Public API

Yes, a free one. The account gives you the access key; the key is what the quota is counted against. No card is involved at the free tier.

The API answers with HTTP 429 and tells you when the quota resets. Nothing is billed automatically and no request is silently dropped.

The API, the blacklist feed and the DNS/RBL zone are hosted by us on EU infrastructure. The Hive plugin and the Honeypot Server run on yours.

Each report is weighted by recency, reporter diversity, threat severity and honeypot trust, then decayed over time. The full formula is documented.

Three concrete differences. First, ReportedIP is EU-hosted with explicit GDPR compliance and EU-only sub-processors, with a data-processing agreement on offer. Second, the scoring is fully transparent: add verbose=true to any check and you see every component of the confidence score, report count, diversity, recency, severity and honeypot bonus, rather than an opaque number. Third, the clients are open source where they can be: the WordPress plugin, the honeypot server and the DNS checker are GPL-2.0 and auditable on GitHub. Scoring is time-decayed on a 30-day half-life, so dormant attackers fall off automatically.

Plain-text and JSON exports are served from /wp-json/reportedip/v2/blacklist; add ?format=txt for one IP per line or ?format=csv for spreadsheets and SIEM imports. The same data is mirrored to Git at github.com/reportedip/reportedip-blacklist with a diff-friendly commit history, so you can track which IPs were added or removed each day and pin a revision for reproducible builds. Entries are scored by the same confidence engine as the API, so a single threshold keeps your block list current and low on false positives.

Two paths, depending on how fresh you need the data. For broad coverage, pull the community blacklist feed directly, an hourly-refreshed text file you can drop into an ipset with a single cron job, no API key required. For per-IP scoring at the moment of a request, for example inside a ban action or a custom firewall rule, call the REST API with a free account (1,000 checks per day). The documentation has ready-to-run filter examples, an iptables ipset script and nginx and Postfix snippets. Most operators combine both: the feed for bulk blocking, the API for real-time decisions on traffic that is not yet on the list.

Yes. Any system can submit reports via POST /reportedip/v2/report with a free API key; an automated reporter running on your own server is exactly the kind of contribution the network is built on. Honeypot operators get a badge and their reports carry extra weight, because honeypot traffic is unsolicited and therefore high-signal, but you do not need one to take part. Reporter diversity is itself a scoring factor, so every independent source makes the whole dataset more reliable.