Free IP Address &
Domain Reputation Checker
Look up any IP address or domain name against VirusTotal's global threat intelligence database. See reputation, threat history, and geolocation — instantly.
Check an IP Now — It's FreeSupports IPv4 addresses and domain names
New to this? What is an IP checker?
Complete IP & Domain Intelligence
Reputation Lookup
Check whether an IP or domain has been flagged as malicious, suspicious, or clean by 95+ security vendors.
Threat History
See the full threat history — when the IP or domain was first flagged, by which vendors, and what type of threat was detected.
Geolocation
Find out what country and city an IP address is located in, along with the ISP and organization that owns it.
ISP & Organization
Identify the internet service provider and organization behind an IP — useful for investigating suspicious server connections.
Risk Score
A 0–100 risk score summarizes the overall threat level of the IP or domain, with a plain-English verdict.
Instant Results
Lookups complete in seconds — no waiting, no queues.
When to Check an IP or Domain
Verify an email sender's IP
Check the originating IP of a suspicious email to see if it comes from a known spam or phishing network.
Investigate firewall alerts
When your firewall or security tool flags an unknown IP, look it up to determine if it's a real threat or a false positive.
Check a server before connecting
Before your app or service connects to an external IP or API endpoint, verify its reputation to avoid connecting to a malicious host.
Investigate suspicious network traffic
Check IPs found in network logs, packet captures, or intrusion detection alerts to assess if traffic is malicious.
Check Any IP or Domain in 3 Steps
Enter the IP or Domain
Type or paste any IPv4 address (e.g. 1.2.3.4) or domain name (e.g. example.com) into the input field.
Run the Lookup
Scanify queries VirusTotal's 95+ security vendor database and returns reputation, threat history, and geolocation.
Read the Report
Get a risk score, vendor verdicts, threat categories, country, ISP, and a clear safe/malicious verdict.
Common Questions
What is an IP Reputation Checker?
An IP reputation checker looks up an IP address or domain name against threat intelligence databases to determine whether it has been associated with malicious activity. Scanify queries VirusTotal's network of 95+ security vendors to return a comprehensive reputation report — including threat history, category, geolocation, and ISP — in seconds.
Why IP Reputation Matters
IP reputation is used by security teams to identify malicious servers, spam sources, botnet nodes, and phishing infrastructure. When an IP address appears in your firewall logs, email headers, or network traffic, checking its reputation can quickly determine whether the connection is a threat or legitimate — without deep packet inspection or manual investigation.
How to Check if a Domain is Blacklisted
Enter the domain name in Scanify's IP/Domain checker. Scanify queries it against VirusTotal's 95+ security vendor database, which includes multiple blacklists and threat intelligence feeds. If the domain is blacklisted by any vendors, you'll see exactly which ones flagged it and what category of threat (malware, phishing, spam, etc.) was detected.
Investigate Suspicious Email Senders
When you receive a suspicious email, check the originating IP address by looking at the email headers (usually found in the "View Raw" or "Show Original" option in your email client). Copy the sending server IP and paste it into Scanify's IP checker to see if it belongs to a known spam network, phishing operation, or malicious infrastructure.
Document Your Security Posture — Download IP & Domain Reports
Scanify Pro lets you run IP and domain intelligence lookups and download a PDF report of the full results. Use it to document third-party server checks, verify partner domains, or build a security audit trail.
Get a professional PDF with full IP reputation data, threat history, and geolocation — ready to share or file.
Verify the reputation of servers and domains used by vendors before integrating them into your infrastructure.
During an incident, quickly look up suspicious IPs and download the report as evidence for your security team or insurers.
Pro users get unlimited IP/domain lookups and PDF downloads every month.