ReportedIP Agent: Free Tester Licences for Linux Server Operators
We are opening the ReportedIP Agent to testers and handing out server licences at no cost. The agent is the only product here without a free tier, so a tester programme is the honest way to find out how it behaves on stacks we do not run ourselves.
Write to 1@reportedip.com with how many servers you run and what is on them.
What the Linux agent does on a server
Two halves. It reads the logs your server already writes and reports the attackers it finds, and it keeps the community blacklist in your kernel firewall so an address that hit someone else this morning never gets a first attempt here.
The feed crossed 20,000 entries in July, as we wrote at the time. The size a server receives depends on the confidence threshold it asks for, and that threshold is yours to set:
- 37,870 addresses at confidence 75 (
confidence: 75), measured on a licensed server on 25 September 2026. - 17,404 addresses at confidence 90 from the same call, the same minute.
- Five sets by service, not one list for everything: ssh, mail, web, ftp and edge. An address that only ever attacks mail servers is dropped on your mail ports and left alone on port 443.
On the production host we measured, those sets held 32,735 entries across both address families, next to 269 whitelist entries and 25 local bans of its own.
How much work is the setup on a busy hosting box
One command. The installer probes which services run, which ports listen and where your distribution keeps its logs, then writes the configuration itself. On a production host with web, mail, FTP, DNS and a control panel that came to 196 log files covered by 62 lines, across seven source types, with a threshold per source instead of one global number.
Before it writes a single byte it checks three things: the flags you passed, the host, and the key. A host without systemd is refused rather than left with a configuration that nothing starts. A missing firewall backend is reported and does not stop the install, because reporting without blocking is a supported way to run it.
reportedip-agent doctor reportedip-agent test /var/log/auth.log reportedip-agent install --key "YOUR_API_KEY"
doctor reports what the host brings and changes nothing. test runs the detectors over a real log, gzipped files included, and prints which address would have crossed which threshold and when, without reporting or banning anything. Details are in the Linux agent documentation.
What it costs the machine, and what it sends us
While watching those 196 files the daemon used 0.8 per cent of one CPU core and 50 MB resident, measured over three and a half hours of uptime. On a small host with seven log files under watch the same build sits at 0.085 per cent and 16.6 MB.
A report is an address, a list of threat category ids and one generated sentence. No log line, no request body, no user name, no User-Agent, no URL. Private ranges from RFC 1918, loopback, the server’s own addresses and the SSH address the installation came from are never reported and never blocked, and your own whitelist sits in front of every drop.
Across six hosts in one day the queue took 557 reports and sent 557, with none dropped. The binary is static, with no interpreter and no runtime to keep patched, for linux/amd64 and linux/arm64, and it updates itself over an Ed25519 signature checked against a key compiled into it.
Who we are looking for
The useful testers are the ones whose setup differs from ours. We run six hosts, five on x86_64 and one on aarch64, with nftables and ipset both in use.
- A distribution outside Debian and Ubuntu, especially the RHEL family.
- A mail server under real load, where a false positive costs you actual mail.
- A control panel other than ISPConfig, or none at all.
- More than ten servers, so the licence arithmetic and the per-device budgets get exercised.
- A host that already runs another blocklist, so we learn what collides.
What a tester gets, and what we want back
You get complimentary server licences for the duration of the programme: the full feed at confidence 75, refreshed every 15 minutes, with no card and no invoice. Normally a licence is included from the Professional plan and each further server is 4.90 euro a month including VAT, down to 1.40 euro at fifty licences, as the pricing page sets out.
What we want back is the unflattering half: a false positive with the log line that caused it, a detector that missed something your old setup caught, a distribution where the installer guessed a log path wrong, and what the daemon costs on your hardware. Numbers are more useful than impressions.
Send a mail to 1@reportedip.com with the number of servers, the distribution, what services run on them and whether you use nftables or ipset. We answer every mail, and we say no when a setup would not tell us anything new.