Frequently asked questions

A shared list of IP addresses that have been caught doing something nasty on the internet: guessing SSH passwords, probing WordPress for holes, sending phishing mail, flooding sites. People who run servers report what hits them, and everyone else can look an address up before deciding whether to trust it.

Not for protecting your own systems. Anyone can make 400 lookups a day without an account, and a free account adds reporting, 10,000 lookups a day and the blocklist. Enterprise, for unlimited use, OEM and resale licensing, private hosting and support, is priced per customer; see the Pricing page and contact sales.

Not to look addresses up: without one you get 400 lookups per 24 hours. You need a free account to report addresses, to make up to 10,000 lookups a day and to download the blocklist. Signing in takes one email: we send a link, you click it, done. There is no password.

A small team of engineers with a long background in running infrastructure and security tooling. The About page tells the story, and the legal details are in the Terms of Service.

Use the Report page, pick what the address did, and add a line of context if you can. From a server it is one curl command, and the Integrations page has ready-made snippets for fail2ban, sshd, nginx, Apache, Postfix and others.

Traffic you actually saw and that was clearly hostile: failed logins from a brute-force run, exploit attempts in your web logs, spam that hit your mail server. Do not report an address because you dislike a company, because a scan looked vaguely odd once, or based on someone else's list. The Acceptable Use page has the full rules.

A short note an admin would find useful, for example "42 failed root logins on sshd in 3 minutes" or "GET /wp-login.php and /xmlrpc.php, 300 requests". Leave out your own hostnames, usernames, email addresses and anything else that identifies you or your users. Comments are public.

Each reporter can report the same address once every 15 minutes. More reports from the same source do not make an address more dangerous, they just make the database bigger. Send one report per incident and let the other reporters confirm it.

Yes. Open the address page and use "Remove my reports", or call DELETE /api/v1/clear-address with your key. That deletes every report you filed against that address and recalculates its score straight away.

Because a blocklist is only as good as the reports in it. Accounts make every report accountable and withdrawable by the person who made it, and stop anyone from flooding the list anonymously. The account is free and needs nothing but an email address.

Only the last 30 days matter. Each distinct reporter counts once, and their report loses weight as it ages (it is worth about half after ten days). Each signed-in reporter counts fully; automated feeds run by the team carry a weight set per feed. The total goes through a curve so the score climbs quickly at first and then flattens: one fresh signed-in report gives 33, three independent ones give 70, five give 86. Nothing ever reaches 100 on a single person's say-so.

The report is spread across the network: each address inside gets the report's weight divided by half the number of addresses. A /31 or /30 report counts almost fully for its two or four addresses, a /24 gives each of its 256 addresses 1/128 of a report, and a /16 barely registers. That way one network report cannot blacklist thousands of innocent neighbours, while a small, clearly abusive block still shows up.

Either the reports are old, or they all came from one or two reporters. The score is a measure of how sure the community is right now, not of how bad the address was at some point.

From the free DB-IP Lite databases, which map address ranges to a country, city and autonomous system (the network that owns the address). City-level data is approximate. It tells you roughly where the network is, not where a person is sitting.

Yes, everywhere: lookups, reports, network checks and the blocklist.

Those are private or reserved ranges. They cannot be the source of traffic on the public internet, so a report against them is always a mistake, usually a log line from behind a proxy or load balancer. If you see them in your logs, fix the logging to record the real client address first.

Sign in, and you get a private API key. Then either download it from your account page, or fetch it from a cron job with curl, putting the key in the URL as ?key=. An Authorization: Bearer header works too. The Integrations page has ready recipes for ipset, nftables, nginx and MikroTik.

The default threshold of 75 is conservative and suits most servers. Still, check it fits your situation before you drop traffic at the edge: a shared VPN exit or a mobile carrier's NAT can collect reports and still carry legitimate users. Blocking only on login endpoints, or rate limiting rather than dropping, is a sensible middle ground.

Yes. Sign in, open your account page and add up to ten networks under Network alerts. Once a day we email you a list of anything reported inside them. It is a cheap early warning that one of your machines has been compromised or a customer is misbehaving.

Yes. We refresh the Tor Project's public list of exit addresses every hour, and lookups and the API (isTor) say whether an address is currently an exit. Whether to block Tor is your call: it carries a lot of abuse, and also a lot of people with good reasons for privacy.

Not without a written agreement. You may use the data to protect systems you own or run, including systems you manage for your employer or clients. Selling it, redistributing it, offering it through your own feed or API, or using it to build or train another reputation product is prohibited, whether directly or indirectly, paid or free. Contact us with the topic "Partnership or data feed" to discuss a licence.

Open your account page and use the eye or copy button next to your key. Keys created before that feature existed cannot be shown again; create a new one there, and the old key stops working the moment you do.

Probably, with a URL change. The report and check endpoints accept the field names most abuse databases use (ip, categories, comment, maxAgeInDays), the JSON responses use the familiar names, and category numbers 1 to 23 are the ones existing fail2ban actions already send.

Without an account: 400 lookups per 24 hours per address, on the website and API together, and no reporting. Free account: 10,000 lookups per 24 hours, reporting (fair use up to 10,000 an hour), 50 bulk uploads and 10 full blocklist downloads per 24 hours. Enterprise: no limits. Every API response carries X-RateLimit headers so your scripts can back off.

First, check whether the reports are right. If your server was compromised or a customer was misbehaving, fix that and the score will decay on its own within a few weeks as no new reports arrive. If the reports are false or malicious, use the contact form with the topic "False positive / delisting" and tell us the address and why. We look at every request.

That happens with home broadband and mobile connections. Scores only look at the last 30 days and fade quickly, so a recycled address usually cleans itself up. If it is causing you trouble right now, contact us and we will take a look.

Each report is linked to your account so you can withdraw it later. If your public profile is switched on (the default), reports show your display name and link to your profile; switch it off on your account page and they show as "Verified reporter" instead. Your email address is never shown. When you look addresses up without signing in, we keep a keyed hash of your IP address for 24 hours to count your allowance, not the address itself.

Yes, by default. Every account has a profile page showing your display name (your company, or your name if you give no company), your logo if you upload one, your latest 10 reports and some statistics, and your reports link to it. It is a way to get credit for helping. Your email address is never shown. You can switch the profile off, change the display name and address, or remove the logo on your account page at any time.

Sometimes, under UK and EU law. We process reported addresses under legitimate interests (network security, which GDPR Recital 49 names explicitly), keep reports for a limited time, and honour objections. The Privacy Policy explains it properly.

From your account page. It removes your email, name, company and API key at once. Reports you filed stay, but without any link to you.