ReportedIP Agent: Free Tester Licences for Linux Server Operators
We give complimentary server licences for the ReportedIP Agent to Linux operators who test it on setups unlike ours. The offer from 25 September 2026 still stands, and a tester licence has no end date.
Write to 1@reportedip.com with how many servers you run and what is on them.
What does the ReportedIP Linux agent do on a server?
The agent is one static binary for linux/amd64 and linux/arm64, at version 0.3.38 on 29 September 2026. It does two jobs. It reads the logs your server already writes, blocks the attackers it finds there and reports them, and it keeps the community blacklist in your kernel firewall, in ipset or nftables, so an address that attacked someone else this morning never gets a first attempt here.
Every detector is a rule file with its own examples, which are checked when the file loads. You can override a shipped rule field by field or add one of your own, and a rule of your own bans for its first 24 hours before it reports anything. The detection and rules page covers all fourteen source types and the file format.
The blacklist does not arrive as one list for everything:
- Five sets by service: ssh, mail, web, ftp and edge. An address that only ever attacks mail servers is dropped on your mail ports and left alone on port 443.
- A group list: what one member of a group in your account reported is dropped on every other member. Groups start at Professional.
- A whitelist in front of every drop: private ranges from RFC 1918, loopback, the server’s own addresses and the SSH address the installation came from are never reported and never blocked.
How large is the blacklist a server receives?
The size depends on the confidence threshold. A score also falls while an address stays quiet since 28 September 2026, so the list now sheds attackers that stopped. The blacklist milestone post explains that change.
| Measured on | Confidence 75 | Confidence 90 |
|---|---|---|
| 26 September 2026 | 38,105 | 17,486 |
| 29 September 2026 | 12,545 | 4,173 |
The first row was measured on a licensed server, the second in the community database after the change. Your plan sets the lowest threshold a host may take, and you can raise it.
How much work is the setup on a hosting server?
One command, run as root: curl -fsSL https://reportedip.com/agent/install.sh | sh. It shows the terms of use and waits for a yes, asks for your key and then checks the host. The installer writes systemd units, so it refuses a host where systemd is not running instead of leaving a configuration that nothing starts. A missing firewall backend is reported and does not stop the install, because reporting without blocking is a supported way to run it.
The installer probes which services run and where your distribution keeps its logs, then writes the configuration itself. On a production hosting host with web, mail, FTP, DNS and a control panel that came to 196 log files covered by 62 lines, across seven source types.
reportedip-agent doctor reportedip-agent test /var/log/auth.log
doctor reports what the host brings and changes nothing. test runs the detectors over a real log and prints which address would have crossed which threshold, without reporting or banning anything. Rollouts with Ansible, cloud-init or a golden image are in the installation examples.
What does the agent cost the machine, and what does it send?
While watching those 196 files the daemon held 50 MB resident, measured over three and a half hours of uptime. On a small host with seven log files the same build sits at 16.6 MB.
A report is an address, a list of threat category ids and one generated sentence. No log line, no request body, no user name, no User-Agent and no URL leave the server. The binary needs no interpreter and no runtime, and it updates itself only after checking an Ed25519 signature against a key compiled into it.
Which setups are we looking for?
The useful testers are the ones whose setup differs from ours. We run the agent on 38 servers of our own (29 September 2026), and they resemble each other.
- A distribution outside Debian and Ubuntu, especially the RHEL family.
- A mail server under real load, where a false positive costs you actual mail.
- A control panel other than ISPConfig, or none at all.
- More than ten servers, so the licence allocation and the report budget per server get exercised.
- A host that already runs another blocklist, so we learn what collides.
What does a tester get, and what do we want back?
You get one complimentary licence per server you test on, set on your account by hand. It shows as Complimentary under Agent Servers in your account, needs no card and never turns into an invoice. A Free account is enough.
The feed follows your plan. On a Free or Contributor account the agent refreshes every 60 minutes and takes addresses from confidence 90. From Professional it refreshes every 15 minutes and starts at confidence 75. Outside the programme one licence is included with Professional and three with Business, and each further server costs 4.90 € a month including VAT, down to 1.40 € from fifty licences, as the pricing page sets out.
Server licensing is still in a monitoring phase, so no host loses its feed today. Once a start date is set, status names it, and every host that reported before that date keeps a complimentary licence for good.
What we want back is the unflattering half: a false positive with the log line that caused it, a detector that missed something your old setup caught, a log path the installer guessed wrong, and what the daemon costs on your hardware. Numbers help us more than impressions.
Send a mail to 1@reportedip.com with the number of servers, the distribution, the services on them and whether you use nftables or ipset.
Questions about the tester licences
Is the tester programme still open?
The programme is open as of 29 September 2026. Send a mail to 1@reportedip.com with the number of servers, the distribution, the services and the firewall backend. We answer every mail, and we decline when a setup would not tell us anything new, such as another Debian host with ISPConfig.
How long does a tester licence last?
A tester licence has no end date and never turns into an invoice. If it is ever removed, only the feed pauses on that server. The list already in the kernel stays, and local detection, local blocking and reports keep running, so a server never becomes unprotected because a licence is gone.
Can a Free account run the agent without a licence?
A Free account can run the agent as a pure reporter with full local protection: detection on all fourteen source types, local blocking with escalation, and reports within the daily limit of the plan. What a server licence adds is the community blacklist feed in the kernel firewall of that server.
Further reading
- The Linux agent: what it does and what it costs
- Server licences: how a host is counted and what runs without a licence
- Agent overview: requirements, quick install and release notes
- Sharing bans across servers with a group
- Securing a server cluster with the agent, groups and the DNSBL