IP Address Reputation Checker

A Python application that checks the reputation of IP addresses using multiple data sources and security databases.

Features

• Multi-source reputation checking: Uses ipinfo.io for basic IP information
• Behavioral analysis: Analyzes IP characteristics (private, public, multicast, etc.)
• Multiple output formats: Human-readable or JSON output
• Command-line interface: Easy to use with optional IP parameter
• Extensible: Ready for integration with additional reputation services

Installation

1. Clone or download the project
2. Create a virtual environment:

   python -m venv venv

3. Activate the virtual environment:

   # On Windows:
   .\venv\Scripts\Activate.ps1
   
   # On macOS/Linux:
   source venv/bin/activate

4. Install dependencies:

   pip install -r requirements.txt

Usage

Basic Usage

Check the default IP address (8.8.8.8):

python ip_reputation_checker.py

Check a specific IP address:

python ip_reputation_checker.py 1.1.1.1
python ip_reputation_checker.py 192.168.1.1

Command Line Options

python ip_reputation_checker.py --help

• ip: IP address to check (optional, defaults to 8.8.8.8)
• --json: Output results in JSON format instead of human-readable format

Examples

# Check Google's DNS server
python ip_reputation_checker.py 8.8.8.8

# Check Cloudflare's DNS server with JSON output
python ip_reputation_checker.py 1.1.1.1 --json

# Check a private IP address
python ip_reputation_checker.py 192.168.1.1

Output

The tool provides:

1. IP Location & Basic Info: Geographic location, organization, timezone
2. Reputation Checks: Results from various security databases
3. Behavioral Analysis: Risk assessment based on IP characteristics
4. Summary: Overall risk level assessment

Sample Output

🔍 Checking reputation for IP: 8.8.8.8
==================================================
📍 Getting IP location and basic info...
🛡️  Checking against reputation databases...
🔬 Analyzing IP behavior patterns...

📊 REPUTATION REPORT FOR 8.8.8.8
⏰ Checked at: 2026-01-27T20:34:20.713962
============================================================

🌍 IP LOCATION & BASIC INFO:
   • Ip: 8.8.8.8
   • Hostname: dns.google
   • City: Mountain View
   • Region: California
   • Country: US
   • Loc: 37.4056,-122.0775
   • Org: AS15169 Google LLC
   • Postal: 94043
   • Timezone: America/Los_Angeles
   • Anycast: True

🛡️  REPUTATION CHECKS:
   [Results from various security services]

🔬 BEHAVIORAL ANALYSIS:
   • Risk Level: Unknown
   • No specific risk factors identified

📋 SUMMARY:
   ❓ Risk level could not be determined

Enhanced Reputation Checking

For comprehensive reputation checking, the tool supports integration with:

Free Services (API keys required)

• AbuseIPDB: Community-driven IP blacklist database
• VirusTotal: Multi-engine malware and reputation scanner
• IPQualityScore: Advanced IP reputation and fraud detection

Getting API Keys

1. AbuseIPDB: Sign up at https://www.abuseipdb.com/ (free tier: 1,000 requests/day)
2. VirusTotal: Sign up at https://www.virustotal.com/ (free tier: 4 requests/minute)
3. IPQualityScore: Sign up at https://www.ipqualityscore.com/ (free tier: 5,000 requests/month)

Adding API Keys

To add API keys, modify the ip_reputation_checker.py file:

# In the check_abuseipdb method:
headers = {
    'Accept': 'application/json',
    'Key': 'YOUR_ACTUAL_API_KEY_HERE'  # Replace with your API key
}

Technical Details

Dependencies

• requests: HTTP library for API calls
• ipinfo: IP information lookup service
• ipaddress: Built-in Python library for IP address validation

Features

• IP Validation: Validates IP address format
• Error Handling: Graceful handling of API failures
• Rate Limiting: Built-in timeouts to avoid overwhelming services
• Multiple Output Formats: Human-readable and JSON output
• Extensible Architecture: Easy to add new reputation sources

Security Considerations

• The tool makes outbound HTTP requests to check IP reputation
• API keys should be stored securely (environment variables recommended)
• Rate limiting should be implemented for production use
• Results should be cached to avoid repeated API calls

Contributing

To add new reputation sources:

1. Add a new method following the pattern check_[servicename]
2. Update the check_ip_reputation method to call the new service
3. Update this README with information about the new service

License

This project is provided as-is for educational and security research purposes.