Look up an IP before you trust it.
isipsafe is a shared record of addresses caught attacking servers: password guessing, exploit attempts, spam, floods. Check one, report one, or pull the whole list into your firewall.
You are connecting from 216.73.217.10.
Just reported
| Address | What happened | When |
|---|---|---|
| 🇺🇸192.3.47.172 | Tor Exit Node | |
| 🇱🇺107.189.29.8 | Tor Exit Node | |
| 🇳🇱178.162.175.5 | Tor Exit Node | |
| 🇸🇪198.167.206.141 | Tor Exit Node | |
| 🇳🇱91.148.244.131 | HackingBad Web BotWeb App AttackVulnerability Scan | |
| 🇨🇳113.128.217.42 | Exploited Host | |
| 🇩🇪64.89.163.146 | Exploited Host | |
| 🇻🇪38.252.184.33 | Exploited Host | |
| 🇩🇪185.87.121.1 | Brute-ForceSSH | |
| 🇺🇸20.40.251.38 | Web App AttackRemote Code Execution | |
| 🇺🇸2602:80d:1008::64 | Bad Web BotVulnerability Scan | |
| 🇦🇩195.178.110.232 | Brute-ForceSSH | ×2 |
How it works
-
Someone gets attacked
A sysadmin in Leeds sees four hundred failed root logins in an hour. Their fail2ban bans the address and, with one extra line of config and their free key, reports it here.
-
Reports add up
The same address hits a shop in Lyon and a mail server in Osaka. Each independent report raises its confidence score. Old reports fade, so the score reflects what the address is doing now.
-
Everyone else is warned
The next server looks it up before letting it near a login form, or has already dropped it via the blocklist. One person's bad afternoon saves a few thousand others theirs.
Questions people ask
What is isIPsafe?
isIPsafe is a free database of IP addresses that have attacked servers. People who run servers report the addresses behind SSH brute force, web attacks, spam and scans, and anyone can look an address up before trusting it.
How do I check if an IP address is malicious?
Enter the IP address in the search box at the top of this page. You get an abuse confidence score from 0 to 100, the number of reports and reporters, attack categories, and the owning network and country.
How do I report an IP address that attacked my server?
Sign in with your email for a free API key, then use the report form or one curl command. fail2ban, nginx, Postfix and Windows RDP can report automatically; the integrations page has ready-made setups.
Is isIPsafe free?
Yes. Anyone can make 400 lookups a day without an account, and a free account adds reporting, 10,000 lookups a day and the blocklist. Enterprise, for OEM licensing, private hosting and no limits, is quoted per customer.
How is the abuse confidence score calculated?
The score counts independent reporters from the last 30 days, with older reports fading and each report weighted by how reliable the source looks. An address needs several independent reports to reach the blocklist threshold of 75.
Report what your servers already see
Reporting takes one line of configuration and a free account. The list is only as good as the reports in it. If your logs are full of attackers anyway, sending them here costs you one line of configuration and helps everybody else.