How to find and block malicious IP addresses
Seven practical ways to spot and block malicious IP addresses: reputation checks, rate limits, honeypots, edge blocking, scanners, a WAF and your ISP.
On this page
An IP address is the cheapest signal you have about a request. It is not a strong one on its own, because attackers rotate through proxies and infected machines, but a reputation lookup and a few rate rules at the edge remove the lazy majority of attacks before they reach your application. The volume makes the cheap filter worth having: by one count, 560,000 new pieces of malware are detected every day.
A penetration test shows you where the perimeter is weak. Blocking known-bad sources is the cheap part of closing it, and a strong perimeter is worth little if the doors are left open.
The tools exist. These seven guidelines are how to apply them without drowning in alerts.
How to identify malicious IPs
No single IP has a rap sheet you can read. You infer intent from where the address comes from, what it has done elsewhere and how it behaves against you, then act on the combination.
1. Check IP reputation, theirs and yours
Look up each source against reputation feeds before it gets far. An address that belongs to a hosting provider, a known proxy or VPN exit, a Tor node or a range reported for abuse last week deserves less trust than a residential connection with no history.
Keep your own reputation clean as well. Mail and traffic from your ranges that land on blocklists get your customers' notifications dropped, and a compromised host inside your network is often first noticed by someone else's blocklist.
2. Rate limit by IP (DoS prevention)
Rate limits are the simplest defense against flooding, including the distributed kind (DDoS).
When one address sends more requests in a window than any real user could, block or throttle it. Set separate, tighter limits on login, signup and password reset, since those are the endpoints attackers hammer.
3. Find the IPs sending the most malicious requests
Start with the addresses that send you the most hostile traffic. They are the ones worth blocking first.
A honeypot makes this easy. Stand up a host that looks vulnerable, is linked from nowhere a real user would go, and log everything that touches it. Anything that scans or exploits it is hostile by definition, so feed those addresses straight into the blocklist on your production servers.
4. Block at the edge, in real time, on every host at once
Blocking one address on one server is not enough. The attacker changes source and carries on, and the next server in your fleet never heard about the first block.
Keep one blocklist, push it to every edge and host automatically, and let the tooling do the bookkeeping so nobody is copying addresses between consoles. Block ranges and ASNs when a whole network is hostile; a single address rarely stays relevant for long.
5. Use vulnerability scanners and an IPS
A vulnerability scanner does not find malicious IPs; it finds what they are probing for. Scan your own network, fix what the scanner reports, and the hostile traffic that does get through has nothing to land on.
An intrusion prevention system (IPS) covers the other side. It watches traffic for known attack patterns and drops the connection before the payload lands.
6. Put a web application firewall (WAF) in front
A web application firewall sits between your site and the internet and inspects every incoming request for attack patterns before your application sees it.
It blocks the request and logs the source, which gives you another feed for the blocklist.
Most WAFs also rate limit and block by country, so for a small site it is often the only edge control you run.
7. Work with your ISP
When a botnet points at you, your ISP sees the flood before you do, and it has filters upstream of your pipe.
Many ISPs run tooling to drop hostile traffic on their own network. Ask what yours offers before you need it, and know who to call.
The ISP stops the part that crosses its network, not the rest. You still need your own monitoring and your own blocklist for the attacks that come in from everywhere else.
Where to start
Malicious IPs are the oldest signal in the book and still a useful one, as long as you treat an address as one input rather than a verdict.
Start at the edge: rate limits on login and signup, a reputation lookup, and one blocklist that every host reads. Then add the honeypot, because it turns your attackers into your own threat feed.
An IP alone will not tell you whether the login behind it is a customer or a stolen session. For that you score the attempt itself from device, network and behaviour signals; see account takeover protection.