Continuous IP Reputation Intelligence
DNSBL, Shodan InternetDB, GeoIP, AbuseIPDB, and WHOIS in one risk score, with continuous monitoring for the IPs you care about.
Instant Risk Assessment
Enter an IP and get a comprehensive risk profile with score, geolocation, open ports, and CVE data.
IP Reputation Checker
Check an IP against DNSBL blocklists, Shodan InternetDB, and GeoIP data.
8.8.8.8
GeoIP
- Country
- 🇺🇸 United States
- City
- Mountain View
- ISP
- Google LLC
- Org
- Google Public DNS
- ASN
- AS15169 Google LLC
Shodan InternetDB
Open Ports
Known CVEs
None found
Hostnames
- dns.google
DNSBL Blocklists
Spamhaus ZEN
Clean
Barracuda
Clean
SpamCop
Clean
CBL
Clean
SORBS
Clean
File-based Blocklists
Found on 0 of 4 listsfirehol_level1
Clean • 24,893 IPs
firehol_level2
Clean • 38,210 IPs
spamhaus_drop
Clean • 1,052 IPs
tor_exit_nodes
Clean • 1,834 IPs
Everything About an IP in One Place
Aggregate intelligence from multiple sources without juggling tabs or API keys.
Combined Risk Score
A 0--100 risk score aggregated from DNSBL listings, open ports, known CVEs, and abuse history. Color-coded from clean (green) to critical (red) with instant visual assessment.
GeoIP and Network Data
Country, city, ISP, organization, and ASN information. Identify where traffic is coming from and which network operator is responsible for the IP address.
Blocklist Coverage
Check against DNSBL services and file-based blocklists covering bruteforce attackers, Tor exit nodes, proxies, spam sources, bots, malware hosts, scanners, and more.
Track Lookup History
Every IP check is saved so you can review past results, compare risk changes over time, and re-check with a single click.
Recent Checks
| IP | Risk | Score | Country | ISP | Checked |
|---|---|---|---|---|---|
| 185.220.101.34 | CRITICAL | 87 | Germany | F3 Netze e.V. | 2 minutes ago |
| 45.33.32.156 | MEDIUM | 42 | United States | Linode, LLC | 15 minutes ago |
| 8.8.8.8 | CLEAN | 3 | United States | Google LLC | 1 hour ago |
| 91.189.91.48 | LOW | 18 | United Kingdom | Canonical Group Ltd | 3 hours ago |
How It Works
Enter an IP address
Type or paste any IPv4 address into the lookup field. Click Check IP or re-check a previous result from your history with a single click.
Query multiple sources
MetricTower queries DNSBL services, Shodan InternetDB, and GeoIP databases in parallel. File-based blocklists (Tor exits, proxies, malware, bots) are checked from Redis.
Get a risk score
Results are aggregated into a 0-100 risk score with five levels: clean, low, medium, high, and critical. The visual gauge and color coding give you an instant assessment.
Investigate details
Drill into open ports (with risky port highlighting), known CVEs, hostnames, blocklist membership by category, and network owner details. API access for automated lookups.
Deep Intelligence Sources
Aggregating data from DNS-based blocklists, Shodan, and curated file-based threat feeds.
DNSBL Blocklists
Check IPs against major DNS-based blocklists including Spamhaus, SpamCop, SORBS, Barracuda, and UCEPROTECT. Results show listed/clean status for each provider with color-coded indicators.
Shodan InternetDB
Open ports, known CVEs, and reverse hostnames from Shodan's InternetDB API. Risky ports (SSH, RDP, database ports) are highlighted in red. CVE identifiers link directly to vulnerability details.
File-Based Threat Feeds
Curated blocklists kept hot in memory and organized by category -- bruteforce, Tor exit nodes, proxies, spam, bots, malware, scanners, exploits, and more. Each category shows hit count and total IPs tracked.
API for Automation
Use GET /api/v1/ip-reputation/{ip} with Sanctum authentication to integrate reputation checks into SIEM workflows, firewall rules, or incident response scripts. JSON responses include score, risk level, and all source data.
Know What Any IP Is Doing Before It Hits Your Network
Look up any IP against DNSBL blocklists, Shodan InternetDB, and GeoIP databases in a single query. Get a combined risk score, open ports, known CVEs, ISP/ASN details, and blocklist status -- all built into Metric Tower alongside your scanning, phishing, and monitoring tools.