Malicious IP Checker — Fraud Score, Blacklist & VPN Detection

Malicious reputation synthesizes DNSBL membership, anonymization heuristics, and hosting classification into actionable fraudScore. Listed addresses on spam, drone, or exploit-oriented zones elevate score sharply. VPN and proxy flags add moderate weight — legitimate privacy users exist, but fraud models often challenge those sessions.

botnetLikely rises when spamhaus, spamcop, dronebl, or backscatter patterns trigger in listedOn names.

Scores below 25 map to low riskLevel for most use cases. Medium 25–54 warrants review. High 55–79 suggests active abuse signals. Critical 80+ means multiple blacklists or strong anonymization flags — treat as hostile until proven otherwise.

detections array documents each category with status and detail strings for ticket exports.

blacklists array shows per-zone listed status with query hostnames. listedOn aggregates names for quick triage. Delisting requires fixing root cause per zone maintainer policy before removal requests.

listedCount two or more adds fraudScore penalty reflecting compounded receiver suspicion.

signals.vpn, signals.proxy, and signals.hosting booleans feed fraud models. Malicious activity clusters on compromised hosting, but legitimate SaaS also runs on datacenters. Combine infrastructure flags with listing data — VPN exit with clean DNSBL differs from hosting IP with multiple listings.

Cross-link vpn-detection and proxy-checker for focused anonymization depth.

Enter hostname when logs contain domain rather than IP. resolveToIpv4 returns first A record IPv4 with resolvedFrom preserved. CDN domains may resolve to edge IPs with neighbor listing noise.

Prefer direct IPv4 when known from firewall or IDS logs for precision.

Run on IDS alerts, credential stuffing sources, C2 indicators from threat feeds, mail bounce blocklist citations, and vendor VPN endpoint validation. Export JSON for SIEM enrichment with fraudScore and listedOn fields.

Recheck during active campaigns — listing status changes hourly.

Both pages call action reputation with identical JSON shape. ip-reputation-checker uses IP reputation SEO vocabulary; malicious-ip-checker targets operators searching malicious IP terminology from threat feeds and SOC tickets.

API consumers use reputation with query or ip parameters interchangeably.

malware-ip-checker emphasizes malwareListHits without composite fraudScore. malicious-ip-checker synthesizes broader signals into fraudScore and detections cards.

Run malware-ip-checker when tickets ask specifically about malware-oriented DNSBL hits; run this page for overall malicious reputation scoring.

GET /ip-tools/api/extended?action=reputation&query=8.8.8.8 or query=example.com. Parse fraudScore, riskLevel, detections, blacklists, listedOn, signals. Cache briefly in automation.

Rate limits protect upstream DNS resolvers — avoid hammering same address every second.

Lookups query public DNSBL and geolocation for addresses you submit. Investigate only indicators tied to legitimate security operations.

fraudScore is informational — not a substitute for enterprise threat intelligence platforms.