This article is also available in:

What is a malicious IP?

A malicious IP is the address of a machine on the internet from which harmful activity originates: intrusion attempts, automated attacks, spam sending, malware distribution. Spotting and filtering these addresses is part of protecting your hosting.

Reminder: what is an IP address?

An IP address is the identifier of a device connected to the internet, a bit like a phone number for a machine. Every server, computer, or smartphone has one when communicating online.
Find your IP address

What makes an IP "malicious"

An IP is considered malicious when it's associated with hostile behavior, for example:

repeated attempts to guess passwords (brute-force attacks);
automated scanning for vulnerabilities on your services;
participation in denial-of-service attacks (DDoS);
mass sending of spam or phishing emails;
distributing malware or controlling infected machines.

Often, these addresses belong to machines that have themselves been compromised, unknowingly enlisted into an attack network (a "botnet").

How they're spotted

Several signals help identify a malicious IP: its reputation, when it appears on blocklists maintained by the security community, and above all its behavior observed in real time, such as a spike in failed connections or abnormal traffic. In the interest of honesty: it isn't always black and white. The same address can be shared by several users, or become malicious temporarily after being compromised, then become clean again. An IP's reputation changes over time.

What Hodi does

Filtering these addresses is part of the security included with your hosting. Specifically:

our monitoring watches traffic 24/7 and detects abnormal behavior;
a web application firewall (WAF) filters suspicious requests before they reach your services;
addresses identified as hostile are blocked, and protection is continuously adjusted.

The goal isn't to promise an impenetrable wall, but to significantly reduce the attack surface and react quickly when a threat appears.

What does this mean for you?

You don't need to manage these lists or monitor connections yourself: that's our job. On your end, good habits (strong passwords, regular updates, caution around access) usefully complement this protection.

Updated on: 17/07/2026

Was this article helpful?

Thank you!