IP Delisting

IP delisting is the process of removing an IP address from the ReportedIP blacklist — either automatically through time decay (most IPs drop off within 60–90 days of the last report) or manually via a delisting request to [email protected], which is reviewed within 48 hours and is always free of charge.

Why IPs Get Listed

IP addresses are added to the ReportedIP database when they are reported for malicious activity by community members, WordPress security plugins, or honeypot servers. Common reasons include:

• Brute-force login attempts against WordPress sites
• Comment spam or form spam
• XMLRPC attacks
• Port scanning or vulnerability probing
• DDoS participation

A listing does not necessarily mean the IP owner is malicious. Shared hosting, compromised servers, VPN exit nodes, and open proxies can all result in legitimate users having a listed IP.

Automatic Removal

ReportedIP uses a time dampening system with exponential decay. Reports automatically lose weight over time:

If no new reports are filed against an IP, its Confidence Score will gradually decrease until it falls below the blocking threshold. Most IPs are effectively delisted within 60–90 days of the last report.

How to Request Delisting

If you believe your IP has been listed in error, or you have resolved the security issue that caused the listing, you can request manual delisting.

1. Check Your IP

First, check your IP's current status on the ReportedIP homepage. This will show you the Confidence Score, number of reports, and the attack categories associated with your IP. How the score is computed and when an IP enters the exported blacklist (confidence ≥ 75 %, 48-hour cool-down, whitelist exclusion) is documented on the Blacklist page.

2. Send a Delisting Request

Email [email protected] with the following information:

False Positive Reports

If you find your IP listed on a specific IP detail page, you can also use the Report False Positive button directly on that page. This creates a review ticket that our team will investigate.

Common causes of false positives:

• Shared hosting: Another site on the same server was compromised
• VPN / Proxy: A previous user of the IP was malicious
• Dynamic IP: Your ISP reassigned a previously abused IP to you
• Security testing: Legitimate penetration testing was mistakenly reported

Review Process

After submitting a delisting request, here is what to expect:

Prevention

To avoid future listings, consider the following best practices:

• Secure your server: Keep software up to date, use strong passwords, and disable unused services
• Enable rate limiting: Use tools like fail2ban or Cloudflare to limit brute-force attempts from your IP range
• Monitor for compromise: Regularly check your server for unauthorized access, malware, or misconfigured services
• Check regularly: Use the ReportedIP API or website to monitor your IP's reputation proactively

Why Delisting Requests Are Denied

Most denied requests fall into a small number of patterns. Avoiding them speeds up your review considerably:

• The abuse is still ongoing. Our honeypots or community sensors recorded reports within the last 24–48 hours. Fix the root cause first — a delisting while attacks continue would be reverted within hours anyway.
• No remediation described. "Please delist my IP" without explaining what was fixed gives the reviewer nothing to verify. One sentence about the cause (compromised CMS, open relay, infected client) and the fix is enough.
• The request comes from a free-mail address with no connection to the IP. Requests from the owning organization, the hosting provider, or an address in the IP's rDNS domain carry far more weight.
• Bulk requests for entire ranges. We delist individual addresses after review. For provider-level range issues, contact us with WHOIS proof of ownership.

Delisting FAQ

How long does delisting take?

Manual delisting requests are acknowledged within 24 hours and decided within 48 hours. Once approved, the IP disappears from API responses immediately and from the exported blacklist files with the next daily export. Automatic delisting through time decay takes longer: without new reports, an IP's confidence score halves every 30 days, so most addresses fall below the 75 % blacklist threshold within 60–90 days of the last report.

Does delisting cost anything?

No. Delisting from ReportedIP is always free. We never charge for removal — paid "express delisting" is a practice we consider incompatible with a trustworthy blocklist. Any third party charging money to remove an IP from ReportedIP is not affiliated with us.

Will my IP be relisted after delisting?

Only if new attacks are reported. Delisting removes existing reports and resets the confidence score to zero, but it does not immunize the address. If the underlying issue — a compromised site, an open proxy, malware on a client — is not fixed, community sensors will report the IP again and the score will rebuild. Repeated relistings are a strong signal to audit the machine behind the address.

Can I monitor my IP so I notice a listing early?

Yes. Query GET /reportedip/v2/check?ip=<your-ip> from a cron job — a free account includes 1,000 checks per day, which is more than enough to watch an entire address pool. See the API Reference for details.

Last updated: July 22, 2026 · Maintained by the ReportedIP team