Products
IP Geolocation Anonymity Detection Blocklists IP Reputation Scores ASN & Company Network Classification Mobile Carriers Extended ASN API ipdata.free
Resources
Documentation API Reference SDKs & Libraries Research Tool Datacenter networks Mobile carriers
Pricing Log in
Sign up
[ BLOCKLISTS ]

Check any IP against
100+ blocklists

Known attackers, abusers, spammers and scanners, pooled from more than a hundred feeds and returned as the lists an address appears on — and why.

the response's blocklists, in the threat object — with every plan

Spam Email abuse
Scanners Port probes
Botnets C&C nodes
Brute Force Credential stuffing
Exploits CVE targeting
Categories
▸ is_known_attacker: true — 2 blocklists Emerging Threats (scanner) · AbuseIPDB (brute force)
Get Started See the feeds
100+ Blocklists
13 Threat categories
<40ms Response time
8M+ IPs screened
[ 01 — SIGNAL SOURCES ]

Where the listings come from

ipdata reads more than a hundred blocklist feeds from over seventy maintainers and folds them into one answer per address. Ten of the best known:

MaintainerFeedsWhat they list
Spamhausspamhaus.org 3DROP, EDROP, DROPv6 Hijacked and criminal-controlled netblocks: do not route or peer abuse.chabuse.ch 7Feodo Tracker, URLhaus, ThreatFox, SSL Blacklist Botnet command-and-control servers and malware hosts AlienVaultalienvault.com 1OTX IP reputation Addresses reported malicious by the Open Threat Exchange Cisco Talostalosintelligence.com 1IP blacklist Attack sources seen across Cisco's telemetry Emerging Threatsemergingthreats.net 1Compromised IPs Hosts known to be compromised and used in attacks SANS ISC & DShielddshield.org 2DShield block list, ISC attack sources The most-reported attacking networks, from DShield's sensors AbuseIPDBabuseipdb.com 1Reported addresses Addresses reported for abuse by site operators worldwide Tor Projecttorproject.org 1Exit addresses Every current Tor exit node Team Cymruteam-cymru.com 2Bogon aggregate, full bogons IPv4 Bogons: address space that should never appear on the internet Blocklist.deblocklist.de 1All reported attackers Attackers reported by fail2ban installations around the world

+ 98 more feeds from 66 maintainers

[ 02 — BLOCKLIST QUERYING ]

Check any IP against 100+ blocklists

One API call returns every blocklist an IP appears on — name, category, listing date, and evidence. No need to query Spamhaus, AbuseIPDB, and Emerging Threats separately.

01

DNS-based blocklists (DNSBLs)

Real-time DNS lookups against the most widely deployed spam and abuse blocklists. Results include zone match, listing reason, and first/last seen timestamps.

Spamhaus ZEN Spamhaus SBL Spamhaus XBL Spamhaus PBL Barracuda BRBL SORBS SURBL URIBL SpamCop Invaluement
02

Threat intelligence feeds

Curated feeds of known attackers, C&C servers, malware distributors, and exploit infrastructure. Updated daily from commercial and open-source providers.

Emerging Threats AlienVault OTX Talos Intelligence Abuse.ch PhishTank OpenPhish Feodo Tracker URLhaus Malware Bazaar ThreatFox
03

Community & crowd-sourced

Abuse reports from network operators, security researchers, and automated reporting systems. Volume and recency indicate sustained malicious activity vs. one-off incidents.

AbuseIPDB Project Honeypot Blocklist.de CINS Army DShield GreenSnow Brute Force Blocker Nothink
04

Specialized & sector-specific

Targeted lists for specific attack types — Tor exit nodes, open proxies, cryptocurrency mining pools, hosting ranges, and government-sanctioned infrastructure.

Tor Exit Nodes FireHOL iBlocklist MaxMind Proxy Cloudflare Radar GreyNoise Censys BinaryEdge
[ 03 — Attributes ]

Every threat signal in a single call

The feeds an address appears on and the verdicts drawn from them, returned with every lookup. No field-level pricing.

Listings4 fields · threat.blocklists

arraythreat.blocklists

The blocklists the address has been reported to; empty when it is on none.

stringthreat.blocklists[].name

The name of the list.

stringthreat.blocklists[].site

The list’s website.

stringthreat.blocklists[].type

The kind of list it is.

Verdicts4 fields · threat

booleanthreat.is_known_attacker

Whether the address is a known source of malicious activity: attacks, malware, botnet traffic.

booleanthreat.is_known_abuser

Whether the address is a known source of abuse: spam, harvesters, registration bots and other nuisance bots.

booleanthreat.is_threat

True when either is_known_attacker or is_known_abuser is true.

booleanthreat.is_bogon

Whether the address is a bogon: unallocated or reserved space that should never appear on the public internet.

[ 04 — USE CASES ]

What you can build with blocklists

01

WAF enrichment

Feed reputation scores into your web application firewall to automatically escalate blocking thresholds for known-bad IPs. Challenge medium-risk traffic with CAPTCHAs, hard-block high-risk.

02

SIEM log enrichment

Enrich security event logs with threat context at ingestion time. Analysts see reputation scores, threat categories, and blocklist history alongside every alert — no manual lookup required.

03

Account fraud prevention

Score IPs at registration and login to detect account takeover attempts, credential stuffing campaigns, and fake account creation from known-malicious infrastructure.

04

Email gateway filtering

Reject or quarantine inbound email from IPs with high spam or phishing scores. Reduce inbox noise and protect users from malicious attachments and credential harvesting.

05

Egress monitoring

Check your own hosts’ outbound connections against the C&C and malware lists. A compromised server shows up the moment it phones home to a listed address.

06

Incident response

During active incidents, bulk-query attacker IPs to understand campaign scope, identify related infrastructure, and determine whether the threat is targeted or opportunistic.

[ 05 — PLANS ]

Open feeds on every plan, commercial feeds from Business

Every plan checks addresses against the open-source blocklists. Business and Enterprise add the commercial feeds from our partner providers.

Free$0OSINT feeds
Startup$50 / moOSINT feeds
Business$120 / moOSINT and commercial feeds
EnterpriseCustomOSINT and commercial feeds

Monthly prices; yearly billing is 20% less. Compare every plan