Linux Server Agent · from Professional

ReportedIP Agent

fail2ban learns from your server. The agent learns from everybody's. It reads the same logs, counts the same failures and bans the same addresses, and on top of that it keeps the community blacklist in ipset or nftables, so an address that attacked somebody else this morning never gets a first attempt here.

View pricing Read the docs

One server included from Professional, three with Business. Further servers from 4.90 € a month, incl. VAT. Version 0.3.8

187 of 189

of the sshd addresses fail2ban had banned on a production host, found again by the agent. The two it did not find were test addresses.

+78

real attackers on that same host that fail2ban had not caught at all. FTP: three of three.

0.085 %

of one CPU core, measured live with seven log files under watch, at 16.6 MB of resident memory.

Zero

log lines, payloads and User-Agents sent to us. A report is an address, category ids and one generated sentence.

A ban list built from your own logs can only ever hold attackers who already found you. That is the ceiling of every tool of the fail2ban generation, and it is not a fault in fail2ban: a local log is all it was ever given. So every server on the internet learns the same lesson separately, at its own expense, one attempt at a time. The agent keeps that local detection in full and adds the half your own logs cannot give you.

What has to happen	fail2ban	ReportedIP Agent
Attackers who have not reached this server yet	Outside its design. The ban list only ever holds what this host saw itself.	In ipset or nftables every 15 minutes on a licensed Professional server, from the reports of every other host on the network.
Attacks in this server's own logs	A jail and a set of regexes per service, tuned by hand.	Thirteen sources with built-in thresholds. Measured against fail2ban on a live host: 187 of 189 addresses, plus 78 more.
What has to be installed for it	Python and its modules, patched with the rest of the system.	One static binary, no cgo, no interpreter, nothing else.
Checking a log before you trust the rules	fail2ban-regex.	reportedip-agent test, which counts the way the daemon counts and changes nothing on the host.
Blocking a local find	Its whole reason to exist.	Optional and off by default, with a kernel timeout so nothing stays banned once the agent stops.
What it costs	Nothing. Free software, and it stays installable next to the agent.	4.90 Euro a month per server, incl. VAT, from the Professional plan.

Linux Server Agent · from Professional

What you get

Replaces fail2ban, and it was measured rather than claimed: of 189 sshd addresses fail2ban had banned, the agent found 187, plus 78 real attackers it had missed. The switch was verified on a live host across three reboots, and turning fail2ban back on restores every jail in eight seconds.
The community blacklist in ipset or nftables, five per-service sets: on a licensed server from Professional it is refreshed every 15 minutes and takes everything scored at confidence 75 and up. The request is conditional, so a list that has not changed costs one 304 and no transfer, and the swap into the kernel sets is atomic, so there is never a moment with an empty or implausibly short set.
Thirteen log sources, each with its own threshold instead of one global number: sshd, web access and error logs, WordPress and Drupal, Postfix, Dovecot, Exim, FTP, named, the ISPConfig panel, ModSecurity, CSF and fail2ban itself where it still runs.
One static binary. No cgo, no interpreter, no Python to keep patched, nothing on the host that the agent depends on. linux/amd64 and linux/arm64.
Nothing about your traffic leaves the machine: no log line, no payload, no User-Agent. A host identifies itself by a random install id written during setup and never by its hostname, so its licence cannot be taken over by renaming a machine.
It updates itself over an Ed25519 signature checked against a key compiled into the binary, on your machine. A tampered download fails there instead of being trusted for having arrived over HTTPS, and the previous binary stays behind as the way back.
Optional local blocking, off until you switch it on: a kernel timeout per entry so nothing stays banned once the agent is gone, longer bans for repeat offenders, and a whitelist rule that sits in front of the drop.
Operations that stay quiet: its own log with its own rotation, one mail per state instead of one per event with a cooldown and an all-clear, and a disk boundary below which it stops reporting and keeps detecting and blocking.
A dry-run command that replaces fail2ban-regex: it counts a real log the way the daemon counts, reports nothing and bans nothing, so you can check the agent against your own logs before you trust it.
Exit codes 0, 1 and 2, so status works as a monitoring check without a wrapper.

Linux Agent docs Network-level blocking fail2ban integration View pricing

reportedip-agent doctor
reportedip-agent test /var/log/auth.log
reportedip-agent install --key "YOUR_API_KEY"

doctor reports what this host brings and what is missing, and changes nothing: no file, no rule, no set. test runs the detectors over a real log and prints which address would have crossed its threshold and when, without reporting or banning anything. The installation then starts in log mode, so the rules match and log before they ever drop a packet.

Do I still need fail2ban?

No. Every attack type that used to arrive through a jail has its own detector reading the original log, and that was checked rather than assumed: on a production host the agent found 187 of the 189 sshd addresses fail2ban had banned, and 78 more it had missed. fail2ban stays available as one optional source for hosts that still run it, and a host without it loses nothing.

How do I check that before I switch fail2ban off?

Run reportedip-agent test against your own logs. It runs the detector chain over the files you name, gzipped ones included, prints which address would have crossed which threshold and when, and reports nothing, bans nothing and writes nothing outside your terminal. Then leave the agent in log mode for a few days and compare. Turning fail2ban back on is one systemctl command, because the agent never writes to its configuration.

What does a second server cost?

Each additional licence is 4.90 € a month or 49 € a year, incl. VAT, and the price per licence falls as the count goes up: 3.90 € from five licences, 2.90 € from ten, 1.90 € from twenty-five and 1.40 € from fifty. The step you reach applies to every licence, not only to the ones above it. There is no free tier for the agent, unlike the rest of the products.

What happens on a server without a licence?

Only the feed download pauses. The list already in the kernel stays and keeps blocking, local detection and local blocking keep running, reports keep going and the agent still updates itself. A server never becomes unprotected because of an open invoice.

Does a server count against my domains?

No. Servers are their own pool, counted separately from the domains of the Hive plugin. The Business volume multiplier raises the domain count but not the number of included servers.

What does it send us?

The address, the threat category IDs and a generated sentence. Never a log line, a user name, a request body, a User-Agent or a URL. A server identifies itself with a random install id created during the installation, not with its name.

How fresh is the list on my server?

On a licensed server from the Professional plan the agent refreshes it every 15 minutes and takes everything scored at confidence 75 and up. The request is conditional, so a list that has not changed answers with a 304 and transfers nothing, which is what makes a short interval cheap. The swap into the kernel sets is atomic, so there is never a moment where a set is empty. Freshness and depth of the feed are what a plan buys; local detection, local blocking and reporting do not depend on it.

WordPress Plugin · Free

ReportedIP Hive

Real-time WordPress security with 16 detection sensors, a Web Application Firewall, four 2FA methods and an opt-in community threat network. Free and open source forever.

Plugin overview

REST Threat Intelligence · Free tier

Public API

The reputation engine behind everything. Query IPs, submit reports, pull the blacklist and run bulk operations from any language, fail2ban, SIEM, firewalls, hosting panels.

API reference

Downloadable Feed · Free

Blacklist Feed

Community-driven blacklist, automatically scored from real-time reports. Plain text, JSON and CSV, ready for fail2ban, iptables, nginx or any blocklist consumer.

Blacklist docs

Live DNSBL Add-on · from PRO

DNS / RBL Zone

Ask a DNS question instead of downloading a list: your mail server looks the address up live, the same way it already queries Spamhaus. No imports, always fresh.

RBL Zone docs

DNS Diagnostics · Free

DNS Checker

Domain health diagnostics from 76 resolvers across 6 continents. Validate SPF, DKIM, DMARC and DNSSEC, run DNSBL lookups and track propagation during migrations.

Open the tool

PTR Check · Free

Reverse DNS Lookup

Resolve the PTR record of an IPv4 or IPv6 address and check whether it resolves back. A PTR record nobody confirms is the most common reason a mail server is refused at the door.

Open the tool