CrowdSec IP reputation tells you whether an IP is dangerous and what it has been doing: which attacks, against which countries and industries, how recently, mapped to MITRE ATT&CK. The data comes from 500,000 production servers that attackers actually target, not from honeypots. Look up any IP for free, enrich your alerts through the API, or run the full database offline.
Use real-time IP Reputation to investigate malicious IPs, validate suspicious activity, and understand attacker behavior in real time.
Malicious IPs in our CTI database
Machines from real users contributing to the network
Signals received on average per day
Countries representing our database
Blocking any and all aggressive IPs is a solid option. But blocking IPs based on unwanted behaviors that have the potential to harm your infrastructure, gives you greater flexibility and targeted protection for your perimeter.
Search for freeIP Range, Domains, and Top ClassificationsComprehensive profile of an IP address.
Crowd ConfidenceLevel of confidence from users in the CrowdSec Network reporting an IP.
Location OriginThe geographical location where an IP address is based.
Background NoiseReflects automatic and mild attacks at a large scale, without a specific target, at a constant pace over time.
IP AggressivenessSeverity of an IP's malicious activities.
ActivityReflects how active an IP has been in the last 3 months.
Attack DetailsSummarizes specific attack scenarios linked to an IP.
Top Targeted CountriesCountries mostly targeted by an IP.
Which cyber threats pose the greatest risk to my organization's security?
What specific threats should I prioritize in my security efforts?
How can I effectively track and analyze the origin of cyber threats?
How can I effectively track and analyze the origin of cyber threats?
We believe the best way to defend against cyber threats is to work together by sharing information and collaborating as one.
Our open source Security Engine sits at the heart of our data collection and it is built on community intelligence, giving us a bird’s eye view of the global attack landscape and allowing us to detect advanced behaviors and cyber attacks like never before. Security Engine users actively contribute to a network of threat intelligence that strengthens the defense of the entire CrowdSec Network.
Learn moreBuilt from real-world attacks observed across thousands of production systems worldwide, not simulations or honeypots. Enriched with attack behaviors, reputation signals, targeted services, threat classifications, and historical context.
You can query the CrowdSec IP Reputation in two ways.
Create a CrowdSec Console account and get 50 queries per day for free, including full information on any given IP. Upgrade your plan to increase your query limit.
You can query the CrowdSec CTI without a Console account directly from the IP search bar. You get 50 queries per day and limited information on any given IP. To get detailed information on an IP, create a CrowdSec Console account.
Download our Majority Report and discover key insights on emerging threats.
Download Now
How do I check if an IP address is malicious?
Is there a free IP reputation API?
Where does CrowdSec's IP reputation data come from?
How is it different from honeypot-based feeds?
Can I use it offline or in an air-gapped environment?
Which tools does it integrate with?
Speak with one of our experts or ask your question on Discord