IP Reputation Checker.
Two attributed signals on any IPv4 or IPv6 address: our own datacenter/residential classification (hosting, cloud, CDN, and known-VPN networks), and Tor exit detection. An infrastructure and risk classification — not a community abuse score — with every source labelled.
IP reputation is how trustworthy an address looks to mail servers, fraud systems, and bot-mitigation tools. We surface two first-party components: our own datacenter/VPN classification (ASN analysis) and Tor exit-node status (the Tor Project's public list). Each is shown separately with its source — an infrastructure and risk classification, not a single combined number.
Last reviewed: May 2026
Check an address.
Enter any public IPv4 or IPv6 address. Private/reserved ranges are skipped — they have no public reputation by design.
What is IP reputation?
IP reputation is the rolling judgement of how trustworthy a specific IP address looks to the systems that have to decide whether to accept its traffic. Mail servers, fraud systems, ad-tech, and bot mitigation all maintain their own reputation views; some are based on direct reports of abuse, others on the network the IP sits in.
There is no single canonical "reputation score" — different sources use different signals and different timeframes. A good reputation tool surfaces the underlying components rather than collapsing them into one opaque number. That's what this page does.
How this tool works — and what each source means
Two first-party signals, each attributed to its source:
- Network classification (Network Lookup analysis). Our own derived signal. Every IP belongs to an Autonomous System (ASN); we maintain a curated list of major cloud providers, hosting companies, CDNs, transit networks, and known VPN infrastructure. An IP on one of those ASNs is classified as
datacenter; everything else is provisionally classified asresidential. ASN data comes from MaxMind GeoLite2. - Tor exit node detection. The Tor Project itself publishes a real-time list of exit relays. We cache it for 24 hours and check the IP against it. This is a derived signal computed from a public list rather than a third-party feed.
This is an infrastructure and risk classification, not a community “abuse score”. We deliberately don't use an abuse-report feed whose free tier forbids commercial use — see data sources for the full reasoning.
Why it matters
- Blocking and rate-limiting abuse. Inbound SSH, login forms, comment posting, signup pages — anywhere automated attacks land — benefits from adding friction to traffic from a known datacenter/VPN origin or a current Tor exit.
- Email deliverability. Your outbound sending IP's reputation determines whether your mail lands in the inbox or the spam folder. Missing reverse DNS, a datacenter classification, or a blacklist listing all hurt. Check the IP your mail server is sending from.
- Fraud and account protection. Card-not-present fraud and account-takeover attempts disproportionately originate from datacenter and Tor IPs. Combining these signals with your own device and behavioural data can inform a risk decision.
- Investigation. When a suspicious IP shows up in your logs, this is the fastest single page that tells you "who is this and is it known bad?" — with the receipts. Pair it with WHOIS for registration, reverse DNS for the PTR, and IP lookup for full geolocation.
Common questions
What does this tool check?
Two attributed signals: our own network classification (is the address on a datacenter, hosting, cloud, CDN, or known-VPN ASN, or is it residential?) and whether it is currently a Tor exit node. It's an infrastructure and risk classification, not a community abuse score — we deliberately don't use a non-commercial abuse feed on this site.
What does a datacenter classification mean?
The IP's Autonomous System (ASN) is on our curated list of cloud, hosting, CDN, transit, or VPN providers — networks commonly used by VPNs, proxies, scanners, and automated traffic. That carries more per-request risk than a residential connection, but it isn't a statement that the specific address is malicious. ASN data comes from MaxMind GeoLite2.
Why does my residential IP look fine here but get blocked elsewhere?
This tool reports infrastructure type and Tor status — not the reputation views mail servers and fraud systems build from their own report data. A residential IP can still be on a blacklist or carry mail-sending problems. Check the blacklist tool and your reverse DNS, SPF, DKIM, and DMARC setup for deliverability issues.
Are VPN and datacenter IPs always bad?
No. Plenty of legitimate users connect via VPN for privacy, and plenty of legitimate services run on cloud and hosting providers. But because the same networks are also used for automated abuse, content scraping, and account stuffing, many sites apply additional friction (CAPTCHAs, slower rate limits) to datacenter/VPN traffic. The IP isn't necessarily malicious — it just carries more risk per request than a residential one, which is a different statement.
Limitations and honest caveats
- No community abuse score. This tool reports infrastructure type and Tor status, not crowd-sourced abuse reports. A residential IP that has been used for abuse can still look “clean” here — cross-check the blacklist tool for mail/reporting reputation.
- Residential proxy networks are not detected. Bright Data, Oxylabs, and similar services route traffic through real home IPs. These look identical to legitimate residential connections without a paid proxy database, which we deliberately don't use.
- Classification lags reality. Our ASN list and the GeoLite2 data behind it update on their own schedules. A network that recently changed hands or started offering VPN service can be misclassified until the data catches up.
- The verdict is informational, not a decision. The summary at the top is a quick read of two infrastructure signals — not a replacement for combining it with your own session, device, and behavioural data.