🚀 Experience the new and improved APIVoid! Check out what's new
A JSON API to detect potentially malicious IP addresses known for spam or fraudulent activities. Use this API to reduce fake sign-ups, protect web forms and get valuable insights about IPv4 and IPv6 addresses.
Consumes 1 credit per API call
# Example Curl request from the command line:
curl -X POST "https://api.apivoid.com/v2/ip-reputation" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY_HERE" \
-d '{"ip": "93.174.95.106"}'
# Example JSON output for a 200 HTTP status code:
{
"ip": "93.174.95.106",
"version": "IPv4",
"blacklists": {
"engines": {
"0": {
"name": "0spam",
"detected": false,
"reference": "https://0spam.org/",
"elapsed_ms": 1
},
"1": {
"name": "Barracuda_Reputation_BL",
"detected": true,
"reference": "https://barracudacentral.org/lookups",
"elapsed_ms": 0
},
"2": {
"name": "BlockedServersRBL",
"detected": true,
"reference": "https://www.blockedservers.com/",
"elapsed_ms": 0
},
"3": {
"name": "EFnet_RBL",
"detected": false,
"reference": "https://rbl.efnetrbl.org/multicheck.php",
"elapsed_ms": 0
},
"4": {
"name": "IBM_Cobion",
"detected": false,
"reference": "https://filterdb.iss.net/dnsblinfo/",
"elapsed_ms": 0
},
"5": {
"name": "JustSpam_org",
"detected": true,
"reference": "http://www.justspam.org/",
"elapsed_ms": 0
},
"6": {
"name": "Known Scanning Service",
"detected": true,
"reference": "https://www.novirusthanks.org/",
"elapsed_ms": 0
},
"7": {
"name": "RealtimeBLACKLIST",
"detected": false,
"reference": "https://realtimeblacklist.com/",
"elapsed_ms": 2002
},
"8": {
"name": "S5hbl",
"detected": true,
"reference": "https://www.usenix.org.uk/content/rbl.html",
"elapsed_ms": 0
},
"9": {
"name": "SpamCop",
"detected": false,
"reference": "https://www.spamcop.net/",
"elapsed_ms": 0
},
"10": {
"name": "Anti-Attacks BL",
"detected": true,
"reference": "https://www.anti-attacks.com/",
"elapsed_ms": 0
},
"11": {
"name": "AntiSpam_by_CleanTalk",
"detected": false,
"reference": "https://cleantalk.org/",
"elapsed_ms": 0
},
"12": {
"name": "APEWS-L2",
"detected": false,
"reference": "http://www.apews.org/",
"elapsed_ms": 0
},
"13": {
"name": "AZORult Tracker",
"detected": false,
"reference": "https://azorult-tracker.net/",
"elapsed_ms": 0
},
"14": {
"name": "Backscatterer",
"detected": true,
"reference": "https://www.backscatterer.org/",
"elapsed_ms": 0
},
"15": {
"name": "Blocking_rocks",
"detected": false,
"reference": "https://blocking.rocks/",
"elapsed_ms": 0
},
"16": {
"name": "BlockList_de",
"detected": true,
"reference": "https://www.blocklist.de/",
"elapsed_ms": 0
},
"17": {
"name": "Blocklist.net.ua",
"detected": true,
"reference": "https://blocklist.net.ua/",
"elapsed_ms": 0
},
"18": {
"name": "Botscout (Last Caught)",
"detected": false,
"reference": "https://botscout.com/",
"elapsed_ms": 0
},
"19": {
"name": "Botvrij.eu",
"detected": false,
"reference": "https://botvrij.eu/",
"elapsed_ms": 0
},
"20": {
"name": "Brute Force Blocker",
"detected": false,
"reference": "https://danger.rulez.sk/index.php/bruteforceblocker/",
"elapsed_ms": 0
},
"21": {
"name": "C-APT-ure",
"detected": false,
"reference": "https://c-apt-ure.blogspot.com/",
"elapsed_ms": 0
},
"22": {
"name": "Charles Haley",
"detected": false,
"reference": "https://charles.the-haleys.org/",
"elapsed_ms": 0
},
"23": {
"name": "CI Army List",
"detected": true,
"reference": "https://cinsscore.com/#list",
"elapsed_ms": 0
},
"24": {
"name": "CRDF",
"detected": true,
"reference": "https://threatcenter.crdf.fr/check.html",
"elapsed_ms": 0
},
"25": {
"name": "CruzIT Blocklist",
"detected": false,
"reference": "https://www.cruzit.com/",
"elapsed_ms": 0
},
"26": {
"name": "CSpace Hostings IP BL",
"detected": true,
"reference": "https://cspacehostings.com/",
"elapsed_ms": 0
},
"27": {
"name": "Cybercrime-tracker.net",
"detected": false,
"reference": "https://cybercrime-tracker.net/",
"elapsed_ms": 0
},
"28": {
"name": "Darklist.de",
"detected": false,
"reference": "https://www.darklist.de/",
"elapsed_ms": 0
},
"29": {
"name": "Dataplane.org",
"detected": true,
"reference": "https://dataplane.org/",
"elapsed_ms": 0
},
"30": {
"name": "ELLIO IP Feed",
"detected": false,
"reference": "https://ellio.tech/",
"elapsed_ms": 0
},
"31": {
"name": "Etnetera BL",
"detected": false,
"reference": "https://security.etnetera.cz/",
"elapsed_ms": 0
},
"32": {
"name": "Feodo Tracker",
"detected": false,
"reference": "https://feodotracker.abuse.ch/",
"elapsed_ms": 0
},
"33": {
"name": "FSpamList",
"detected": false,
"reference": "https://fspamlist.com/",
"elapsed_ms": 0
},
"34": {
"name": "GPF DNS Block List",
"detected": false,
"reference": "https://www.gpf-comics.com/dnsbl/export.php",
"elapsed_ms": 0
},
"35": {
"name": "GreenSnow Blocklist",
"detected": false,
"reference": "https://greensnow.co/",
"elapsed_ms": 0
},
"36": {
"name": "HoneyDB",
"detected": true,
"reference": "https://honeydb.io/",
"elapsed_ms": 0
},
"37": {
"name": "InterServer IP List",
"detected": false,
"reference": "https://sigs.interserver.net/",
"elapsed_ms": 0
},
"38": {
"name": "IPSpamList",
"detected": true,
"reference": "https://www.ipspamlist.com/ip-lookup/",
"elapsed_ms": 0
},
"39": {
"name": "IPsum",
"detected": true,
"reference": "https://github.com/stamparm/ipsum",
"elapsed_ms": 0
},
"40": {
"name": "ISX.fr DNSBL",
"detected": true,
"reference": "https://bl.isx.fr/",
"elapsed_ms": 0
},
"41": {
"name": "JamesBrine IP List",
"detected": true,
"reference": "https://jamesbrine.com.au/",
"elapsed_ms": 0
},
"42": {
"name": "LAPPS Grid Blacklist",
"detected": false,
"reference": "https://lappsgrid.org/",
"elapsed_ms": 0
},
"43": {
"name": "Liquid Binary",
"detected": true,
"reference": "https://liquidbinary.com/",
"elapsed_ms": 0
},
"44": {
"name": "M4lwhere Intel",
"detected": false,
"reference": "https://m4lwhere.org/",
"elapsed_ms": 0
},
"45": {
"name": "Mark Smith Blocked IPs",
"detected": false,
"reference": "https://www.marksmith.it/",
"elapsed_ms": 0
},
"46": {
"name": "Mirai Tracker",
"detected": false,
"reference": "https://mirai.security.gives/index.php",
"elapsed_ms": 0
},
"47": {
"name": "Myip.ms Blacklist",
"detected": false,
"reference": "https://myip.ms/browse/blacklist",
"elapsed_ms": 0
},
"48": {
"name": "NEU SSH Black list",
"detected": false,
"reference": "http://antivirus.neu.edu.cn/scan/",
"elapsed_ms": 0
},
"49": {
"name": "Nginx Bad Bot Blocker",
"detected": true,
"reference": "https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker",
"elapsed_ms": 0
},
"50": {
"name": "NOC_RUB_DE",
"detected": false,
"reference": "https://noc.rub.de/web/",
"elapsed_ms": 0
},
"51": {
"name": "NoIntegrity BL",
"detected": false,
"reference": "https://www.nointegrity.org/",
"elapsed_ms": 0
},
"52": {
"name": "NordSpam",
"detected": false,
"reference": "https://www.nordspam.com/",
"elapsed_ms": 0
},
"53": {
"name": "NoVirusThanks",
"detected": false,
"reference": "https://www.novirusthanks.com/",
"elapsed_ms": 0
},
"54": {
"name": "NUBI Bad IPs",
"detected": true,
"reference": "https://www.nubi-network.com/",
"elapsed_ms": 0
},
"55": {
"name": "OpenPhish",
"detected": false,
"reference": "https://www.openphish.com/",
"elapsed_ms": 0
},
"56": {
"name": "Peter-s NUUG IP BL",
"detected": false,
"reference": "https://home.nuug.no/~peter/",
"elapsed_ms": 0
},
"57": {
"name": "PhishTank",
"detected": false,
"reference": "https://www.phishtank.com/",
"elapsed_ms": 0
},
"58": {
"name": "PlonkatronixBL",
"detected": true,
"reference": "https://plonkatronix.com/",
"elapsed_ms": 0
},
"59": {
"name": "PSBL",
"detected": false,
"reference": "https://psbl.org/",
"elapsed_ms": 0
},
"60": {
"name": "Redstout Threat IP list",
"detected": true,
"reference": "https://www.redstout.com/index.html",
"elapsed_ms": 0
},
"61": {
"name": "Ring-u NOC",
"detected": false,
"reference": "https://portal.ring-u.com/portal/portal.php",
"elapsed_ms": 0
},
"62": {
"name": "RJM Blocklist",
"detected": false,
"reference": "https://rjmblocklist.com/",
"elapsed_ms": 0
},
"63": {
"name": "Rutgers Drop List",
"detected": false,
"reference": "https://www.rutgers.edu/",
"elapsed_ms": 0
},
"64": {
"name": "Sblam",
"detected": false,
"reference": "https://sblam.com/",
"elapsed_ms": 0
},
"65": {
"name": "SSL Blacklist",
"detected": false,
"reference": "https://sslbl.abuse.ch/",
"elapsed_ms": 0
},
"66": {
"name": "Talos IP Blacklist",
"detected": false,
"reference": "https://www.talosintelligence.com/",
"elapsed_ms": 0
},
"67": {
"name": "ThreatLog",
"detected": false,
"reference": "https://www.threatlog.com/",
"elapsed_ms": 0
},
"68": {
"name": "Threatview",
"detected": false,
"reference": "https://threatview.io/",
"elapsed_ms": 0
},
"69": {
"name": "Threat Crowd",
"detected": false,
"reference": "https://www.threatcrowd.org/",
"elapsed_ms": 0
},
"70": {
"name": "Threat Sourcing",
"detected": false,
"reference": "https://www.threatsourcing.com/",
"elapsed_ms": 0
},
"71": {
"name": "TweetFeed",
"detected": false,
"reference": "https://github.com/0xDanielLopez/TweetFeed",
"elapsed_ms": 0
},
"72": {
"name": "UCEPROTECT Level 1",
"detected": false,
"reference": "https://www.uceprotect.net/en/index.php",
"elapsed_ms": 0
},
"73": {
"name": "URLhaus",
"detected": false,
"reference": "https://urlhaus.abuse.ch/",
"elapsed_ms": 0
},
"74": {
"name": "USTC IP BL",
"detected": false,
"reference": "http://blackip.ustc.edu.cn/",
"elapsed_ms": 0
},
"75": {
"name": "ViriBack C2 Tracker",
"detected": false,
"reference": "https://tracker.viriback.com/",
"elapsed_ms": 0
},
"76": {
"name": "VoIP Blacklist",
"detected": true,
"reference": "https://www.voipbl.org/",
"elapsed_ms": 0
},
"77": {
"name": "VXVault",
"detected": false,
"reference": "http://vxvault.net/ViriList.php",
"elapsed_ms": 0
},
"78": {
"name": "ZeroDot1 Miner IPs",
"detected": false,
"reference": "https://zerodot1.gitlab.io/CoinBlockerListsWeb/index.html",
"elapsed_ms": 0
}
},
"detections": 24,
"engines_count": 79,
"detection_rate": "30%",
"scan_time_ms": 2012
},
"information": {
"reverse_dns": "battery.census.shodan.io",
"is_eu": true,
"continent_code": "EU",
"continent_name": "Europe",
"country_code": "NL",
"country_name": "Netherlands (Kingdom of the)",
"currency": "EUR",
"currency_name": "Euro",
"currency_name_plural": "euros",
"currency_symbol": "€",
"currency_symbol_native": "€",
"calling_code": "31",
"emoji_flag": "🇳🇱",
"emoji_flag_unicode": "U+1F1F3 U+1F1F1",
"region_name": "Noord-Holland",
"city_name": "Amsterdam",
"latitude": 52.378502,
"longitude": 4.89998,
"isp": "FiberXpress BV",
"asn": "AS202425"
},
"anonymity": {
"is_proxy": false,
"is_webproxy": false,
"is_vpn": false,
"is_hosting": false,
"is_tor": false
},
"risk_score": {
"result": 100
},
"elapsed_ms": 2084
}Checking reputation...
Checking reputation...
Checking reputation...
Checking reputation...
Checking reputation...
Checking reputation...
Checking reputation...
Checking reputation...
Key Features
Businesses use this IP Reputation API to check if an IP address is blocklisted and by which blocklist service, if the IP address is used as proxy, and to get additional IP geolocation information.
This API supports IPv4 and IPv6 addresses, it includes IP geolocation, ASN and IP reputation data.
Check if an IP address is known to be a public proxy, web proxy, VPN, Tor node or hosting provider.
We support 70+ IP blocklist services, including some of our in-house IP abuse detection engines.
Find out which IP blocklist service(s) detect your IP address, this can help to fix eventual false positives.
Common Use Cases
Our API can be used in many ways, from cybersecurity tasks to other business-specific tasks. Here we showcase the most popular use cases according to our customers usage:
Using a SIEM platform? Add context to security incidents, convert events into valuable insights.
If you have some indicators of compromise (IoC) of an IP, you can verify them with our API.
Whether you need to get IP reputation, IP country geolocation or IP risk score, our API has it all.
If you have a registration form you can block suspicious user sign-ups based on their IP reputation score.
USAGE EXAMPLE
All it takes is a HTTPS POST request with JSON payload to our endpoint, and you’ll receive the response within seconds, usually within 1-3 seconds. Here are a few code examples to use the API:
$ip = '1.2.3.4';
$apiUrl = 'https://api.apivoid.com/v2/ip-reputation';
$apiKey = 'your_api_key_here';
$ch = curl_init($apiUrl);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(['ip' => $ip]));
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
if ($httpCode === 200) {
$responseData = json_decode($response, true);
print_r($responseData);
// Block user if IP is detected by 1 or more blacklists
if (($responseData['blacklists']['detections'] ?? 0) > 0) {
echo "Your IP address is detected by " . intval($responseData['blacklists']['detections']) . " blacklists.";
exit;
}
// Block user if IP is detected by at least 2 blacklists (to reduce false positives)
if (($responseData['blacklists']['detections'] ?? 0) > 1) {
echo "Your IP address is detected by " . intval($responseData['blacklists']['detections']) . " blacklists.";
exit;
}
// Block user if IP is located in a specific country
if (in_array($responseData['information']['country_code'] ?? '', ['IT', 'DE'])) {
echo "Your IP address is located in a not-allowed country.";
exit;
}
// Block user if IP is detected as Tor or proxy
if (array_filter($responseData['anonymity'] ?? [], fn($value, $key) => in_array($key, ['is_tor', 'is_proxy']) && $value, ARRAY_FILTER_USE_BOTH)) {
echo "Your IP address is detected as Tor or proxy.";
exit;
}
// Block user if IP is detected as VPN
if ($responseData['anonymity']['is_vpn'] ?? false) {
echo "Your IP address is detected as VPN.";
exit;
}
}Create your account, pick a subscription plan, and make your first API call instantly with your API key—simple as that!
Get started now