Frequently Asked Questions

ReportedIP is a community-driven IP reputation service. It collects reports of malicious IP addresses from WordPress sites, Linux servers, honeypots and manual submissions, scores every address and makes the result available through a REST API, a downloadable blacklist and a DNS zone.

Anyone can check an address for free. Registered users can report attackers and get higher quotas. The service is operated from Germany under the GDPR and runs on servers in Germany.

Yes. The free plan includes 1,000 IP checks and 50 reports per day, which is enough for most small and medium websites. Lookups without an API key are possible too, limited to 100 per day per IP address.

Paid plans raise the quotas and add bulk operations, several domains per licence, Linux server licences and managed delivery of mails and SMS for two-factor login. See the pricing page.

The Confidence Score (0 to 100) says how likely an IP address is to be malicious. It is calculated from:

• Number of reports: more reports raise the score.
• Reporter diversity: reports from different sources carry more weight than many reports from one source.
• Recency: recent reports count more than old ones.
• Severity: severe attack categories raise the score more.
• Honeypot data: reports from verified honeypots receive a bonus.

Reports lose weight as they age (30-day half-life). On top of that, the whole score falls once an address goes quiet: after two weeks without a new report it halves every 30 days, so an address that stops attacking drops off the blacklist on its own. Details: Confidence Score.

Three concrete differences. (1) Operated in Germany under the GDPR, on servers in Germany. (2) Open clients: the WordPress plugin Hive and the DNS checker are GPL-licensed and auditable, the honeypot server is source-available. (3) Scores that age: reports lose weight on a 30-day half-life and quiet addresses fall off the list automatically, while verified honeypot reports carry extra weight.

For a side-by-side breakdown, see the AbuseIPDB alternative comparison.

Two products for two kinds of systems:

• ReportedIP Hive, the WordPress security plugin with 16 attack sensors, a Web Application Firewall and four-method two-factor login (SMS codes from the Professional plan). Free in every mode. It comes from WordPress.org; the features of the paid plans come with the ReportedIP Hive Pro add-on.
• ReportedIP Agent for Linux servers: it reads the logs of SSH, mail, web and FTP services, blocks attackers in the kernel and loads the community blacklist. Licensed per server.

The raw data is available in three forms: the REST API, the blacklist feed and the DNS/RBL zone for mail servers. On top of that come fifteen free tools, including the self-hosted Honeypot Server. Overview: Products.

Registration takes a minute:

1. Open the Register page and enter your email address and a password.
2. Accept the Privacy Policy and Terms of Use.
3. Click the activation link in the email we send you.
4. You land in your Dashboard.

Important: you can only log in after confirming your email address. If the activation mail does not arrive within a few minutes, check your spam folder.

In your Dashboard, open Subscription. Professional and Business are booked there by self-service Stripe checkout, monthly or yearly. Current prices are on the pricing page. Enterprise is quoted individually: use the Enterprise section in the dashboard or write to 1@reportedip.com.

In the Privacy section of your Dashboard you can export your data or delete your account with all personal data. The deletion runs immediately and cannot be undone. Reports you filed stay in the database without any link to you, because the reputation of the reported addresses depends on them.

Yes. Every account has a personal referral link in the dashboard. The person you refer gets 20 % off the first invoice of a Professional or Business plan, and you get a credit worth one month of your plan once their withdrawal period is over. Businesses can alternatively join the cash partner programme. Details and conditions: Referral programme.

Register a free account at reportedip.com/register, confirm your email address, then open the API Keys section of your Dashboard and create a key with a descriptive name. Copy it right away, it is shown only once. Send it with every request in the X-Key header.

The daily limits depend on your plan:

• Free: 1,000 checks/day, 50 reports/day
• Contributor: 5,000 checks/day, 200 reports/day
• Professional: 25,000 checks/day, 1,000 reports/day, bulk operations
• Business: 100,000 checks/day, 5,000 reports/day, bulk operations. Booked two to twenty times, all limits multiply.
• Enterprise: unlimited, custom contract
• Honeypot operators: unlimited

The limits count per account, not per key. Lookups without an API key are limited to 100 per day per IP address.

The API answers in JSON. The /blacklist endpoint additionally supports format=txt (one IP per line) and format=csv (columns IP, confidence, last reported).

POST /v2/bulk-check checks up to 1,000 IPs in one call and returns one result object per address. It is available on Professional, Business and Enterprise. POST /v2/bulk-report accepts up to 1,000 reports per call and is reserved for Enterprise. Bulk calls count against your daily quota by the number of IPs, not by the number of HTTP requests. Payloads: API reference.

For the blacklist, yes. /blacklist returns an ETag and a Cache-Control header. Send If-None-Match with the next request and you get HTTP 304 as long as the list has not changed. Blacklist downloads never count against your daily quota, whether they answer 200 or 304.

/check has no ETag. Cache the answer on your side instead: the WordPress plugins keep a positive result for 24 hours and a negative one for 2 hours.

With ?verbose=true, /v2/check additionally returns confidenceBreakdown (the share of each component: reports, diversity, recency, severity, honeypot bonus and the inactivity factor) and debugInfo (report count, unique reporters, honeypot reports, time-dampening factor). Useful to understand why an address scored where it did. A verbose call costs the same as a normal one.

Revoke the key in your Dashboard under API Keys and create a new one. The old key is rejected from the next request on. Then update every system that used it (WordPress sites, Linux agents, scripts). Every plan can hold several keys, so you can create the new key first and rotate without downtime.

Since version 3.0.0 there is one plugin plus an add-on:

• ReportedIP Hive, free from WordPress.org: 16 attack sensors, a Web Application Firewall, two-factor login, form protection, multisite and WooCommerce support. Documentation.
• ReportedIP Hive Pro, the add-on for the Professional, Business and Enterprise plans: managed mail and SMS delivery, two-factor login in the WooCommerce shop and the other features of these plans. Download it from the dashboard. It runs next to the free plugin and installs it if it is missing.

WordPress admin → Plugins → Add New → search for "ReportedIP Hive" → Install Now → Activate. A one-page quickstart opens on first activation. On a Professional, Business or Enterprise plan, also download ReportedIP Hive Pro from the dashboard and upload it under Plugins → Add New → Upload Plugin. For a manual install you can download reportedip-hive.zip as well. Documentation.

Local Shield runs entirely on your server. It counts failed logins and blocks repeat offenders locally, but it neither shares data nor queries the community database. No requests go to reportedip.com.

Community Network connects to the ReportedIP API. Your site profits from what thousands of other sites report, and attacks on your site are shared to protect the others. It needs an API key (the free plan is enough). The plugin supports both modes, and you can switch at any time without losing local data.

Yes. Since version 2.1.2 Hive inspects incoming requests (URI, query string, body, user agent) against a signature ruleset: SQL injection, XSS, path traversal, command injection, LFI wrappers, SSRF, Log4Shell, PHP object injection, NoSQL, XXE, web-shell uploads and more. The engine and the OWASP Top 10 ruleset (Paranoia Level 1) are free on every plan. In Local Shield mode Hive uses the baseline bundled with the plugin; a site connected to the community receives the Free ruleset from reportedip.com, which covers more. Contributor adds the extended Paranoia Level 2 ruleset, updated weekly, and Professional the deeper ruleset for Paranoia Levels 2 and 3, updated daily through Priority Sync. The rules are signed with Ed25519, and a bundled offline baseline means a tampered or unreachable feed can never break your rules. An optional drop-in (auto-configured for Apache and PHP-FPM, snippet for nginx) blocks before WordPress even loads. The WAF is hardened against ReDoS and fails open: a broken rule never takes the site down.

Free on every plan: verified-bot detection (Googlebot, Bingbot and other crawlers are confirmed through their official address ranges and forward-confirmed reverse DNS, spoofers are flagged or blocked), disposable-email blocking at registration, a comment honeypot, basic security headers, a protection and hardening score from 0 to 100, block-page reference codes (also sent as the X-RIP-Ref header), access lockdown switches for the REST API, XML-RPC, feeds, guest access to wp-admin, PHP in the uploads folder and version fingerprints, a system readiness register that surfaces what usually fails quietly, and MainWP integration.

Professional adds advanced security headers (HSTS, Permissions-Policy, Content-Security-Policy, cross-origin isolation), adaptive two-factor triggers per role and optional Tor exit node blocking. Business adds the audit trail (sign-ins, accounts, content, plugins, themes and core, settings with old and new value, file editor, network; with filters and CSV/JSON export), account blocking with the session manager and remote settings management for all your sites from the reportedip.com dashboard.

Free on every plan: a comment spam filter that scores every comment and marks it as spam or rejects it, and an invisible proof of execution on comments, registration and lost-password forms that real browsers pass without noticing and simple bots fail. The same protection covers Contact Form 7 with one switch.

Professional adds a computation check: the browser has to solve a small signed challenge from your server before the form is sent, the effort rises with the request rate and the page stays cacheable. Business adds ready-made adapters for WPForms, Gravity Forms, Elementor Forms, Formidable Forms, Forminator and Ultimate Member. A rejected submission always shows the sender a message, nothing disappears silently.

Hive has a registration rule set that covers every sign-up path: the WordPress registration form, WooCommerce, multisite sign-ups and accounts created by code. It includes prohibited usernames on top of a built-in list of reserved system names (admin, administrator, root, webmaster and similar), email allow and block rules, a configurable sign-up limit per IP address, and an optional immediate block for login attempts against usernames that do not exist, which is what credential-stuffing tools produce in volume.

Ten entries per list are free on every plan. Professional lifts the limit, accepts /regex/ patterns and adds allowlist-only registration from listed IP ranges. Details: Registration Rules.

Yes, on the Business plan. A blocked account keeps its posts, orders and media but cannot log in, cannot use an application password and cannot complete a password reset; all its sessions and trusted devices end the moment the block is set. You block from the user profile, from the Users list (column, filter and bulk action) or with wp reportedip user block <user>. A block can carry a message the person sees at login and an internal note they never see.

Existing blocks stay in force and can always be lifted, even after the plan has expired, so an expired licence never leaves an account locked out. Under Users → Sessions you see every active session with login time, expiry, IP address and device, and can end single sessions or all sessions of a user. Details: User Account Control and Sessions.

Barely. The block check is one indexed query on the local block table per request, run early at init. The whitelist is held in memory for the request. Reports are queued and sent in the background by cron. Reputation lookups at login and on forms are cached locally, a positive result for 24 hours and a negative one for 2 hours, so repeated checks of the same address cost neither time nor API quota.

Nothing to do by hand. Version 3.0.0 arrives as a normal update. Attempts, blocked IPs, whitelist (ranges and permanent entries included), queue, settings and API key are kept. On a network where the plugin ran site by site, the data of every site moves into the network tables. Open the quickstart afterwards to pick Local Shield or Community Network.

Yes, since version 2.0.0. Hive is activated for the whole network only, so the security configuration stays the same on every site. All tables live under the network prefix: one block locks an address out of every sub-site, and brute-force attempts across sites add up in one counter. Network admins get all settings and a log view across all sites; site admins see status and logs of their site plus a few site-level overrides. How many domains may use the managed mail and SMS delivery depends on the plan (Professional 3, Business 15 per licence, Enterprise unlimited).

Hive supports four methods, combinable per user: TOTP (Google Authenticator, Authy, 1Password, Bitwarden and others), a code by email, a code by SMS (through the managed SMS delivery, Professional and up) and WebAuthn (passkeys, YubiKey, Touch ID, Face ID, Windows Hello). One security key per account is free on every plan at the WordPress login and the password reset; the two-factor challenge in the WooCommerce shop, key check included, needs Professional or higher. Business adds Advanced Security Keys (several keys per user, automatic model detection, alerts when a key is added or removed). There are also ten single-use recovery codes and trusted devices (30 days by default).

Yes, officially since version 2.1.36. The YubiKey 5 series (USB-A, USB-C, Lightning, NFC), the Security Key by Yubico and every other CTAP2 authenticator complete a full WebAuthn ceremony at the WordPress login, the WooCommerce storefront challenge and the password reset. At the WordPress login and the password reset, one key or passkey per account is free on every plan; the key check in the WooCommerce shop is part of the storefront challenge and needs Professional or higher. The Business plan adds several keys per account (main and backup), automatic model detection ("YubiKey 5 Series with NFC") and email alerts when a key is added or removed. A cloned key (signature counter does not advance) is rejected and reported by mail on every plan. Setup: Hardware security keys; field report: YubiKey 5C NFC for WordPress 2FA.

Use one of the ten recovery codes you saved during setup. If those are gone, an administrator can reset two-factor login for any user under Users → Two-Factor. With shell access, wp reportedip 2fa reset <user_id> does the same via WP-CLI, on every plan.

Yes. Failed logins on the WooCommerce account and checkout pages count towards brute-force protection on every plan, Free included. From Professional up, with the Pro add-on installed, the two-factor challenge appears inside your storefront (My Account, checkout, cart and the checkout block) instead of on the WordPress login page.

The free plugin updates through WordPress.org like any plugin from the directory. ReportedIP Hive Pro checks reportedip.com every 12 hours with your Community Access Key; its updates show up on the same Plugins page. Sites that ran the former GitHub version (2.1.x) received a one-time 3.0.0 release that moved them over and installed the Pro add-on where the plan includes it.

Three formats through /v2/blacklist:

• JSON: address, Confidence Score and time of the last report
• TXT: one IP per line, made for firewalls
• CSV: columns IP, confidence and last reported

Mail servers can query the same data per message as a DNS/RBL zone.

The API feed is part of every account from the Contributor plan up, and downloads do not count against the daily quota. Independently of that, a public mirror on GitHub is free for everyone without an account. The Linux agent needs a server licence to load the feed, see the Agent section below.

The API list is rebuilt continuously from the current scores; polling every 15 to 60 minutes is enough for firewalls. The public Git mirror is pushed once a day: an address enters it 48 hours after its first report and stays as long as its score is above the threshold.

By default the list contains addresses with a Confidence Score of 75 or higher. A single reporter cannot push an address that high: the score is capped until several independent sources have reported it. You choose a different threshold with the confidence parameter, for example ?confidence=90 for a stricter list. Other parameters: limit, format and category.

Yes, pass ?category=<id> to /v2/blacklist, several IDs separated by commas. The IDs are listed under Threat Categories. The public Git mirror additionally publishes nine topic lists (spam, brute force, CMS login, web attacks, malware, DDoS, fraud, infrastructure and APT) as separate files, so you can load only what fits your stack.

Yes. The TXT format is made for direct firewall integration. The blacklist documentation has guides for nginx, Apache, iptables, fail2ban and Cloudflare Custom Rules. To report attackers back from fail2ban, see the fail2ban guide. On Linux servers, the ReportedIP Agent does all of this in one package.

The DNS/RBL zone makes the blacklist queryable per message from Postfix, Exim, Rspamd or any DNSBL-aware mail filter, with the usual 127.0.0.x return codes. Access runs through a personal token. It is an add-on for Professional, Business and Enterprise at 7.90 € a month or 79 € a year incl. VAT, with up to 100,000 queries per day per token. Setup: DNS/RBL zone, product page: DNSBL Zone.

First look up your address on the ReportedIP homepage to see which categories were reported. Once the cause is fixed, request removal with the delisting form. Without an account you confirm the request by email, signed-in users follow it in their dashboard. Requests are usually decided within 48 hours.

Each report loses weight with a 30-day half-life: after 30 days it counts half, after 90 days an eighth. In addition, the score of an address falls as soon as no new report arrives: after two weeks of quiet it halves every 30 days. An address that stops attacking therefore drops below the blacklist threshold within weeks. There is no permanent ban for community reports.

False positives happen, mostly with shared hosting addresses, VPN exit nodes and dynamically assigned addresses. Every IP detail page and every lookup result for a reported address links to the delisting form with the address filled in. Our team reviews the request, usually within 48 hours, and you get the decision by email.

VPN and Tor addresses are scored like any other address: by what is reported from them. If attacks come from your exit node, it will be listed, and it drops off again once the reports stop. If your range was listed without cause, use the delisting form. Our API marks known Tor exit nodes separately, so site operators can decide for themselves how to treat them.

Reports stay in the database because the reputation of the reported addresses depends on them. When you delete your account, the reports lose every link to you and remain as anonymous data points; their weight fades with age like every other report. If a report of yours was wrong, write to 1@reportedip.com.

Business costs 39.00 € a month or 389 € a year (about 17 % less), incl. VAT. On top of Professional you get: 100,000 API checks and 5,000 reports per day, 15 domains per licence, 3 Linux server licences, 2,500 mails and 75 SMS per month through the managed delivery, 3 groups for shared bans, Advanced Security Keys, the audit trail, account blocking with the session manager, remote settings management for all your sites, form adapters for WPForms, Gravity Forms, Elementor Forms, Formidable Forms, Forminator and Ultimate Member, one year of log retention and priority email support within 12 hours. The full comparison is on the pricing page.

Yes. Business can be booked from 2 to 20 times at checkout, and changed later in the Stripe Customer Portal. It multiplies the whole plan: daily API checks and reports, the included mails and SMS per month and the number of domains. Example: 5 times Business gives 500,000 checks a day, 25,000 reports a day, 12,500 mails and 375 SMS a month and up to 75 domains. The included Linux server licences do not multiply, because servers are booked separately. From two licences up a volume discount applies automatically, and the exact total is shown before you confirm. Beyond 20 times, Enterprise takes over (from 663 € a month, custom contract).

When your monthly included SMS are used up (25 on Professional, 75 on Business), you can buy a one-time bundle in the dashboard: 50 SMS for 14.90 €, 200 SMS for 49.90 € or 500 SMS for 99.90 €, all incl. 19 % VAT. Bundles never expire and are only used after the monthly quota. The other two-factor methods (TOTP, email, WebAuthn) keep working even when no SMS are left.

Yes, with the same logic: 1,000 mails for 4.90 €, 5,000 mails for 14.90 € or 25,000 mails for 49.90 €, all incl. 19 % VAT. They never expire and only start once the monthly included mails (500 on Professional, 2,500 on Business) are used up. Whoever buys bundles regularly is usually better off with the next plan.

Yearly billing saves about 17 %: Professional 149 € a year instead of 12 × 14.90 € = 178.80 €, Business 389 € a year instead of 12 × 39.00 € = 468 €. You choose the billing period at checkout; later changes run through the Stripe Customer Portal, which you open from the Billing section of the dashboard. Enterprise contracts are quoted individually.

Yes: Professional covers 3 domains, Business 15 per licence, Enterprise any number; Free and Contributor cover one. A Hive site registers its domain when it uses your API key. Under Domains in the dashboard you see every registered site with API key, Hive and WordPress version and last contact, and you can release a domain to free the slot. On Business you can also manage the Hive settings of all sites centrally.

Mail: Hive falls back to wp_mail() on your own server. Two-factor login keeps working, just without the deliverability of our managed mail delivery.

SMS: the user switches to another method (TOTP, email, WebAuthn) or you buy a bundle. SMS login never fails silently, the user is told clearly when SMS is not available.

All self-service prices (Professional, Business, bundles and add-ons) include 19 % German VAT. Stripe Tax applies the correct rate:

• Customers in Germany: 19 % VAT on the invoice.
• EU businesses with a valid VAT ID (checked against VIES): 0 %, with the Reverse Charge note on the invoice ("Steuerschuldnerschaft des Leistungsempfängers").
• EU consumers outside Germany: the rate of their country via OSS (One-Stop-Shop).
• Businesses outside the EU: 0 %, export.

Enterprise is quoted net, the same rules apply on the invoice. Stripe creates the invoices; you find them as PDF in the Billing section of your dashboard.

Professional and Business can be cancelled at any time in the Stripe Customer Portal, effective at the end of the current billing period, monthly or yearly. There is no partial refund for the rest of a period. Instead, a 14-day money-back guarantee applies to the first subscription payment: within 14 days of purchase you get the full amount back without giving a reason, request it at 1@reportedip.com.

Bundle credits become final once the first credit is used. Consumers have the statutory right of withdrawal, which ends early for digital services only if you expressly agreed to that before checkout. The binding version is in our terms.

For each report: the reported IP address, attack categories, a timestamp, an optional comment and which account reported it. No user agents and no data of your visitors. The service follows the principle of data minimisation (GDPR Art. 5).

The WordPress plugins never send usernames to the service. On your own server, Hive stores usernames only where you switch it on (detailed logging) or where it is the purpose of the feature (the Business audit trail).

Reports are kept because the reputation of an address is calculated from them; their weight fades with age, and a successful delisting request removes an address from the database. Account data is deleted when you delete your account. How long Hive keeps its logs depends on your plan: 30 days on Free and Contributor, 90 days on Professional, one year on Business, configurable on Enterprise.

Yes. Under GDPR Art. 17 you can request deletion of your personal data. With an account you do it yourself in the Privacy section of the dashboard, immediately. Otherwise write to 1@reportedip.com. Reports filed from your account remain as anonymous data points without any link to you.

As soon as you use the managed mail and SMS delivery (Professional and up), we process personal data on your behalf, namely recipient addresses and phone numbers. For that we act as your processor under GDPR Art. 28; request the data-processing agreement at 1@reportedip.com. Enterprise customers can agree on an individual AVV. Sharing attacker addresses with the community is not processing on your behalf; each party is responsible for its own part.

The servers run at Hetzner Online in Nuremberg, Germany. Mails are sent from our own mail servers in Germany. Sub-processors:

• Stripe Payments Europe Ltd. (Ireland), payment processing.
• Avernis (Germany), delivery of SMS codes.
• Cloudflare, DDoS protection in front of the API address reportedip.de.

The complete and binding list is in our privacy policy.

No. There is no analytics, no advertising tracker and no third-party tracking on reportedip.com. The cookies we set are functional: the login session, the chosen language, the colour scheme and, if you arrived through a referral link, a referral cookie valid for 60 days. Payment runs on Stripe pages. Hive sets cookies on your site only during two-factor login: a short-lived challenge cookie and, if the user opts in, a trusted-device token.

A standalone PHP application (PHP 8.2+ with SQLite) that imitates WordPress, Drupal and Joomla. 40 built-in analyzers detect SQL injection, XSS, brute force, credential stuffing, plugin exploits and scanner signatures. Detected attackers are reported to the ReportedIP API in small batches, by default right after page visits, optionally by cron. The source code is public at github.com/reportedip/honeypot-server under the Business Source License 1.1, which turns into Apache 2.0 on 1 March 2030. Deployment guide: Honeypot Server documentation.

Two reasons. Defence: every request an attacker spends on your honeypot does not hit a real system. Status: honeypot operators get honeypot status on their ReportedIP account, with unlimited checks and reports and extra weight on their reports. Honeypot data counts more than ordinary reports because nobody visits a honeypot by accident.

Yes, attackers have to be able to reach it from the internet. Run it on an unused subdomain or on a small separate VPS; the smallest cloud server plans are enough. A Docker Compose setup is included.

Yes. Since version 1.3.0 every detection can trigger a webhook, and each webhook has its own HTTP method, headers and body, so it can feed any API. Choose the method (POST, PUT, PATCH or GET), add auth headers line by line and build the body from placeholders such as {{ip}}, {{categories}}, {{severity}} and {{timestamp}}. The placeholder {{abuseipdb_categories}} maps ReportedIP categories to AbuseIPDB IDs, and presets for AbuseIPDB, Slack, Discord and generic JSON get you started in one click. Test deliveries use the loopback address 127.0.0.1, so they never file a real report. Reference: Honeypot Server documentation.

Optionally, yes. Set a secret on a webhook and every request carries an X-ReportedIP-Signature header with an HMAC-SHA256 of the raw body (sha256=<hmac>). Recompute it with the same secret and compare in constant time before you trust the payload, the same pattern GitHub and Stripe use. Delivery happens after the trap response has been sent, so a webhook never slows the honeypot down.

The agent protects Linux servers. It reads the logs of SSH, mail (Postfix, Dovecot, Exim), web servers, WordPress and Drupal, FTP, DNS and ModSecurity, blocks attackers locally in the kernel with ipset or nftables, reports them to the community and loads the community blacklist in five sets (ssh, mail, web, ftp, edge). It updates itself and tells you by mail when something needs attention. Overview: ReportedIP Agent.

One command as root, with the API key from your dashboard:

curl -fsSL https://reportedip.com/agent/install.sh | REPORTEDIP_KEY=<KEY> sh

The installer asks you to accept the terms first; for unattended installs set REPORTEDIP_ACCEPT_TERMS=1. The only hard requirement is systemd, on x86_64 or ARM64. Without ipset or nftables the agent still runs and reports, it just cannot block. Step by step: Installation.

For the blacklist feed, yes: it is licensed per server. Professional includes one server, Business three, Enterprise as agreed. Free and Contributor include none: the agent installs, detects, blocks locally and reports there too, but it does not load the community blacklist. With a complimentary or trial licence the agent loads the feed once an hour, with addresses from confidence 90; from Professional up it loads every 15 minutes, from confidence 75.

Servers are a pool of their own, separate from the domains of the Hive plugin, so a licensed server never costs you a domain. Licences are added and removed under Agent Servers in the dashboard. Details: Licences.

4.90 € a month or 49 € a year per server, incl. VAT. The price per server falls with the number: 4.90 € for 1 to 4 licences, 3.90 € from 5, 2.90 € from 10, 1.90 € from 25 and 1.40 € from 50, always for all booked licences. From Professional up there is no upper limit.

Booking Business several times raises the number of domains but not the number of included servers, because servers are the part that is paid for separately.

No. Domains and servers are two separate pools. A Professional account with all three domains in use still has its one included server, and adding server licences never reduces the number of domains.

Only the feed download pauses. The community list already loaded stays in the kernel and keeps blocking; local detection, local blocking, reports within the daily limit of your plan and self-updates all continue. The service is not stopped and no set is emptied.

That is deliberate: a server must never become unprotected because of an open invoice. reportedip-agent status shows the licence state, the age of the list and what to do.

No. Licensing is introduced in stages, and every server that reported to ReportedIP before the cut-over keeps a free licence permanently.

Yes, with groups. A group bundles API keys of agent hosts and Hive sites: when one member reports an address, every member blocks it. Each group has its own whitelist of addresses no member will ever block or report. Professional includes 1 group with up to 10 members, Business 3 groups with 50 members each, Enterprise 100 groups with 500 members. Setup: Groups.

Yes. Every attack type that used to arrive through a jail has its own detector that reads the original log, so a host without fail2ban loses nothing. Where fail2ban still runs, the agent can use it as one additional source.

Measured over eleven days on a production host, the agent found 187 of the 189 addresses fail2ban had banned on the same machine (the two it missed were test addresses entered by hand) and reported 78 more addresses that were really attacking but stayed below the fail2ban thresholds. reportedip-agent test <file> replaces fail2ban-regex. The full guide: how the Linux agent replaces fail2ban.

A free diagnostics tool for domains. It queries about 100 DNS resolvers in more than 50 countries on six continents and checks SPF, DKIM, DMARC and DNSSEC. Typical uses: finding mail delivery problems, following DNS propagation during a move, comparing answers across resolvers. Available at reportedip.com/dnschecker/. The reportedip-dnschecker WordPress plugin behind it, with the shortcode [ridns_dns_checker], is open source under the GPL.

Yes. Without an account you have 30 lookups a day per IP address, shared across all tools. Signed in, the shared limit rises to 100 a day. The tools are independent of the IP reputation service; you can use one without the other.

Ten, and no. Nine run in the browser, the tenth is the Honeypot Server you host yourself: DNS Checker, Email Security Check, DNSBL Blacklist Check, Reverse DNS, Abuse Contact, Bot Verification, ASN Report, Security Headers and What We Know About You. The full list with inputs and outputs is under Free Tools.

Use the DNSBL Blacklist Check. It queries twelve curated zones at once, for IPv4 and IPv6, plus the ReportedIP list, and names every list that answers along with the return code, so you know where to ask for removal. Nine of the twelve zones have an IPv6 version; for the other three the result says "not applicable" instead of "clean".

With the operator of the smallest network block, not the largest. The Abuse Contact tool reads the responsible registry over RDAP and returns the mailbox that operator publishes, together with the network block, its holder and a report draft you send from your own mailbox. Nothing is sent from our side.

Check it with Bot Verification. A user agent is free text that any client can send, so the tool uses the method the bot operator publishes: forward-confirmed reverse DNS for Googlebot, Bingbot, Applebot, YandexBot and Baiduspider, and the published address ranges for GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot, PerplexityBot and DuckDuckBot.

Most often because the address has no PTR record, or one that does not resolve back. Reverse DNS shows both: the name the address carries and whether it survives the forward check. Only the operator of the address block can set a PTR record, usually your hosting or transit provider.

That depends on how the reports are spread, and that is what the ASN Report answers. A total report count alone makes every large provider look criminal, so the report shows two figures for each network: how many addresses are known there, and how many reports each of them carries.

With Security Headers. It fetches one page and weights each finding by what it prevents, so a missing Content-Security-Policy counts more than a missing Permissions-Policy, and it names the directive to change instead of only the header that is missing. The weights are listed under Tool Scoring.

Yes. Every tool is a public REST endpoint under /wp-json/ridns/v1, seventeen in total, without key or account. They share the daily budget of the browser tools. Parameters and responses: Tools API.

Yes, in two logs. For statistics, each lookup (the domain, address or AS number you entered) is recorded with a pseudonymous visitor hash and, if you are signed in, your user ID, and kept for up to one year. For abuse prevention, the lookup is also recorded with your full IP address, the input and the result, and deleted after 30 days. The daily counter behind the rate limit expires after one day, and the DNS Checker caches its results for 90 seconds. No tool files a report on your behalf, and no tool contacts an address you enter; only Security Headers fetches the page you name, because that is what it checks. Details: privacy policy.