Guides
Practical answers about blacklisted addresses, attacks in your logs and how IP reputation works.
Need a quick answer about one address? See what is my IP, or use the bulk IP check for a list.
Blacklist problems
What to do when your own address has been listed.
Why is my IP address blacklisted?An IP address is usually blacklisted because of a compromised device, a shared or reused address, or software that looks like an attack. Here is how to find out which.How to remove an IP address from a blacklistFind the list that named your address, fix the cause, then follow that operator's process. Here are the general steps, and how removal works on isIPsafe.How to tell if your server is compromisedLook for unexplained outbound traffic, unfamiliar processes and jobs, new SSH keys and abuse complaints. These checks help you find them and decide what to do next.
Scanners and networks in your logs
Who is behind the traffic you keep seeing.
Censys scanner: what it is and how to block itCensys scans the internet to map exposed services. Seeing it in your logs usually means your server is reachable. Here is how to verify it and opt out.Shodan scanner: is it malicious, and can you block it?Shodan is a search engine for internet-connected devices. Here is how to recognise its scanners, what they mean for you and the limits of blocking them.Why is a cloud provider's IP attacking my server?Attacks from Google Cloud, Azure or AWS addresses usually come from those providers' customers or compromised machines. Block or report the address, not the whole network.
Stopping attacks
Practical steps against the most common attacks.
How to stop SSH brute force attacksTurn off password logins and use SSH keys, limit who can reach the port, and ban repeat offenders. Here are the steps, with commands.How to stop wp-login.php and xmlrpc.php attacksProtect WordPress with strong passwords and two-factor authentication, rate limit wp-login.php and turn off xmlrpc.php if nothing needs it. Includes nginx examples.What is a port scan, and should you worry?A port scan finds out which services a server exposes. Scans are constant and do not mean you were breached, but they show what you should close or patch.
Definitions
Short explanations of the terms used across this site.
What is an IP reputation score?An IP reputation score estimates how likely an address is to be abusive, based on what it has been seen doing. Here is what the numbers mean and what they cannot tell you.IP blacklist vs whitelist: what is the difference?A blacklist names addresses to block and allows the rest. A whitelist names addresses to allow and can block the rest. Most systems use both.What is a Tor exit node, and should you block it?A Tor exit node is the address websites see when someone connects through Tor. Traffic can come from many unrelated people, so here is how to decide what to do with it.
Use cases
How the data fits particular systems and teams.
IP blacklists for email serversMail servers need attack protection and spam filtering, and these call for different lists. Here is where an attack blacklist helps and where a specialist list is better.IP blacklist for managed service providersMSPs can use isIPsafe on a free account to protect the systems they manage for clients. Here is what the terms allow and how to work within the limits.IP reputation for AI agentsGive an AI agent IP reputation data through the isIPsafe MCP server, with nothing to install. Here is how to connect it and use it safely.
For developers
Using the API and the blacklist from your own tools.
Free IP reputation APIA free REST API to check IP reputation, report attacks and download a blacklist. Lookups work without a key, and a free account allows more.IP blacklist download formats: JSON, CSV, STIX, ipset and moreDownload the isIPsafe blacklist as text, CSV, JSON or STIX 2.1, or as rules for ipset, nftables, nginx, Apache and MikroTik, with filters for score, country and IP version.
Comparisons
How we compare with other services, including where they are the better choice.
The best free IP blacklists comparedThe best free IP blacklist depends on what you are protecting. Compare isIPsafe, AbuseIPDB, Spamhaus DROP, CrowdSec, FireHOL and GreyNoise on contents, access and licence.AbuseIPDB alternativeA side-by-side comparison of isIPsafe and AbuseIPDB, including price, limits, data and tools.CrowdSec alternative: isIPsafe comparedisIPsafe is a reputation database you query or download from, while CrowdSec is software you run that detects attacks locally. Compare them, or use them together.Spamhaus alternative: isIPsafe comparedSpamhaus focuses on mail and network reputation lists, while isIPsafe is a community database of attacking addresses with scores. Many people should use both.FireHOL IP Lists alternative: isIPsafe comparedFireHOL collects and compares public IP feeds, while isIPsafe takes reports directly and scores each address. Here is how they differ and when each suits.GreyNoise alternative: isIPsafe comparedGreyNoise specialises in internet-wide scanning, while isIPsafe is a community database of reported attackers. Compare free limits, data and when each suits.IPQualityScore alternative: isIPsafe comparedIPQualityScore is built mainly for fraud prevention, while isIPsafe focuses on addresses reported for attacks. Which you need depends on what you are protecting.