IP Abuse & Reputation Checker

Check an IP's abuse score and risk tier from cross-feed threat corroboration — not a mail-server blacklist (DNSBL) lookup. Same scoring as the abusive networks database.

Enter an IP address above and press Check.

This is not a DNSBL / email-blacklist check. Tools like Spamhaus or mxtoolbox's blacklist checker test whether a mail server IP appears on an email-deliverability blocklist. This tool checks something different: whether multiple independent threat-intelligence feeds have flagged this network for hosting spam infrastructure, malware C2, botnet relays, or mass-exploitation tooling — the same cross-feed model behind the most abusive networks.

How the score works

abuse_score
1–10. Higher means more independent feeds corroborate the same network as hostile.
risk_tier
Critical (8–10), High (5–7), or Medium (3–4) — a network needs 3+ corroborating sources to register at all.
threat_type
tor_exit, vpn, or abuser — whichever classification took priority for this address.

FAQ

No. DNSBL tools check mail-deliverability blocklists specifically. This checks general cross-feed threat corroboration — spam, malware, and botnet infrastructure reporting, not email-specific reputation.
Different services maintain different lists for different purposes. A clean cross-feed abuse score here does not guarantee a clean result on a specific mail DNSBL, a payment-fraud list, or a platform's own internal ban list.
Every 6 hours, same as the abusive networks feed this tool reads from.
The abuse score runs 1–10 by how many independent feeds flag the same network: medium is 3–4, high is 5–7, and critical is 8–10. A network needs at least 3 independent sources to appear at all, so a single noisy blocklist can't flag an IP on its own.

About this tool

This tool reports how an IP address is regarded across threat intelligence sources and condenses it into an abuse score and a risk tier. It looks at corroboration across several feeds rather than relying on any single one.

How it works

An address that appears in several independent feeds scores higher than one that appears in only one, which reduces false positives from a single noisy list. The result also shows the network the address sits in, so you can see whether the problem is one host or a whole range.

What to keep in mind

This is a reputation score, not a mail-server DNS blocklist check, and it should not be used as a substitute for one when diagnosing email delivery. Shared and reassigned addresses can inherit a bad reputation from a previous user.

Common uses

Security teams use it to prioritize investigation of suspicious sources, to decide whether to rate limit or challenge a request instead of rejecting it, and to enrich incident reports with a consistent, explainable score.

Related: VPN and proxy checker · Abusive networks · Threat feeds · IP lookup