// tool reference · Network & Firewall
IP Reputation Checker Free
Look up the reputation and risk of an IP address.
Open IP Reputation Checker → Engine: /security-tools/ip_reputation
What it does
Looks up the reputation and risk of an IP address: blocklist membership, category (Tor exit, scanner, bot, hosting), and a confidence-weighted risk score. Use it to decide whether a source IP in your logs deserves attention.
When to use it
- Triaging a source IP that appears repeatedly in auth failures.
- Deciding whether to block an address at the edge.
Inputs
Field names are the actual form parameters, verified against source.
| Field | Type | Required | Notes |
|---|---|---|---|
| ip | text | required | A single IPv4 or IPv6 address. |
What you get back
Risk score, category, blocklist hits, and a recommended action.
Worked example
Input
185.220.101.5
Output (abridged)
Risk: HIGH Category: Tor exit node Recommendation: expected for anonymised traffic; block only if your threat model excludes Tor. Correlate with what the IP actually did.
How it works
Deterministic lookup against aggregated reputation sources.
Limits
Read live from the platform configuration.
| Rate limit | 30 requests / 60s (platform default) |
Limitations — what it does not do
Reputation is a lagging, aggregated signal. A freshly-rented VPS with no history looks clean, and a shared NAT can look dirty because of someone else. Reputation informs a decision; it does not make one.
Privacy
The queried address is not associated with your account.
Standards
MITRE ATT&CK (T1090 Proxy)