IP Reputation Check
Is this IP malicious? Get a confidence-weighted 0-100 threat score, the attack categories it is flagged for, Tor, VPN and proxy detection, and the network behind it. Free, no signup.
Threat Score
0-100 confidence-weighted composite score
Attack Categories
Botnet, C2, brute-force, scanning, phishing, spam
Tor / VPN / Proxy
Anonymization flagged separately from attacks
Network Context
ASN, owner, prefix, RPKI and abuse contact
Is This IP Malicious? A Five-Step Check
A reputation lookup is the start of an investigation, not the verdict. Security analysts triaging an alert typically work through these steps:
- 1
Read the score and the flags
The 0-100 score says how strong the evidence is; the categories say what the address did.
- 2
Check the network
Hosting provider, residential ISP, mobile carrier, Tor or VPN: the same flag means different things on each.
- 3
Weigh recency and corroboration
Several independent, current reports outweigh one old listing on a single list.
- 4
Rule out shared addresses
CGNAT, CDNs and dynamic ranges can carry flags caused by other users or a previous holder.
- 5
Decide and act
Block, add friction, apply your Tor/VPN policy, or report the abuse to the network's abuse contact.
The full workflow, with examples and false-positive checks, is in the guide how to check if an IP address is malicious.
How the Threat Score Works
The threat score is not a simple blocklist lookup. It correlates signals across independent sources: an IP flagged independently by several sources scores higher than one with a single flag. Threat categories carry different weights, and additional confirmations raise the score with diminishing returns, so one stale listing does not make an address look as dangerous as one that is actively reported everywhere.
No threat indicators found across any source
Minor flags - Tor exit node, single blocklist hit, or stale entry
Multiple sources flagging this IP - active scanner or brute-force source
High-confidence threat - C2 infrastructure, botnet, or confirmed malware
Threat Categories and What They Mean
Every finding carries a category and a severity. The category answers "malicious how?", which decides the right response:
| Flag | Indicates | Typical response |
|---|---|---|
| c2 | Command-and-control server for malware or a botnet | Block; check internal hosts that contacted it |
| botnet, malicious | Infected or abused host taking part in attacks or malware distribution | Block; look for related activity |
| phishing | Hosts or has hosted phishing content | Block for web and mail traffic |
| brute-force, scanner | Login attempts or port scans against other networks | Block at exposed services |
| spam | Reported as a source of unsolicited mail | Relevant mainly for mail servers |
| tor-node, vpn, proxy | Anonymization service: the real user is elsewhere | Policy decision, not proof of abuse |
| hosting, cdn, mobile | Network type: data center, CDN or mobile carrier | Context for the verdict |
| hijacked, possibly_hijacked | The covering prefix was seen in a suspected BGP hijack | Treat traffic with suspicion |
Tor, VPN and Proxy Check
Anonymization services relay traffic for many users, so an address can be a Tor exit node, a commercial VPN endpoint or an open proxy without being an attacker itself. These flags are shown separately from attack categories and only raise the score moderately, so you can apply your own policy - allow, challenge or block - instead of treating every anonymized user as hostile.
Tor exit data is refreshed every 30 minutes. For a dedicated yes/no answer use the Tor exit node check.
IP Reputation API (REST and MCP)
Enrich SIEM alerts, SOAR playbooks and scripts with the same data. Anonymous use allows 250 requests per day; a free API key raises that to 1,000.
$ curl -s https://api.ipctl.io/v1/intel/192.0.2.10
{
"data": {
"score": 62,
"intel": [
{ "tag": "scanner", "severity": "medium" },
{ "tag": "brute-force", "severity": "high" }
]
}
}Illustrative response for a documentation address. In a shell, curl ipctl.io/ip/<address>/threat prints just the score. AI assistants such as Claude, Cursor or VS Code can call the MCP tool check_ip_reputation.
IP Blacklist Check vs IP Reputation
A blacklist check answers whether an address appears on a list. This check goes further: it shows every category the address is currently flagged for - malware and botnet activity, command-and-control, brute-force logins, port scanning, phishing, spam, open proxies, VPNs and Tor - and how well that is corroborated across independent sources.
If your question is why your own mail is being rejected, the spam flag here is a useful first signal, but mail delivery depends on the specific DNS blocklists the receiving servers use and on SPF, DKIM and DMARC. Check the blocklists named in the bounce messages as well.
Why Multi-Source Scoring Matters
Single-source checks produce false positives. An IP appearing on one list might be a stale entry or an overly broad classification. When the same IP is flagged by several independent sources, that corroboration substantially increases confidence in the result - which is why the score, not a single listing, is the number to act on.
Popular Lookups
Frequently Asked Questions
How can I tell if an IP address is malicious?
Look it up above and read the threat score together with the flagged categories and the network the address belongs to. Several independent, current reports of attacks - for example botnet, command-and-control or brute-force activity - from a hosting network are a strong signal. A single old listing, or an anonymization flag such as Tor or VPN on its own, is not.
How do I check if an IP address is blacklisted?
Enter the IP address in the search box above. The result shows a 0-100 threat score and every category the address is currently flagged for - malware and botnet activity, brute-force attacks, scanning, spam, open proxies, VPNs and Tor - together with its network, owner and location. No account is needed.
What does the threat score mean?
The score combines all threat signals for an address into one number. 0-20 means no indicators were found, 21-50 is low risk (for example a Tor node or a single stale listing), 51-75 means several independent sources flag it, and 76-100 is a high-confidence threat such as botnet or command-and-control infrastructure.
Is an IP blacklist check the same as an IP reputation check?
Not quite. A blacklist check answers whether an address appears on a list. A reputation check weighs how many independent sources flag it, for what, and how severe that is - so a single outdated listing doesn't make an address look as dangerous as one that is confirmed by several sources.
Can it tell whether an IP is a VPN, proxy or Tor exit?
Yes. Tor nodes, commercial VPN endpoints and open or anonymous proxies are flagged separately from malicious activity, so you can tell an anonymised user apart from an attacker. Hosting and CDN networks are shown as context and only nudge the score slightly.
How often is the reputation data updated?
Tor data is refreshed every 30 minutes and the other threat categories at least once a day. Listings that the sources withdraw disappear from the score automatically.
Why is my IP address flagged?
Shared addresses - hosting servers, mobile carriers and carrier-grade NAT - can inherit flags from other users or a previous owner of the address. If your own address is flagged, remove the cause (for example an infected device or an open proxy); the flag expires once the reporting sources stop listing it.
Can I use IP reputation in an AI agent, SIEM or SOAR?
Yes. AI assistants such as Claude, Cursor or VS Code can use the ipctl MCP server (tool check_ip_reputation), and SIEM or SOAR playbooks can call the REST API in an HTTP request step. Setup for both is on the integrations page.
Is there an IP reputation API?
Yes. GET https://api.ipctl.io/v1/intel/{ip} returns the threat score and flags as JSON. Anonymous use allows 250 requests per day; a free API key raises that to 1,000.