IP Reputation API: Detect suspicious IP addresses

A JSON API to detect potentially malicious IP addresses known for spam or fraudulent activities. Use this API to reduce fake sign-ups, protect web forms and get valuable insights about IPv4 and IPv6 addresses.

Get started now

Live demo

Consumes 1 credit per API call

# Example Curl request from the command line:
                          
curl -X POST "https://api.apivoid.com/v2/ip-reputation" \
     -H "Content-Type: application/json" \
     -H "X-API-Key: YOUR_API_KEY_HERE" \
     -d '{"ip": "93.174.95.106"}'

# Example JSON output for a 200 HTTP status code:

{
    "ip": "93.174.95.106",
    "version": "IPv4",
    "blacklists": {
        "engines": {
            "0": {
                "name": "0spam",
                "detected": false,
                "reference": "https://0spam.org/",
                "elapsed_ms": 1
            },
            "1": {
                "name": "Barracuda_Reputation_BL",
                "detected": true,
                "reference": "https://barracudacentral.org/lookups",
                "elapsed_ms": 0
            },
            "2": {
                "name": "BlockedServersRBL",
                "detected": true,
                "reference": "https://www.blockedservers.com/",
                "elapsed_ms": 0
            },
            "3": {
                "name": "EFnet_RBL",
                "detected": false,
                "reference": "https://rbl.efnetrbl.org/multicheck.php",
                "elapsed_ms": 0
            },
            "4": {
                "name": "IBM_Cobion",
                "detected": false,
                "reference": "https://filterdb.iss.net/dnsblinfo/",
                "elapsed_ms": 0
            },
            "5": {
                "name": "JustSpam_org",
                "detected": true,
                "reference": "http://www.justspam.org/",
                "elapsed_ms": 0
            },
            "6": {
                "name": "Known Scanning Service",
                "detected": true,
                "reference": "https://www.novirusthanks.org/",
                "elapsed_ms": 0
            },
            "7": {
                "name": "RealtimeBLACKLIST",
                "detected": false,
                "reference": "https://realtimeblacklist.com/",
                "elapsed_ms": 2002
            },
            "8": {
                "name": "S5hbl",
                "detected": true,
                "reference": "https://www.usenix.org.uk/content/rbl.html",
                "elapsed_ms": 0
            },
            "9": {
                "name": "SpamCop",
                "detected": false,
                "reference": "https://www.spamcop.net/",
                "elapsed_ms": 0
            },
            ...
        },
        "detections": 24,
        "engines_count": 79,
        "detection_rate": "30%",
        "scan_time_ms": 2012
    },
    "information": {
        "reverse_dns": "battery.census.shodan.io",
        "is_eu": true,
        "continent_code": "EU",
        "continent_name": "Europe",
        "country_code": "NL",
        "country_name": "Netherlands (Kingdom of the)",
        "currency": "EUR",
        "currency_name": "Euro",
        "currency_name_plural": "euros",
        "currency_symbol": "€",
        "currency_symbol_native": "€",
        "calling_code": "31",
        "emoji_flag": "🇳🇱",
        "emoji_flag_unicode": "U+1F1F3 U+1F1F1",
        "region_name": "Noord-Holland",
        "city_name": "Amsterdam",
        "latitude": 52.378502,
        "longitude": 4.89998,
        "isp": "FiberXpress BV",
        "asn": "AS202425"
    },
    "anonymity": {
        "is_proxy": false,
        "is_webproxy": false,
        "is_vpn": false,
        "is_hosting": false,
        "is_tor": false
    },
    "risk_score": {
        "result": 100
    },
    "elapsed_ms": 2084
}

Check the safety reputation of any IPv4 or IPv6 address

Businesses use this IP Reputation API to check if an IP address is blocklisted and by which blocklist service, if the IP address is used as proxy, and to get additional IP geolocation information.

Support IPv4 and IPv6

This API supports IPv4 and IPv6 addresses, it includes IP geolocation, ASN and IP reputation data.

Detect Proxy, VPN, Tor

Check if an IP address is known to be a public proxy, web proxy, VPN, Tor node or hosting provider.

70+ Scanning Engines

We support 70+ IP blocklist services, including some of our in-house IP abuse detection engines.

IP Blocklist Details

Find out which IP blocklist service(s) detect your IP address, this can help to fix eventual false positives.

Take a look at some real-world use cases of this API service

Our API can be used in many ways, from cybersecurity tasks to other business-specific tasks. Here we showcase the most popular use cases according to our customers usage:

Enrich SIEM Data

Using a SIEM platform? Add context to security incidents, convert events into valuable insights.

Validate IoCs

If you have some indicators of compromise (IoC) of an IP, you can verify them with our API.

Better Risk Assessment

Whether you need to get IP reputation, IP country geolocation or IP risk score, our API has it all.

Reduce Fake Sign-ups

If you have a registration form you can block suspicious user sign-ups based on their IP reputation score.

$ip = '1.2.3.4'; $apiUrl = 'https://api.apivoid.com/v2/ip-reputation'; $apiKey = 'your_api_key_here'; $ch = curl_init($apiUrl); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode(['ip' => $ip])); $response = curl_exec($ch); $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE); curl_close($ch); if ($httpCode === 200) { $responseData = json_decode($response, true); print_r($responseData); // Block user if IP is detected by 1 or more blacklists if (($responseData['blacklists']['detections'] ?? 0) > 0) { echo "Your IP address is detected by " . intval($responseData['blacklists']['detections']) . " blacklists."; exit; } // Block user if IP is detected by at least 2 blacklists (to reduce false positives) if (($responseData['blacklists']['detections'] ?? 0) > 1) { echo "Your IP address is detected by " . intval($responseData['blacklists']['detections']) . " blacklists."; exit; } // Block user if IP is located in a specific country if (in_array($responseData['information']['country_code'] ?? '', ['IT', 'DE'])) { echo "Your IP address is located in a not-allowed country."; exit; } // Block user if IP is detected as Tor or proxy if (array_filter($responseData['anonymity'] ?? [], fn($value, $key) => in_array($key, ['is_tor', 'is_proxy']) && $value, ARRAY_FILTER_USE_BOTH)) { echo "Your IP address is detected as Tor or proxy."; exit; } // Block user if IP is detected as VPN if ($responseData['anonymity']['is_vpn'] ?? false) { echo "Your IP address is detected as VPN."; exit; } }