WORLDEYE PRO TOOL

IP Reputation Checker — Is This IP Malicious?

Check an IP address, domain, or file hash against public threat feeds and blocklists, and see what the security community's sensors have reported about it.

TARGET — IP, DOMAIN OR FILE HASH

PREVIEW — WORLDEYE PRO
Open in WorldEye

EXAMPLE RESULT — FORMAT ONLY, NOT A LIVE CHECK

Reputation check of a sample address

Target
203.0.113.66
Feed A
listed — category: port scanning — reported recently
Feed B
not listed
Feed C
listed — category: spam source — older report
Reading
2 listings — a lead to investigate, not a verdict

This is the shape of a real result, shown with a documentation-range example address; feed names are generalised here. The live check runs inside WorldEye's RECON board and is included with WorldEye Pro.

What a reputation result can and can't tell you

  • Reputation here is feed-based: it reports what public threat feeds and blocklists list about an address. A listing is a lead to investigate, not a verdict that the address — or its current user — did anything wrong.
  • IP addresses change hands. An address listed for spam or scanning last month may now belong to a cloud customer or home user who had nothing to do with it.
  • Absence from the feeds is not proof of innocence either: fresh infrastructure used in a new campaign may not be listed anywhere yet.
  • Use a result to decide how much scrutiny something deserves — extra checks on a flagged sender, for example — not as the sole basis for accusing or blocking anyone.

Your mail server, firewall, or inbox shows you an address you have never seen: a login attempt at 3am, a server your site suddenly talks to, a sender whose mail looks almost right. The first question is the oldest one in security — has anyone seen this address misbehave before? An IP reputation checker answers it by searching the public threat feeds and blocklists that security teams and sensor networks publish: spam sources, known scanners, botnet infrastructure, phishing domains, and malware hashes.

WorldEye's Threats check lives in the RECON board's Threat & Exposure group, and it accepts the three identifiers investigations actually start with: an IP address, a domain, or a file hash. The result gathers what the feeds say into one place — which lists carry the identifier, what category they file it under, and when it was seen — alongside the board's other views of the same target, so you can pivot from a flagged IP to its device record, its open ports, or the network it sits in without starting over.

The craft is in reading the result proportionately. One stale listing on one list, for an address that cloud providers recycle weekly, means very little. Fresh listings across several independent feeds, in categories that match what you observed, mean a great deal. The checker gives you the raw material for that judgement; it deliberately does not compress it into a single trustworthy-or-not score, because real reputation does not work that way.

How it works

  1. 1Open the RECON board on the WorldEye globe and choose Threats in the Threat & Exposure group.
  2. 2Enter the IP address, domain, or file hash you are investigating.
  3. 3Run the check. WorldEye searches the public threat feeds and blocklists it tracks for that identifier.
  4. 4Read the listings feed by feed: which lists carry it, under what category, and how recently it was reported.
  5. 5Pursue the lead in the same board — open the address's device record, port scan, or subnet — and weigh the listings together with what you observed yourself.

Run Threats in WorldEye

Threats runs live in WorldEye's RECON board — RECON board → Threat & Exposure → Threats — and is included with WorldEye Pro. Create a free account to explore the board and its free tools, and upgrade when you need the Pro modules.

Open the globeCreate a free accountSee WorldEye Pro

IP reputation questions

How can I tell if an IP address is malicious?+
Start with reputation: check the address against threat feeds and blocklists, as this tool does, and look at the pattern — multiple independent, recent listings in categories like scanning, spam, or botnet activity are a strong signal. Then add context: what did the address actually do to you, whose network does it sit in, and is it a shared cloud address? Reputation plus your own observation is a judgement; either alone is a guess.
An IP I use is listed. Does that mean I did something wrong?+
Usually not. Addresses are recycled constantly — your cloud instance, VPN exit, or home connection may have inherited an address a previous holder abused. Listings also expire and most feeds offer delisting once the activity stops. Treat a listing on your own address as housekeeping: check nothing on your side is compromised, then request delisting from the feed that carries it.
Can I check a domain or a file hash too?+
Yes. The same check accepts domains — useful for phishing and malware-distribution lookups — and file hashes, which identify a specific known file such as a malware sample. A hash match is the most precise of the three: hashes identify exact bytes, whereas IP and domain reputation describe infrastructure that can be shared or sold.
An address came back clean. Is it safe to trust?+
Clean means not listed in the feeds checked, at the time of the check. Brand-new malicious infrastructure often has no listings yet, and some campaigns deliberately use reputable cloud addresses. Use a clean result to lower concern, not to switch it off — normal authentication, authorisation, and monitoring still apply to every address.
Should I block every listed IP automatically?+
Carefully. Automatic blocking on a single feed listing will eventually block innocent users who inherited recycled addresses, and can cut off shared services like VPN exits and cloud regions. Most teams weight listings by freshness, feed quality, and category, and block decisively only on strong, current, corroborated signals.
What does it cost?+
Threats is a Pro module in WorldEye's RECON board, included with WorldEye Pro. The board also includes a free Data Leak Checker on the Tools page, which searches public breach data for an email address with no account at all.

Keep exploring

Data Leak Checker — is an email in a known breach? (free)Shodan IoT Lookup — the device record for any IP (free)Vulnerability Sweep — known CVEs on a hostAll WorldEye tools

One email when the sky does something big

Rocket launches, storms overhead and new camera drops — plus major WorldEye news. Rare, and no spam, ever.

Instant subscribe — no confirmation email. We check the address as you type it in.

All WorldEye tools Open the live map