IP Reputation Check

Check one IPv4 or IPv6 address against bounded public threat snapshots. Results preserve each publisher’s scope, freshness, and limitations—there is no opaque “risk score.”

  • Source-level evidence
  • Freshness shown
  • Tor kept neutral
  • No query sent upstream

Check an IP address

?Enter one literal address only. Hostnames, URLs, CIDR prefixes, ports, and IPv6 zone IDs are rejected.

The server canonicalizes valid literals and checks locally cached snapshots.

Try an example:

Privacy: the queried address is sent only to Octetify’s same-origin service, evaluated against cached data, and is not persisted or forwarded to source operators.

What is checked

Threat evidence comes from Spamhaus DROP network ranges, the CINS Army exact-IP snapshot, and abuse.ch Feodo Tracker’s recommended botnet C2 feed. Tor Project exit-list data is neutral context. Python’s standards-based IP address semantics classify special-use space.

Source and update boundaries

The service downloads only fixed HTTPS endpoints with byte, time, record-count, and schema limits. It retains the last valid snapshot after a refresh failure and discloses stale, degraded, or unavailable coverage in every report.

What a result means

A source match is evidence to investigate, not an automatic blocking decision. A no-match means only that the address was absent from the checked snapshots. It does not prove safety, trust, mail deliverability, ownership, or current routability.

Why there is no score

A botnet C2 observation, a containing DROP network, a hostile-activity list, and Tor exit context answer different questions. Combining them into one number would hide their scope and imply unsupported precision.