# isipsafe

> isipsafe is a free, community-run database of IP addresses that have attacked servers on the internet. Anyone can look up an IP address, report one that attacked them (SSH and RDP brute force, web application attacks, spam, phishing, DDoS, port scans and more), and signed-in users can download a blocklist of the worst offenders.

Key facts:
- Looking up an IP address is free without an account (400 lookups per 24 hours). A free account adds reporting, 10,000 lookups per 24 hours and 10 blocklist downloads per 24 hours. Enterprise has no limits and includes OEM/resale licensing, private hosting and support (contact sales).
- Every reported address gets an abuse confidence score from 0 to 100, based on how many independent reporters flagged it in the last 30 days, weighted towards recent and signed-in reports.
- Signing in uses a magic link sent by email; there are no passwords. New users get a private API key.
- The blocklist is available as plain text, CSV, JSON, STIX 2.1, ipset, nftables, nginx, Apache and MikroTik formats.
- Category IDs 1-23 use the same numbering as most existing abuse reporting tools, so fail2ban actions written for other services work with a URL change.
- Licence: the data may be used to protect your own systems; reselling or redistributing it, or building products or services on it, directly or indirectly, requires written authorisation (see /terms section 6 and /eula).
- Lookups flag current Tor exit nodes and allowlisted addresses (major public DNS resolvers), which can never be reported or blocklisted.
- Signed-in users can watch up to 10 networks and get a daily email when anything inside them is reported.
- IP geolocation and ASN data comes from DB-IP (db-ip.com), CC BY 4.0.

## Pages
- [Check an IP](https://isipsafe.com/): look up any IPv4 or IPv6 address, network (CIDR) or hostname
- [Report an IP](https://isipsafe.com/report): web form for reporting an abusive address (free account)
- [Pricing](https://isipsafe.com/pricing): anonymous, free account and Enterprise plans
- [Integrations](https://isipsafe.com/integrations): one page per tool, including fail2ban, SSH, nginx, Apache, WordPress, Postfix, Windows RDP, pfSense, OPNsense, MikroTik, Cloudflare, MISP, OpenCTI, Splunk, Elastic and Graylog
- [API reference](https://isipsafe.com/api): REST API documentation
- [OpenAPI spec](https://isipsafe.com/api/v1/openapi.json)
- [Report categories](https://isipsafe.com/categories)
- [Statistics](https://isipsafe.com/statistics)
- [Abuse by country](https://isipsafe.com/countries): reported addresses per country, with a page per country at /countries/{code} (for example /countries/de)
- [Most reported networks](https://isipsafe.com/asn): a page per autonomous system at /asn/{number}
- Category pages at /categories/{code} (for example /categories/ssh): the addresses most reported for that attack type
- [Monthly threat report](https://isipsafe.com/trends): top networks, countries and attack types each month, at /trends/{yyyy-mm}
- [FAQ](https://isipsafe.com/faq)
- [About](https://isipsafe.com/about) and [Vision](https://isipsafe.com/vision)
- [Terms](https://isipsafe.com/terms), [Acceptable use](https://isipsafe.com/acceptable-use), [Privacy](https://isipsafe.com/privacy), [EULA](https://isipsafe.com/eula)

## API in one minute
- Check: GET https://isipsafe.com/api/v1/check?ip=203.0.113.7  (no key needed for up to 400 lookups per 24 hours)
- Report (key required): curl "https://isipsafe.com/api/v1/report?key=YOUR_KEY" -d ip=203.0.113.7 -d categories=ssh,brute-force -d comment="sshd brute force"
- Blocklist: curl "https://isipsafe.com/api/v1/blocklist?key=YOUR_KEY&format=txt&confidenceMinimum=90"
- The API key goes in the URL as ?key=YOUR_KEY or in an "Authorization: Bearer YOUR_KEY" header.

## Categories
- `dns-compromise` DNS Compromise (legacy id 1): Altering DNS records so that traffic is sent somewhere it should not go.
- `dns-poisoning` DNS Poisoning (legacy id 2): Falsifying a resolver's cache (cache poisoning).
- `fraud-orders` Fraud Orders (legacy id 3): Placing fraudulent orders in a shop or booking system.
- `ddos` DDoS Attack (legacy id 4): Taking part in a distributed denial-of-service attack, usually as part of a botnet.
- `ftp-brute-force` FTP Brute-Force (legacy id 5): Guessing passwords against FTP or FTPS servers.
- `ping-of-death` Ping of Death (legacy id 6): Malformed or oversized packets sent to crash a host.
- `phishing` Phishing (legacy id 7): Hosting phishing pages or sending phishing email.
- `voip-fraud` VoIP Fraud (legacy id 8): SIP scanning, toll fraud and unauthorised calls through a phone system.
- `open-proxy` Open Proxy (legacy id 9): Open proxy or open relay. For Tor exit nodes use Tor Exit Node.
- `web-spam` Web Spam (legacy id 10): Comment, forum or referrer spam aimed at websites.
- `email-spam` Email Spam (legacy id 11): Unsolicited bulk email or mail carrying malicious attachments.
- `blog-spam` Blog Spam (legacy id 12): Spam posted into blog comment forms.
- `vpn` VPN IP (legacy id 13): The address belongs to a VPN service. Use together with another category.
- `port-scan` Port Scan (legacy id 14): Scanning for open ports and listening services.
- `hacking` Hacking (legacy id 15): General intrusion attempts that do not fit a more specific category.
- `sql-injection` SQL Injection (legacy id 16): Trying to inject SQL through forms, query strings or headers.
- `spoofing` Spoofing (legacy id 17): Forging the sender of an email or the source of traffic.
- `brute-force` Brute-Force (legacy id 18): Password guessing against logins: SSH, RDP, FTP, SMTP, web forms and so on.
- `bad-bot` Bad Web Bot (legacy id 19): Scrapers and crawlers that ignore robots.txt, fake their user agent or hammer a site.
- `exploited-host` Exploited Host (legacy id 20): The machine looks compromised and is being used to attack others. Use with another category.
- `web-app-attack` Web App Attack (legacy id 21): Probing or exploiting web applications: WordPress, Drupal, phpMyAdmin, shop software, plugins.
- `ssh` SSH (legacy id 22): Abuse of the SSH service. Use together with Brute-Force or Hacking.
- `iot` IoT Targeted (legacy id 23): Attacks aimed at routers, cameras and other connected devices. Mention the device in the comment.
- `rdp` RDP Abuse (legacy id 24): Login attempts or exploits against Remote Desktop.
- `mail-server-attack` Mail Server Attack (legacy id 25): Password guessing or relay attempts against SMTP, IMAP or POP3.
- `xss` Cross-Site Scripting (legacy id 26): Injecting script into pages through parameters, forms or headers.
- `path-traversal` Path Traversal / LFI (legacy id 27): Requests for ../../etc/passwd, .env, .git and other files outside the web root.
- `rce` Remote Code Execution (legacy id 28): Exploit attempts that try to run commands on the server (Log4Shell, command injection, deserialisation).
- `credential-stuffing` Credential Stuffing (legacy id 29): Logging in with username and password pairs leaked from other sites.
- `vuln-scan` Vulnerability Scan (legacy id 30): Automated scanning for known CVEs and misconfigurations.
- `malware-hosting` Malware Distribution (legacy id 31): Serving malware, droppers or malicious payloads.
- `c2` Command & Control (legacy id 32): Botnet or malware command-and-control server.
- `cryptojacking` Cryptojacking (legacy id 33): Dropping or controlling unauthorised cryptocurrency miners.
- `api-abuse` API Abuse (legacy id 34): Hammering, scraping or fuzzing an API beyond fair use.
- `card-testing` Card Testing (legacy id 35): Checking stolen payment cards with small transactions.
- `database-attack` Database Attack (legacy id 36): Attacks on exposed MySQL, PostgreSQL, Redis, MongoDB, Elasticsearch and similar.
- `http-flood` HTTP Flood (legacy id 37): Layer 7 flood: large numbers of HTTP requests meant to exhaust a site.
- `sms-pumping` SMS / OTP Pumping (legacy id 38): Triggering SMS or one-time-password messages to rack up telecom charges.
- `fake-accounts` Fake Accounts (legacy id 39): Mass sign-ups, fake reviews or account farming.
- `telnet` Telnet Abuse (legacy id 40): Login attempts against Telnet, usually from IoT botnets.
- `tor-exit` Tor Exit Node (legacy id 41): Abuse arriving through a Tor exit relay. The operator is usually not the attacker; use together with what was done.