v1

latestSwagger 2.02026-07-132830204.5 KB

Security and Networking

IP Blocklist

The IP Blocklist API will detect potentially malicious or dangerous IP addresses

get/ip-blocklist

Query parameters

ipstring required

An IPv4 or IPv6 address. Accepts standard IP notation (with or without port number), CIDR notation and IPv6 compressed notation. If multiple IPs are passed using comma-separated values the first non-bogon address on the list will be checked

vpn-lookupboolean

Include public VPN provider IP addresses. <br> <b>NOTE</b>: For more advanced VPN detection including the ability to identify private and stealth VPNs use the <a href="https://www.neutrinoapi.com/api/ip-probe/">IP Probe API</a>

Response

ipstring required

The IP address

is-botboolean required

IP is hosting a malicious bot or is part of a botnet. This is a broad category which includes brute-force crackers

is-exploit-botboolean required

IP is hosting an exploit finding bot or is running exploit scanning software

is-malwareboolean required

IP is involved in distributing or is running malware

is-spiderboolean required

IP is running a hostile web spider (deprecated but kept for backwards compatibility instead use UA/IP lookups for spider detection)

is-dshieldboolean required

IP has been flagged as a significant attack source by DShield (dshield.org)

list-countinteger required

The number of blocklists the IP is listed on

is-proxyboolean required

IP has been detected as an anonymous web proxy or anonymous HTTP proxy

is-hijackedboolean required

IP is part of a hijacked netblock or a netblock controlled by a criminal organization

is-torboolean required

IP is a Tor node or running a Tor related service

is-spywareboolean required

IP is involved in distributing or is running spyware

is-spam-botboolean required

IP address is hosting a spam bot, comment spamming or any other spamming type software

is-listedboolean required

Is this IP on a blocklist

is-vpnboolean required

IP belongs to a public VPN provider (only set if the 'vpn-lookup' option is enabled)

last-seeninteger required

The unix time when this IP was last seen on any blocklist. IPs are automatically removed after 7 days therefor this value will never be older than 7 days

blocklistsstring[] required

An array of strings indicating which blocklist categories this IP is listed on. Current possible values are: <br> <ul> <li>tor - IP is a Tor node or running a Tor related service</li> <li>proxy - IP has been detected as an anonymous web proxy or HTTP proxy</li> <li>vpn - IP belongs to a public VPN provider</li> <li>bot - IP is hosting a malicious bot or is part of a botnet. This is a broad category which includes brute-force crackers</li> <li>spam-bot - IP address is hosting a spam bot, comment spamming or any other spamming type software</li> <li>exploit-bot - IP is hosting an exploit finding bot or is running exploit scanning software</li> <li>hijacked - IP is part of a hijacked netblock or a netblock controlled by a criminal organization</li> <li>malware - IP is currently involved in distributing or is running malware</li> <li>spyware - IP is currently involved in distributing or is running spyware</li> <li>spider - IP is running a hostile web spider (deprecated but kept for backwards compatibility instead use UA/IP lookups for spider detection)</li> <li>dshield - IP has been flagged as a significant attack source by DShield (dshield.org)</li> </ul>

cidrstring required

The CIDR address for this listing (only set if the IP is listed)

Example response

{
  "blocklists": [
    "bot",
    "exploit-bot",
    "proxy",
    "spam-bot",
    "tor",
    "vpn"
  ],
  "cidr": "104.244.72.115/32",
  "ip": "104.244.72.115",
  "is-bot": true,
  "is-dshield": false,
  "is-exploit-bot": true,
  "is-hijacked": false,
  "is-listed": true,
  "is-malware": false,
  "is-proxy": true,
  "is-spam-bot": true,
  "is-spider": false,
  "is-spyware": false,
  "is-tor": true,
  "is-vpn": true,
  "last-seen": 1763386800,
  "list-count": 29,
  "sensors": [
    {
      "blocklist": "tor",
      "description": "Tor router",
      "id": 1
    },
    {
      "blocklist": "bot",
      "description": "CINS army list",
      "id": 6
    },
    {
      "blocklist": "exploit-bot",
      "description": "Vulnerability scanning or DDoS bot",
      "id": 17
    },
    {
      "blocklist": "spam-bot",
      "description": "Comment and forum spammers",
      "id": 19
    },
    {
      "blocklist": "bot",
      "description": "Brute force bot (SSH, SMTP, IMAP or HTTP)",
      "id": 20
    },
    {
      "blocklist": "bot",
      "description": "Hacking or attack bot",
      "id": 22
    },
    {
      "blocklist": "tor",
      "description": "Tor node",
      "id": 32
    },
    {
      "blocklist": "exploit-bot",
      "description": "Exploit attacks against website",
      "id": 33
    },
    {
      "blocklist": "spam-bot",
      "description": "HTTP form spam bot",
      "id": 34
    },
    {
      "blocklist": "tor",
      "description": "Tor exit node",
      "id": 38
    },
    {
      "blocklist": "bot",
      "description": "Web server attack source",
      "id": 39
    },
    {
      "blocklist": "spam-bot",
      "description": "Harvester, spam or comment spam host",
      "id": 50
    },
    {
      "blocklist": "proxy",
      "description": "Public HTTP proxy",
      "id": 53
    },
    {
      "blocklist": "vpn",
      "description": "VPN service hosting",
      "id": 54
    },
    {
      "blocklist": "tor",
      "description": "Tor exit node",
      "id": 55
    },
    {
      "blocklist": "spam-bot",
      "description": "Forum, blog or other website spammer",
      "id": 58
    },
    {
      "blocklist": "bot",
      "description": "IP connected to a known honeypot",
      "id": 59
    },
    {
      "blocklist": "bot",
      "description": "Brute force bot (SSH)",
      "id": 60
    },
    {
      "blocklist": "bot",
      "description": "Brute force bot (SMTP)",
      "id": 61
    },
    {
      "blocklist": "bot",
      "description": "Brute force bot (Apache HTTP)",
      "id": 62
    },
    {
      "blocklist": "bot",
      "description": "Brute force bot (IMAP)",
      "id": 63
    },
    {
      "blocklist": "bot",
      "description": "Brute force bot (Website Logins)",
      "id": 66
    },
    {
      "blocklist": "exploit-bot",
      "description": "Hacking, exploit or other attack source",
      "id": 67
    },
    {
      "blocklist": "bot",
      "description": "Scanning or brute force attacks (last 30 days)",
      "id": 68
    },
    {
      "blocklist": "bot",
      "description": "Hacked IP or spam source",
      "id": 69
    },
    {
      "blocklist": "exploit-bot",
      "description": "HTTP attack source",
      "id": 73
    },
    {
      "blocklist": "spam-bot",
      "description": "Email/SMTP attack source",
      "id": 74
    },
    {
      "blocklist": "bot",
      "description": "SSH attack source",
      "id": 75
    },
    {
      "blocklist": "bot",
      "description": "Abuse source (hacking or spam)",
      "id": 76
    }
  ]
}