IP reputation check
Paste any IPv4 or IPv6 address to see its reputation: allowlist, greylist or blocklist, with the evidence behind it. The same lookup shows whether the address is a VPN, proxy, Tor exit or hosting server. Free, no signup.
Check an IP's reputation
Many addresses: the bulk check. In code: the free API returns it as the reputation field, no key needed.
What each result means
| Reputation | Meaning | Suggested action |
|---|---|---|
| Allowlist | No abuse on record and nothing hiding the user: an ordinary home, mobile or business line, or shared infrastructure such as a CDN or public DNS. | Let it through. |
| Greylist | No abuse on record, but the address hides who is behind it or sits in a hosting network: a VPN, proxy, Tor exit or cloud server. | Allow reading; add a light check (email or CAPTCHA) on signup and payment. |
| Blocklist | The address is on current public blocklists of hosts seen attacking, scanning, sending spam or controlled by malware. | Block or review sensitive actions; expect the listing to age out once the abuse stops. |
How the reputation is decided
Reputation answers one question: has this address misbehaved recently? It is kept apart from the VPN verdict on purpose. A commercial VPN server with a clean record is greylisted, not blocklisted, because hiding an address is not the same as attacking from it.
Only abuse evidence puts an address on the blocklist. iplogs.com refreshes several public blocklists of attacking and compromised hosts every two hours, so a listing reflects recent activity and drops off after the address stops showing up there.
Each answer lists the evidence behind it. Open an address to see the evidence that matched, alongside its VPN, proxy and Tor signals, owner, network and location.
For the 0 to 100 risk score that sits next to the reputation, see the IP fraud score page; the glossary covers the terms.
Questions
What is IP reputation?
It is a judgment about how an IP address has behaved: whether it has been seen attacking other hosts, scanning for weaknesses, sending spam or taking part in a botnet. Sites use it to decide how much to trust traffic from an address before they know anything else about the visitor.
Why is my IP on a blocklist when I did nothing wrong?
Addresses are shared and reused. Your ISP may have given you an address that a previous customer abused, or many customers may share it through carrier-grade NAT, or an infected device on your network may be scanning without your knowledge. Listings usually expire within days once the activity stops; restarting the router often gets you a different address.
Is this the same as an email blacklist check?
No. Email blocklists (DNSBLs) track addresses that send spam mail and decide whether a mail server accepts your messages. This check covers web and API traffic: attacks, scanning, malware and anonymizers. To fix email delivery problems, look up your mail server's address on the DNSBLs your recipients use.
Does a VPN give me a bad IP reputation?
Not by itself. A VPN server with no abuse on record is greylisted: no bad history, but the address hides who is using it. Some VPN and proxy addresses do end up on blocklists because other users of the same server abused it, and then the blocklist evidence shows on the result.