Linux Server Agent · for hosters and admins

ReportedIP Agent: the community blocklist in your server's kernel

Thousands of addresses that attacked other servers this morning, dropped in ipset or nftables before their first attempt reaches you, and every attack in your own logs detected and reported. One static binary for hosters and admins running web, mail, FTP and DNS on the same machines. One server is included from Professional.

Get the Linux agent View pricing

One server included from Professional, three with Business. Further servers from 4.90 € a month, incl. VAT. Version 0.3.42

12,545

addresses in the list a licensed server received at confidence 75, measured on 29 September 2026. At confidence 90 it is 4,173, and the threshold is yours to set.

196 logs, 62 lines

of configuration: what the installer found by itself on a production hosting host, across seven service types, without a single acquisition rule written by hand.

50 MB

resident while watching those 196 files, measured over three and a half hours of uptime. On a small host with seven files it is 16.6 MB.

Zero

log lines, payloads and User-Agents sent to us. A report is an address, category ids and one generated sentence.

A hosting box is not one service. It is web, mail, FTP, DNS and a control panel on the same machine, writing a few hundred log files between them, and every attack type arrives in a different one. Watching all of that by hand is a day of work and it still leaves the ceiling in place: a ban list built from your own logs holds only what found you first. So every server on the internet learns the same lesson separately, at its own expense, one attempt at a time.

The situation	This server on its own	This server on the network
An address that has attacked forty other hosts this morning and reaches you now	A first attempt, and a second, until a threshold is crossed. Whatever it got through in between, it got through.	Already in the kernel set before it arrives, because forty operators reported it while you slept.
A brute-force wave against your mail ports from an address pool you have never seen	Learned one address at a time, from your own failures.	Learned once, by whoever was hit first, and dropped on your mail ports only.
A new attack pattern that appears on another continent first	Arrives here as an unknown. Detection starts from zero.	Arrives here as an address with a confidence score and a category.
Attacks in this machine's own logs	Still the only source that can see them, and it stays in full: fourteen source types, each with its own threshold, every one a rule file you can extend.	The same detection, plus every find reported so the next operator is spared it.
What the learning costs you	One successful attempt per lesson, paid in your own traffic.	4.90 Euro a month per server, incl. VAT, from the Professional plan. One server is included.

Linux Server Agent · for hosters and admins

What you get

The community blacklist in ipset or nftables. On a licensed server from Professional it is refreshed every 15 minutes and takes everything scored at confidence 75 and up. The request is conditional, so a list that has not changed costs one 304 and no transfer, and the swap into the kernel sets is atomic, so there is never a moment with an empty or implausibly short set.
Five sets by service, not one list for everything: ssh, mail, web, ftp and edge. An address that only ever attacks mail servers is dropped on your mail ports and left alone on port 443, so a shared address costs you no customer traffic.
The installer finds its own work. It probes which services are running, which ports listen, where this distribution keeps its logs and which of them exist, then writes the configuration itself: on the host above that was 196 virtual host logs from 62 lines. Every source carries its own threshold instead of one global number.
One static binary. No cgo, no interpreter, no runtime to keep patched, nothing on the host that the agent depends on. linux/amd64 and linux/arm64.
Nothing about your traffic leaves the machine: no log line, no payload, no User-Agent, no URL, no user name. A host identifies itself by a random install id written during setup and never by its name, so its licence cannot be taken over by renaming a machine.
It updates itself over an Ed25519 signature checked against a key compiled into the binary, on your machine. A tampered download fails there instead of being trusted for having arrived over HTTPS, and a build that does not start or reports the wrong version is discarded before the swap.
Local blocking, on from the installation: a kernel timeout per entry so nothing stays banned once the agent is gone, bans that grow from 30 minutes to a cap of seven days for repeat offenders, and a whitelist that sits in front of the drop. One line, mode: log, switches it off without touching anything else.
Operations that stay quiet: its own log with its own rotation, one mail per state instead of one per event, with a cooldown and an all-clear, and a disk boundary below which it stops reporting and keeps detecting and blocking.
A dry run over your real logs that reports nothing, bans nothing and writes nothing outside your terminal, so you can check the agent against your own traffic before you trust it with a packet.
Exit codes 0, 1 and 2, so status works as a monitoring check without a wrapper.
Every detector is a rule file you can read, override and extend. A pattern decides whether a line hits, a separate block says where in that line the address stands, and each rule carries its own examples, one of them with a decoy address in the attacker's field, all checked when the file loads. A rule of your own bans for its first 24 hours and reports only after that, and a rule whose threshold is reached by addresses on your own whitelist stops reporting by itself.
Group bans across your fleet. A key belongs to one group in your account, managed under Groups from the Professional plan, and every address one member reports is dropped on every other member for the group window, 24 hours by default, on every port, in its own kernel set. Entries and exceptions can be added by hand in the portal, a member's own addresses are never on the list, and a signed webhook per ban event tells your own tooling, retried three times if it does not answer. A key in no group behaves exactly as before.
Port scan detection from the kernel. A firewall rule behind the lists logs a SYN to a port this host does not listen on, at most ten a minute, and the scan source reads those lines from the journal, or from kern.log where there is none. Ten probes inside ten minutes from one address are a scan: banned like any other find and reported under the port scan category. The listening ports are read at every sync, and the rule also asks the kernel whether a socket listens on the port at that moment. A service you start is never a scan target, and neither is the passive range of a running FTP server.
The reputation of your own address. Every run checks whether the address this host reports from is itself in the community database, and status warns with the confidence, the report count and the delisting page, so a compromised box or a shared address does not go unnoticed. The warning clears with the first run after delisting.

Linux Agent docs Network-level blocking Threat categories View pricing Installation examples

One command, as root

# At a terminal: it shows the terms of use and takes a yes, then
# asks for your key, then three short questions, and Enter takes the
# safe answer every time.
curl -fsSL https://reportedip.com/agent/install.sh | sh

# For automation, and for fifty hosts: nothing is asked, the terms
# are accepted up front.
curl -fsSL https://reportedip.com/agent/install.sh | REPORTEDIP_ACCEPT_TERMS=1 REPORTEDIP_KEY="YOUR_API_KEY" sh

The first thing the script shows is the terms of use, and it needs a yes before it downloads anything. It checks that it runs as root, that the platform is Linux, that the architecture is amd64 or arm64 and that a checksum tool exists. Then it downloads the build for your architecture with your key, verifies it against SHA256SUMS and installs it to /usr/local/bin. From there the setup probes which services run, which ports listen and where this distribution keeps its logs, and writes the configuration itself. Take the second form whenever a script runs this, because it asks nothing and needs no terminal.

The first sync builds the rules

reportedip-agent sync

The installation touches no firewall rule: no chain, no set, no jump. This run creates all of it and loads the five per-service lists, which is why the installer ends by telling you to run it. Until then the host is exactly as it was, and an installation you decide against costs one rm of two directories.

See that it ran, before anything drops

reportedip-agent status
reportedip-agent doctor
reportedip-agent test /var/log/auth.log
reportedip-agent rules list

status prints an entry count per list, the state of the chain, the whitelist and the licence state of this host, so one screen tells you whether the install worked. doctor says what this host brings and what is missing, and changes nothing: no file, no rule, no set. test runs the detectors over a real log, gzipped files included, and prints which address would have crossed which threshold and when, without reporting or banning anything. rules list shows every detector as the file it is, with the layer it came from and whether it is on.

This host drops from its first sync on, because that is what the installation writes. Answer log if you want to read for a week first what would have been cut off. The documentation walks through the same installation in full: every flag, every configuration key, and the granular questions the quick path skips.

Will it block one of my customers by mistake?

Four things stand in the way of that, and the first three cannot be switched off. Private ranges, loopback, this server's own addresses and the SSH address the installation came from are never reported and never blocked. Your own whitelist sits in front of every drop. The list is scored, and you choose the threshold: at confidence 75 a licensed server received 12,545 addresses on 29 September 2026, at confidence 90 it was 4,173. The host drops from its first sync on, and if you want to read that for a week first, answer log instead of drop during the install.

How much work is the setup on a box with a hundred sites?

One command. The installer probes which services run, which ports listen and where this distribution keeps its logs, then writes the configuration itself. On a production hosting host that came to 196 virtual host logs covered by 62 lines, with a threshold per source rather than one global number. There is no acquisition rule to write per service and none to maintain when a site is added, because the paths are globbed.

What does it send us?

The address, the threat category IDs and a generated sentence. Never a log line, a user name, a request body, a User-Agent or a URL. A server identifies itself with a random install id created during the installation, not with its name.

What happens on a server without a licence?

Only the feed download pauses. The list already in the kernel stays and keeps blocking, local detection and local blocking keep running, reports keep going and the agent still updates itself. A server never becomes unprotected because of an open invoice.

What does a second server cost?

Each additional licence is 4.90 € a month or 49 € a year, incl. VAT, and the price per licence falls as the count goes up: 3.90 € from five licences, 2.90 € from ten, 1.90 € from twenty-five and 1.40 € from fifty. The step you reach applies to every licence, not only to the ones above it. Without a licence the agent still runs on the Free plan: it detects and blocks locally in full and reports what it finds. Only the community feed needs a server licence; Professional includes one, Business three.

Does a server count against my domains?

No. Servers are their own pool, counted separately from the domains of the Hive plugin. The Business volume multiplier raises the domain count but not the number of included servers.

How fresh is the list on my server?

On a licensed server from the Professional plan the agent refreshes it every 15 minutes and takes everything scored at confidence 75 and up. The request is conditional, so a list that has not changed answers with a 304 and transfers nothing, which is what makes a short interval cheap. The swap into the kernel sets is atomic, so there is never a moment where a set is empty. Freshness and depth of the feed are what a plan buys; local detection, local blocking and reporting do not depend on it.

Can I keep the blocklist I already use?

Yes. The agent only ever writes its own sets and its own chain, and it never touches a rule or a set it did not create, so another list, an existing firewall installation or a hand-written chain keeps working next to it. If you want to see what the agent would add before you commit, run it in log mode and compare.

Can I write my own detection rules?

Yes, and every shipped detector is one already: a YAML file with a pattern, a block that names where the address stands in the line, a threshold and its own examples. A file of yours under /etc/reportedip-agent/rules.d/ adds a rule or overrides a shipped one field by field, and the agent picks it up within a minute. reportedip-agent rules check names any mistake with file and line before the daemon sees it, and test with --rule runs one rule against a real log. Three things protect you from a rule that reads the wrong field: the examples are checked every time the file loads, a new rule of yours bans but does not report for its first 24 hours, and a rule whose threshold is reached by addresses on your own whitelist stops reporting by itself.

WordPress Plugin · Free

ReportedIP Hive

Real-time WordPress security with 16 detection sensors, a Web Application Firewall, four 2FA methods and an opt-in community threat network. Free and open source forever.

Plugin overview

REST Threat Intelligence · Free tier

Public API

The reputation engine behind everything. Query IPs, submit reports, pull the blacklist and run bulk operations from any language, your SIEM, your firewall or your hosting panel.

API reference

Downloadable Feed · Free

Blacklist Feed

Community-driven blacklist, automatically scored from real-time reports. Plain text, JSON and CSV, ready for iptables, nftables, nginx or any blocklist consumer.

Blacklist docs

Live DNSBL Add-on · from PRO

DNS / RBL Zone

Ask a DNS question instead of downloading a list: your mail server looks the address up live, the same way it already queries Spamhaus. No imports, always fresh.

RBL Zone docs

DNS Diagnostics · Free

DNS Checker

Domain health diagnostics from 76 resolvers across 6 continents. Validate SPF, DKIM, DMARC and DNSSEC, run DNSBL lookups and track propagation during migrations.

Open the tool

PTR Check · Free

Reverse DNS Lookup

Resolve the PTR record of an IPv4 or IPv6 address and check whether it resolves back. A PTR record nobody confirms is the most common reason a mail server is refused at the door.

Open the tool