> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.hodi.host/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# What is a malicious IP?

|| A malicious IP is the address of a machine on the internet from which harmful activity originates: intrusion attempts, automated attacks, spam sending, malware distribution. Spotting and filtering these addresses is part of protecting your hosting.

## Reminder: what is an IP address?

An IP address is the identifier of a device connected to the internet, a bit like a phone number for a machine. Every server, computer, or smartphone has one when communicating online.
[Find your IP address](https://hodi.host/ip)

## What makes an IP "malicious"

An IP is considered malicious when it's associated with hostile behavior, for example:
* repeated attempts to guess passwords (brute-force attacks);
* automated scanning for vulnerabilities on your services;
* participation in denial-of-service attacks (DDoS);
* mass sending of spam or phishing emails;
* distributing malware or controlling infected machines.
Often, these addresses belong to machines that have themselves been compromised, unknowingly enlisted into an attack network (a "botnet").

## How they're spotted

Several signals help identify a malicious IP: its reputation, when it appears on blocklists maintained by the security community, and above all its behavior observed in real time, such as a spike in failed connections or abnormal traffic. In the interest of honesty: it isn't always black and white. The same address can be shared by several users, or become malicious temporarily after being compromised, then become clean again. An IP's reputation changes over time.

## What Hodi does

Filtering these addresses is part of the security included with your hosting. Specifically:
* our monitoring watches traffic 24/7 and detects abnormal behavior;
* a web application firewall (WAF) filters suspicious requests before they reach your services;
* addresses identified as hostile are blocked, and protection is continuously adjusted.

The goal isn't to promise an impenetrable wall, but to significantly reduce the attack surface and react quickly when a threat appears.

## What does this mean for you?

You don't need to manage these lists or monitor connections yourself: that's our job. On your end, good habits (strong passwords, regular updates, caution around access) usefully complement this protection.