hellvirus
Is this IP or domain worth worrying about?
Paste IPs or domains from a log, an alert or a suspicious email. Every check runs in your browser against public sources, and every result says why.
What gets checked
- Private and reserved ranges: RFC 1918, carrier-grade NAT, loopback, link-local, documentation, multicast and the other IANA special-purpose blocks. This check is offline, and those addresses are never sent anywhere.
- Reverse DNS (PTR), plus a check that the name resolves back to the same IP (forward-confirmed rDNS).
- Registration data via RDAP, the modern replacement for WHOIS: the network owner, the address range, the abuse contact, and a domain's registration date and registry status.
- Domain DNS: A, AAAA, NS and MX records, and public names that point at private addresses.
- Email spoofing protection: whether SPF exists and how strict it is, and the DMARC policy.
How the score works
Each finding adds a fixed number of points: high 35, medium 15, low 5, info 0. The total is capped at 100. 0 means no concerns found, 1–19 minor notes, 20–49 some concern, and 50 or more high concern. Every finding is listed with its reason, so you can disagree with it.
Country is never scored. Attackers rent servers everywhere, and blaming a country punishes ordinary people.
Honest limits
- There is no abuse-database check. Sources like AbuseIPDB, blocklists and threat feeds need API keys or a server, and this site has neither. A clean result here is not a clean reputation.
- No ASN or BGP routing data, no port scans, no malware scanning, and no page screenshots.
- RDAP coverage varies, and some country domains publish nothing.
- DNS answers come from one resolver at one moment and can change.
Use this for triage, then confirm with your own logs and tools. It's defensive only: please don't use it to target anyone.
Privacy
No account, no cookies, no analytics, no trackers, and no server of ours. Your browser sends each lookup straight to the public source below and nothing else gets it. Results stay in this tab until you close it.
- DNS:
cloudflare-dns.com(DNS-over-HTTPS) - Registration:
rdap.org, which redirects to the responsible registry (APNIC, ARIN, RIPE, Verisign, and others)
Those services can see the names and IPs you look up, as with any DNS query. A share link puts your list in the URL, so only share it with people you'd tell anyway.