IP Reputation Check
Check any IP address for threats. Get a confidence-weighted composite threat score - instantly.
Threat Score
0–100 confidence-weighted composite score
Threat Indicators
Multiple independent signals corroborated
Tor / Proxy
Exit node and anonymous proxy detection
Network Context
ASN, prefix, RPKI status for full picture
How Threat Scoring Works
ipctl's threat score is not a simple blocklist lookup. We correlate signals across independent sources. An IP flagged independently by several signals scores higher than one with a single flag. Different threat categories carry different weights, and cross-category signals compound using diminishing returns to prevent score inflation.
No threat indicators found across any source
Minor flags - Tor exit node, single blocklist hit, or stale entry
Multiple sources flagging this IP - active scanner or brute-force source
High-confidence threat - C2 infrastructure, botnet, or confirmed malware
What We Analyze
Our threat intelligence engine is updated automatically to deliver a comprehensive view of any IP address.
Curated external threat intelligence, regularly updated
Proprietary scoring engine combining signals across categories
Real-time identification of Tor exit nodes, VPNs, and anonymous proxies
Known command-and-control infrastructure and botnet participation
IPs involved in active brute-force, scanning, or credential stuffing attacks
ASN reputation, prefix hygiene, and RPKI validation status
Why Multi-Provider Scoring Matters
Single-source checks produce false positives. An IP appearing on one list might be a stale entry or an overly broad classification. When the same IP is flagged by multiple independent sources, that corroboration dramatically increases confidence in the result.
ipctl's scoring engine uses a diminishing-returns formula across sources. The first signal sets the base score; each additional independent confirmation boosts it, but with decreasing marginal impact to prevent score inflation.
Programmatic Access
Query IP reputation via the REST API. Free tier includes 1,000 requests/day.