---
title: "IP Blocklist"
method: GET
path: "/ip-blocklist"
tags: ["Security and Networking"]
---

# IP Blocklist

`GET /ip-blocklist`

The IP Blocklist API will detect potentially malicious or dangerous IP addresses

## Query parameters

- `ip` string, required
- `vpn-lookup` boolean

## Response `200`

OK

- IPBlocklistResponse — Structure of ip-blocklist
  - `ip` string, required — The IP address
  - `is-bot` boolean, required — IP is hosting a malicious bot or is part of a botnet. This is a broad category which includes brute-force crackers
  - `is-exploit-bot` boolean, required — IP is hosting an exploit finding bot or is running exploit scanning software
  - `is-malware` boolean, required — IP is involved in distributing or is running malware
  - `is-spider` boolean, required — IP is running a hostile web spider (deprecated but kept for backwards compatibility instead use UA/IP lookups for spider detection)
  - `is-dshield` boolean, required — IP has been flagged as a significant attack source by DShield (dshield.org)
  - `list-count` integer, required — The number of blocklists the IP is listed on
  - `is-proxy` boolean, required — IP has been detected as an anonymous web proxy or anonymous HTTP proxy
  - `is-hijacked` boolean, required — IP is part of a hijacked netblock or a netblock controlled by a criminal organization
  - `is-tor` boolean, required — IP is a Tor node or running a Tor related service
  - `is-spyware` boolean, required — IP is involved in distributing or is running spyware
  - `is-spam-bot` boolean, required — IP address is hosting a spam bot, comment spamming or any other spamming type software
  - `is-listed` boolean, required — Is this IP on a blocklist
  - `is-vpn` boolean, required — IP belongs to a public VPN provider (only set if the 'vpn-lookup' option is enabled)
  - `last-seen` integer, required — The unix time when this IP was last seen on any blocklist. IPs are automatically removed after 7 days therefor this value will never be older than 7 days
  - `blocklists` string[], required — An array of strings indicating which blocklist categories this IP is listed on. Current possible values are: <br> <ul> <li>tor - IP is a Tor node or running a Tor related service</li> <li>proxy - IP has been detected as an anonymous web proxy or HTTP proxy</li> <li>vpn - IP belongs to a public VPN provider</li> <li>bot - IP is hosting a malicious bot or is part of a botnet. This is a broad category which includes brute-force crackers</li> <li>spam-bot - IP address is hosting a spam bot, comment spamming or any other spamming type software</li> <li>exploit-bot - IP is hosting an exploit finding bot or is running exploit scanning software</li> <li>hijacked - IP is part of a hijacked netblock or a netblock controlled by a criminal organization</li> <li>malware - IP is currently involved in distributing or is running malware</li> <li>spyware - IP is currently involved in distributing or is running spyware</li> <li>spider - IP is running a hostile web spider (deprecated but kept for backwards compatibility instead use UA/IP lookups for spider detection)</li> <li>dshield - IP has been flagged as a significant attack source by DShield (dshield.org)</li> </ul>
  - `sensors` BlocklistSensor[], required — An array of objects containing details on which specific sensors detected the IP
    - `id` integer, required — The sensor ID. This is a permanent and unique ID for each sensor
    - `blocklist` string, required — The primary blocklist category this sensor belongs to
    - `description` string, required — Contains details about the sensor source and what type of malicious activity was detected
  - `cidr` string, required — The CIDR address for this listing (only set if the IP is listed)

## Other responses

- `400` — Your API request has been rejected. Check error code for details
- `403` — You have failed to authenticate
- `500` — We messed up, sorry! Your request has caused a fatal exception
- `default` — We messed up, sorry! Your request has caused an error

---

[API](https://skmtc.net/neutrinoapi/apis/neutrino-api.md) · [All operations](https://skmtc.net/neutrinoapi/apis/neutrino-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/neutrinoapi/neutrino-api/revisions/4ebd6b56de42/schema)