IP Reputation Check

IP Reputation Check

"Is this IP a proxy?", "is this a VPN?", "why was my IP flagged?" — these are the questions this tool answers, using signals our service already computes for every lookup: whether an address matches a known VPN/proxy or anonymizing-proxy network, whether it's a Tor exit node, whether it's hosting/datacenter space, whether a threat-intelligence feed lists it as malicious, whether it was recently seen scanning or brute-forcing logins across the internet, and a 0-100 risk score rolling several of those signals into one number.

Every one of those signals is a real, already-computed fact — not a live third-party API call made just for this page. The VPN/proxy signal combines a hosting/datacenter classification heuristic with a real anonymous-proxy network flag; the Tor signal is a curated exit-node list; the malicious flag comes from ten configured threat-intelligence feeds; the scanner flag comes from Dataplane.org's per-service recon feeds. The risk score is a transparent, deterministic weighted rollup over these and a few other signals (hosting, missing reverse DNS, bulk-mail-sender ranges) — never a black-box number and never a call to a paid third-party fraud-scoring API.

Two deliberately separate concepts show up here, and it matters that they stay separate: the SCANNER signal ("recently seen probing SSH/Telnet/RDP logins across the internet") is advisory reputation, not a confirmed-malicious verdict — plenty of scanning traffic comes from security researchers, misconfigured devices, or shared infrastructure, not attackers. It is never folded into the malicious flag. And the RISK SCORE is exactly that — a score, a starting point for judgment, not a definitive "this IP is bad" statement. A clean score does not guarantee an address is safe, and a high score does not prove wrongdoing by whoever is using it right now (addresses get reassigned, shared, and spoofed).

This free tool checks your OWN IP address in full — every boolean signal plus the exact numeric score — since "is my own connection being flagged?" is the main reason people reach for a tool like this. Checking someone ELSE's address returns only a coarse risk category (low/medium/high) plus the malicious flag, deliberately withholding the boolean breakdown and the exact score: giving away the full antifraud-grade detail for ANY address, for free, would be handing out the same product our paid API's security group sells. The full detail for any IP is available through the API on a paid tier — see the API-equivalent section below for exactly what differs.

How to use this check

1. Leave the field blank, or enter an address

   Leave the IP field empty to check your own address (the common case), or type any IPv4/IPv6 address to check a different one.

2. Check reputation

   Click "Check reputation" (or open a permalink URL) to run the check against our already-computed privacy, threat-intel, recon and fraud signals.

3. Read the verdict

   For your own IP you get a clean/suspicious/high-risk verdict, the exact 0-100 risk score and all 5 boolean signals; for any other address you get only a risk category and the malicious flag.

4. Share

   The page URL updates with your query as a permalink, so you can copy and share the current result directly.

Glossary

Anonymous proxy

A network that deliberately hides the originating address, matched here against a curated network-topology dataset — distinct from generic hosting/datacenter space, which is a weaker VPN-posture heuristic, not a confirmed anonymizer.

Tor exit node

The last relay in a Tor circuit before traffic reaches the open internet — the address a destination server actually sees, matched against a maintained exit-node list.

Threat intelligence

Curated feeds of addresses observed in confirmed malicious activity (malware C2, botnets, active attacks); an address matching one or more feeds sets the malicious flag.

Active recon / scanner signal

An ADVISORY signal — the address was recently seen attempting automated logins or probing (SSH, Telnet, RDP and similar) across the internet. Deliberately kept separate from the malicious flag: being seen scanning is not the same claim as being confirmed malicious.

Risk score

A 0-100 number rolling up several signals (hosting, VPN, Tor, malicious, missing reverse DNS, bulk-mail-sender ranges) with configured weights — a transparent starting point for judgment, never a definitive verdict on its own.

Hosting/datacenter

Address space registered to a hosting or cloud provider rather than a residential/mobile ISP — common for both legitimate servers and VPN exit points, so it's a weak signal on its own, not proof of anything.

API equivalent

This page calls our own public tools endpoint under the hood — you can call the same endpoint directly, unauthenticated, subject to a per-caller rate limit. It deliberately returns less for someone else's address than our full API's security group does (?include=security), which is a metered, paid product — for comparison, the full-detail curl is shown second:

curl "https://ip.xakki.pro/api/v1/tools/reputation?ip=8.8.8.8"

Example response (arbitrary-tier — the caller's own IP would additionally carry riskScore/isVpnOrProxy/isTor/isHosting/isScanner):

{
  "ip": "8.8.8.8",
  "tier": "arbitrary",
  "verdict": "clean",
  "isMalicious": false,
  "riskLevel": "low"
}

curl -H "Authorization: Bearer <token>" "https://ip.xakki.pro/api/v1/ip?ip=8.8.8.8&include=security"

Read the full API docs

Related tools

• All free tools
• HTTP Headers Inspector
• WebRTC Leak Test
• IP Fraud Detection API

Frequently asked questions

Why do I get more detail for my own IP than for any other address?

To keep this free tool from handing out the same detailed antifraud lookup our paid API sells for ANY address. Checking your own connection — "am I flagged as a proxy? is my IP considered risky?" — is the main reason people use a tool like this, so that scenario keeps the full breakdown; a stranger's address only gets a rough category.

Is the "scanner" signal the same as "malicious"?

No, and this is deliberate. The scanner signal means the address was recently seen attempting automated logins or probing across the internet — an advisory reputation signal. It never gets folded into the malicious flag, which comes from separate, curated threat-intelligence feeds. An address can be flagged as a scanner without ever being confirmed malicious, and vice versa.

Is a "clean" verdict a guarantee the address is safe?

No. A clean verdict means none of our currently loaded signals fired for this address right now — not that the address is verified safe for all time. Threat feeds only cover what they've observed; an address can rotate off every list, be reassigned, or start being used differently tomorrow.

Does this tool log or store the addresses I look up?

Your query is sent to our server to run the check (unlike our purely client-side calculators), and results are cached briefly to avoid recomputing the same lookup on every page reload — the same short-lived cache pattern our other tools-lane endpoints use, not a permanent record tied to you.

Why does a private or reserved IP show "not applicable" instead of a verdict?

Reputation and risk signals genuinely don't apply to non-routable space (private ranges, loopback, CGNAT, reserved blocks) — there's no privacy/threat-intel data to compute a verdict from, so this tool says so explicitly rather than showing a misleading "clean" result.

Is there a rate limit on this tool?

Yes — this page and its underlying API endpoint share the free tools lane's per-caller rate limit, independent of our main IP lookup API's daily quota. If you need higher volume or full-detail programmatic access for any address, our API docs cover the paid tiers.