You find an unfamiliar IP address in a firewall log, a login alert or a mail header. Before you block it, or ignore it, you want to know whether it is actually hostile. A single lookup rarely settles that, but a few quick checks usually do.
1. Look at its reputation
Reputation services collect reports from many networks and turn them into a score. AbuseIPDB, for example, publishes an abuse confidence percentage. A high score with many recent reports is a strong signal. A low score, or one report from months ago, is weak. Our malicious IP archive lists addresses from the AbuseIPDB blacklist, and each has its own page with related reports.
2. Find out who owns it
Registry data (RDAP or WHOIS) shows the organization and address range the IP belongs to. A residential ISP, a cloud provider and a bulletproof hosting company all point to very different situations. If a whole block belongs to a hosting provider with a poor reputation, the risk is higher than for a single shared address.
3. Check reverse DNS
A reverse DNS (PTR) record maps the address back to a hostname. A mail server with a matching hostname is normal. A generic name like a numbered ISP pool, or no record at all, means little on its own but adds context when other signs are present.
4. Check blocklists
DNS blocklists such as Spamhaus ZEN and SpamCop are queried with a simple DNS request. Being listed usually means the address sent spam or hosted abusive services. Check the listing reason, because some lists cover dynamic home connections that are not malicious at all.
5. Look at what it actually did
Your own logs matter more than any score. Repeated failed logins, scanning many ports, or requests for admin paths that do not exist on your site are behaviour you can act on. One stray connection is not.
What a blacklist entry does not tell you
- Shared addresses (VPNs, carrier NAT, university networks) can be flagged because of one user among thousands.
- Addresses get reassigned, so an old report may describe a previous owner.
- A score reflects reports, not verified intent.
Put together, these checks take a few minutes. The IP and domain lookup runs the reputation, ownership, reverse DNS and blocklist checks in one step, so you can see them side by side before deciding whether to block.