Most people start here
I run a WordPress site
Install Hive. It blocks known attackers on arrival, adds a firewall and gives every account real two-factor login. The plugin and all 16 sensors are free forever.
Get Hive for WordPress
Open IP threat intelligence platform
Protection for WordPress sites and Linux servers, from one attacker network
Two products: Hive, the free WordPress security plugin, and the agent for Linux servers. Both feed and read the same community reputation database. If you would rather use the raw data, it is here as a REST API, a blacklist feed and a DNS/RBL zone. Everything runs on EU infrastructure.
981k+
IP addresses tracked
8.2M+
community reports
63
threat categories
Start where you are
Three situations, three short paths. Everything else on this page is detail.
Hosters and server admins
I run Linux servers
Install the agent. It puts the community blocklist into your kernel firewall in five per-service sets and reports the attacks it finds in the logs your server already writes. One server is included from Professional.
Get the Linux agentAgencies and freelancers
I look after client sites
One Business licence covers 15 sites at 2.60 € each, managed from a single dashboard, white-labelled with your own name on the quickstart and the 2FA screens.
See the agency setupJust need the data, not a product? The same list is available as a REST API, a blacklist feed and a DNS/RBL zone, with 1,000 checks a day for free. Public API · Blacklist Feed · DNS / RBL Zone
What ReportedIP does
Someone tries to break into a website in Rotterdam. Ninety seconds later that same attacker is blocked on a site in Lisbon that has never seen them before.
That is the whole idea. When a site running our plugin, a honeypot or a firewall gets attacked, it reports the attacking IP address. Every other site on the network gets that address straight away. About 981k+ addresses are known this way, from 8.2M+ reports. The more sites join, the earlier each one sees an attacker coming.
Everything below is one of two things: a product that does it for you, Hive on the WordPress site or the agent on the Linux server, or the same data in a shape your own systems can read. Every quarter the same dataset also becomes a WordPress Attack Report, free to cite under CC BY 4.0.
- A site gets attacked. Someone hammers the login form, floods the comments or scans for a known hole.
- The address is reported. Only the attacking address and what it did. No visitor data, no content, nothing about the site itself.
- Everyone else is warned. The address gets a score from 0 to 100, how sure the network is that it attacks people, and every connected site can act on it.
- Your site blocks it on arrival. Before the login page loads, before the comment form is reached, before anything is tried.
The two products
Hive for the WordPress site, the agent for the Linux server underneath it. Hive is free and open source in every mode and protects the site it is installed in. The agent is the server side and the one thing here you pay for per host: it finds attacks in the logs the server already writes and puts the community list in the kernel on top of that.
WordPress Plugin · Free
ReportedIP Hive
Real-time WordPress security with 16 detection sensors, a Web Application Firewall, four 2FA methods and an opt-in community threat network. Free and open source forever.
Linux Server Agent · for hosters and data centres
ReportedIP Agent
One static binary that puts thousands of known attackers into your kernel firewall before they reach you, and watches every log your server already writes for the ones nobody has reported yet.
Or take the raw data
The same list of attacking addresses, in whichever shape your stack can read. Pick one, they are three doors into the same room.
REST Threat Intelligence · Free tier
Public API
The reputation engine behind everything. Query IPs, submit reports, pull the blacklist and run bulk operations from any language, your SIEM, your firewall or your hosting panel.
Downloadable Feed · Free
Blacklist Feed
Community-driven blacklist, automatically scored from real-time reports. Plain text, JSON and CSV, ready for iptables, nftables, nginx or any blocklist consumer.
Live DNSBL Add-on · from PRO
DNS / RBL Zone
Ask a DNS question instead of downloading a list: your mail server looks the address up live, the same way it already queries Spamhaus. No imports, always fresh.
Free tools
Nine tools that block nothing and need no account: DNS checker, DNSBL lookup, e-mail security check, reverse DNS, security headers, abuse contact, bot verification, ASN report and a privacy mirror.
Which product do I need?
Start from the job you want done.
| Your goal | Use |
|---|---|
| Protect a WordPress site | ReportedIP Hive |
| Protect and report from a Linux server | ReportedIP Agent |
| Reputation checks in your SIEM, firewall or scripts | Public API |
| Drop a static blocklist into iptables or nginx | Blacklist Feed |
| Block addresses at your mail server (SMTP) | DNS / RBL Zone |
| Diagnose DNS, mail authentication, headers or a single address | Free tools |
The protection is free forever. A paid plan buys our servers: 2FA mail and SMS delivery, higher API quotas, every site in one dashboard and the blocklist feed for your Linux servers. Professional works out at 4.97 € per domain per month and includes one server. View pricing
Latest news and guides
Release notes, guides and reports, newest first.
Get started: free forever
Create an account for API access, read the docs first, or check what the paid plans add. No credit card required.
Security Focused
GDPR Compliant
Made in Germany
Open source where possible