring factor, so every independent source you add makes the whole dataset more reliable. Just register a free account, generate a key, and point your existing log-watching tooling at the report endpoint.

Both editions of the Hive WordPress security plugin are free and open source under GPL-2.0: the Full Edition on GitHub with 16 attack sensors incl. a Web Application Firewall and four-method two-factor authentication, and the Light Edition on WordPress.org for focused brute-force protection. Hive PRO is an optional subscription on top of the Full Edition: it connects your sites to the managed, EU-hosted 2FA relay for SMS and e-mail codes, no Twilio account, no API keys, with 25 SMS and 500 e-mails per month included, and one licence covers three domains. Agencies and shops with more sites take Business, which covers fifteen. The plugin itself stays free; the paid plans only add the managed services. See the pricing page for current plans.