Thousands of addresses that attacked other servers this morning, dropped in ipset or nftables before their first attempt reaches you, and every attack in your own logs detected and reported. One static binary for hosters and admins running web, mail, FTP and DNS on the same machines. One server is included from Pro.
14
log source types the installer recognises by itself: SSH, web, mail, FTP, DNS, the control panel and the kernel, each with its own threshold.
15 min
between two refreshes of the community list on a licensed server. A list that has not changed costs one 304 and no transfer.
1 binary
static, for amd64 and arm64. No cgo, no interpreter and no runtime on the host that needs patching.
Zero
log lines, payloads and User-Agents sent to us. A report is an address, category ids and one generated sentence.
One box or a full rack: the agent installs without a single question, finds its own logs and keeps itself up to date on amd64 and arm64 alike.
Web hosts and resellers
Web, mail, FTP, DNS and the panel on one box. The installer reads the web server's own configuration and finds every vhost log by itself, every source gets its own threshold, and a site added tomorrow is covered without touching the configuration. Nothing about your customers' traffic leaves the machine.
Detection in detailData centres and managed servers
One unattended command for Ansible or cloud-init, signed self-updates, group bans so an address that hits one rack is dropped on every other, and status as JSON with an official Zabbix template for the NOC. Volume pricing goes down to 1.40 € per server.
Rollout examplesAgencies and admins
One server is included in Pro. Install it, run the first sync, read status: the box is on the network in a few minutes, and a dry run over your real logs shows what it would have banned before it drops a single packet.
Installation guideA hosting box is not one service. It is web, mail, FTP, DNS and a control panel on the same machine, writing a few hundred log files between them, and every attack type arrives in a different one. Watching all of that by hand is a day of work and it still leaves the ceiling in place: a ban list built from your own logs holds only what found you first. So every server on the internet learns the same lesson separately, at its own expense, one attempt at a time.
Same machine, same logs, seven situations from a normal week in hosting. The difference is whether this server is the only one that learns from them.
| The situation | Without the agent | With the agent |
|---|---|---|
| An address attacked forty other hosts this morning and now knocks on yours | It gets its first attempts in until your own threshold trips. | Dropped in the kernel before its first packet arrives. |
| Brute force against WordPress logins spread over 300 vhosts | Each site sees a few attempts and none of them looks like an attack. | Counted across every vhost log on the box, banned and reported once. |
| Password spray against your mailboxes from a pool of fresh addresses | Learned one address at a time, from your own failed logins. | Learned once by whoever was hit first, dropped on your mail ports only. |
| The attacker moves on from server 1 to server 2 | Server 2 starts again from zero. | With a group, server 2 drops it the moment server 1 reports it. |
| A new server goes into the rack | Empty ban list until it has been attacked often enough to learn. | Thousands of known attackers in the kernel after the first sync. |
| Attacks only this machine can see | Its own logs are the only source, so they stay in full. | The same fourteen log sources, plus every find reported to spare the next operator. |
| What the learning costs | One successful attempt per lesson, paid with your customers' traffic. | From 4.90 € down to 1.40 € per server a month, incl. VAT. One server included in Pro. |
Detection, local blocking and reporting run on every plan, also on a free key. A server licence adds the community feed in the kernel, and the Pro plan adds group bans across your fleet. Nothing below is a teaser for a capability that turns out to be locked.
Labels mark what a capability needs. One server licence is included in Pro, three in Business.
Addresses that attacked other servers this morning are dropped before their first packet reaches yours. This is the part a server licence buys; everything further down runs without one.
7Read the detail Blocking in detail Licences
A hosting server writes every kind of attack into a different log. The agent reads all of them, each source with its own threshold, and the installer finds them without a single rule written by hand.
15Read the detail Detection and rules Configuration
A find is banned locally, reported to the network and never blocks the people who should get through. Every step can be watched before it is trusted.
9Read the detail Local blocking
No detector is hidden in the binary. Each one is a YAML file with a pattern, the position of the address and its own examples, and a rule of yours sits next to the shipped ones.
8Read the detail Writing rules
Built for the operator with fifty servers as much as for the one with a single box. What one host learns, the others can use, and nothing needs a person logged in to stay current.
8Read the detail Rollout examples Groups
An agent on fifty servers is only cheap if it stays quiet. It reports its state to the monitoring you already run and writes one mail when something changes, not one per event.
8Read the detail Monitoring Running it
A hoster answers for the traffic of every customer on the box. The agent is built so that answer stays short.
6Read the detail What leaves the machine Installation
Pro includes one server and Business three. Every further server is a licence, and the step you reach applies to every licence you book, not only to the ones above it. All prices incl. VAT.
| Licences booked | Per server and month | Per server and year | Paid yearly, per month |
|---|---|---|---|
| 1 to 4 | 4.90 € | 49.00 € | 4.08 € |
| 5 to 9 | 3.90 € | 39.00 € | 3.25 € |
| 10 to 24 | 2.90 € | 29.00 € | 2.42 € |
| 25 to 49 | 1.90 € | 19.00 € | 1.58 € |
| 50 and more | 1.40 € | 14.00 € | 1.17 € |
What a fleet costs a month, plan included
Up to 200 licences are booked in the portal; above that the price is set in an Enterprise contract. A server without a licence keeps detecting, blocking and reporting, only the community feed pauses.
Who it's for
Hosters, agencies and admins running the full Linux stack: web, mail, FTP, DNS and a control panel on the same machines, with one box or fifty.
# At a terminal: it shows the terms of use and takes a yes, then
# asks for your key, then three short questions, and Enter takes the
# safe answer every time.
curl -fsSL https://reportedip.com/agent/install.sh | sh
# For automation, and for fifty hosts: nothing is asked, the terms
# are accepted up front.
curl -fsSL https://reportedip.com/agent/install.sh | REPORTEDIP_ACCEPT_TERMS=1 REPORTEDIP_KEY="YOUR_API_KEY" shThe first thing the script shows is the terms of use, and it needs a yes before it downloads anything. It checks that it runs as root, that the platform is Linux, that the architecture is amd64 or arm64 and that a checksum tool exists. Then it downloads the build for your architecture with your key, verifies it against SHA256SUMS and installs it to /usr/local/bin. From there the setup probes which services run, which ports listen and where this distribution keeps its logs, and writes the configuration itself. Take the second form whenever a script runs this, because it asks nothing and needs no terminal.
reportedip-agent syncThe installation touches no firewall rule: no chain, no set, no jump. This run creates all of it and loads the five per-service lists, which is why the installer ends by telling you to run it. Until then the host is exactly as it was, and an installation you decide against costs one rm of two directories.
reportedip-agent status
reportedip-agent doctor
reportedip-agent test /var/log/auth.log
reportedip-agent rules liststatus prints an entry count per list, the state of the chain, the whitelist and the licence state of this host, so one screen tells you whether the install worked. doctor says what this host brings and what is missing, and changes nothing: no file, no rule, no set. test runs the detectors over a real log, gzipped files included, and prints which address would have crossed which threshold and when, without reporting or banning anything. rules list shows every detector as the file it is, with the layer it came from and whether it is on.
This host drops from its first sync on, because that is what the installation writes. Answer log if you want to read for a week first what would have been cut off. The documentation walks through the same installation in full: every flag, every configuration key, and the granular questions the quick path skips.
Release notes, guides and reports, newest first.
Four things stand in the way of that, and the first three cannot be switched off. Private ranges, loopback, this server's own addresses and the SSH address the installation came from are never reported and never blocked. Your own whitelist sits in front of every drop. The list is scored, and you choose the threshold: from 75 up on a licensed server, or higher to keep only the surest entries. The host drops from its first sync on, and if you want to read that for a week first, answer log instead of drop during the install.
One command. The installer probes which services run, which ports listen and where this distribution keeps its logs, then writes the configuration itself, with a threshold per source rather than one global number. A few dozen lines of configuration cover hundreds of virtual host logs. There is no acquisition rule to write per service and none to maintain when a site is added, because the paths are globbed.
The address, the threat category IDs and a generated sentence. Never a log line, a user name, a request body, a User-Agent or a URL. A server identifies itself with a random install id created during the installation, not with its name.
Only the feed download pauses. The list already in the kernel stays and keeps blocking, local detection and local blocking keep running, reports keep going and the agent still updates itself. A server never becomes unprotected because of an open invoice.
Each additional licence is 4.90 € a month or 49 € a year, incl. VAT, and the price per licence falls as the count goes up: 3.90 € from five licences, 2.90 € from ten, 1.90 € from twenty-five and 1.40 € from fifty. The step you reach applies to every licence, not only to the ones above it. Without a licence the agent still runs on the Free plan: it detects and blocks locally in full and reports what it finds. Only the community feed needs a server licence; Pro includes one, Business three.
No. Servers are their own pool, counted separately from the domains of the Hive plugin. The Business volume multiplier raises the domain count but not the number of included servers.
On a licensed server from the Pro plan the agent refreshes it every 15 minutes and takes everything scored at confidence 75 and up. The request is conditional, so a list that has not changed answers with a 304 and transfers nothing, which is what makes a short interval cheap. The swap into the kernel sets is atomic, so there is never a moment where a set is empty. Freshness and depth of the feed are what a plan buys; local detection, local blocking and reporting do not depend on it.
Yes. The agent only ever writes its own sets and its own chain, and it never touches a rule or a set it did not create, so another list, an existing firewall installation or a hand-written chain keeps working next to it. If you want to see what the agent would add before you commit, run it in log mode and compare.
Yes, and every shipped detector is one already: a YAML file with a pattern, a block that names where the address stands in the line, a threshold and its own examples. A file of yours under /etc/reportedip-agent/rules.d/ adds a rule or overrides a shipped one field by field, and the agent picks it up within a minute. reportedip-agent rules check names any mistake with file and line before the daemon sees it, and test with --rule runs one rule against a real log. Three things protect you from a rule that reads the wrong field: the examples are checked every time the file loads, a new rule of yours bans but does not report for its first 24 hours, and a rule whose threshold is reached by addresses on your own whitelist stops reporting by itself.
With the same command you would type by hand, with the answers set as environment variables: REPORTEDIP_ACCEPT_TERMS=1 and REPORTEDIP_KEY skip every question, so the installer needs no terminal. The documentation has ready examples for Ansible, cloud-init, control panel hosts and mail and database servers. After that the fleet maintains itself: every host checks for a new release every six hours and installs it only after the Ed25519 signature has been verified on that host.
status returns exit code 0 when the host is healthy, 1 when it is degraded, for example an empty list, a missing chain or a stopped daemon, and 2 when a human has to look at the configuration, so Nagios, Icinga and Checkmk can run it without a wrapper. status --json prints the same verdict as one document with a reason per problem and counts and ages per section, without a request to our API. For Zabbix 7 there is an official template, and the monitoring guide covers Prometheus as well.
Yes, with a group. Every key in your account can join one group, and each address a member reports is dropped on every other member for the group window, 24 hours by default, on every port. Pro includes one group with ten keys, Business three groups with fifty keys each. A group has its own whitelist in the portal, and a signed webhook tells your own tooling about every ban.
A report carries the attacking address, the threat category ids and one sentence the agent generates. No log line, user name, URL, payload or User-Agent leaves the machine, so nothing about your customers or their visitors is transferred. The API and the feed run on infrastructure in the EU, operated from Germany, and an access log written with anonymised addresses is left out by the installer so a network address is never reported as an attacker.
Same dataset, different shape.
WordPress Plugin · Free
Real-time WordPress security with 16 detection sensors, a Web Application Firewall, four 2FA methods and an opt-in community threat network. Free and open source forever.
REST Threat Intelligence · Free tier
The reputation engine behind everything. Query IPs, submit reports, pull the blacklist and run bulk operations from any language, your SIEM, your firewall or your hosting panel.
Downloadable Feed · Free
Community-driven blacklist, automatically scored from real-time reports. Plain text, JSON and CSV, ready for iptables, nftables, nginx or any blocklist consumer.
Live DNSBL Add-on · from Pro
Ask a DNS question instead of downloading a list: your mail server looks the address up live, the same way it already queries Spamhaus. No imports, always fresh.
DNS Diagnostics · Free
Domain health diagnostics from about 100 resolvers in more than 50 countries. Validate SPF, DKIM, DMARC and DNSSEC, run DNSBL lookups and track propagation during migrations.
PTR Check · Free
Resolve the PTR record of an IPv4 or IPv6 address and check whether it resolves back. A PTR record nobody confirms is the most common reason a mail server is refused at the door.
One server included from Pro, three with Business. Further servers from 4.90 € a month, incl. VAT.
