Check IP Reputation Across Major Blocklists

IP Blacklist Lookup API.

Check if an IP address appears on known malicious IP blocklists. Identifies inbound threats (attackers, spammers) and outbound threats (C2 servers, malware hosts).

Get your free API key Read the docs

Free tier, no card< 200ms responses99.9% uptime SLA

GET/v1/ipblacklistlookuplive

query

Response200 OK · sample

{
  "status": "ok",
  "error": null,
  "data": {
    "ipAddress": "185.220.101.1",
    "isIPBlacklisted": true,
    "inbound": {
      "found": true,
      "description": "IP is known for malicious inbound activity (spam, scanning, brute-force attacks)"
    },
    "outbound": null,
    "threatLevel": "high",
    "ipDetails": {
      "ip": "185.220.101.1",
      "country": "DE",
      "region": "BY",
      "timezone": "Europe/Berlin",
      "city": "Nuremberg",
      "coordinates": [
        49.4478,
        11.0683
      ],
      "countryName": "Germany",
      "regionName": "Bavaria",
      "postalCode": "90403",
      "continent": "EU",
      "continentName": "Europe",
      "accuracyRadius": 20
    }
  }
}

Sample response · verify to run one live call, no signup

How it works

IP Blacklist Lookup API

Check if an IP address appears on known malicious IP blocklists. Identifies inbound threats (attackers, spammers) and outbound threats (C2 servers, malware hosts).

Check inbound and outbound threat lists
Blocklists updated multiple times daily
IP geolocation details (premium)
Fast sub-second response times

1
Send one request
A single authenticated GET with the location you care about — no SDK required.
```
GET /v1/ipblacklistlookup?query=…
x-api-key: your_key
```
2
We do the aggregation
Each request pulls from multiple upstream sources and computes the derived fields for you.
3
Get clean JSON back
One structured object, typically under 200 ms — ready to render.
```
{ ipAddress, isIPBlacklisted, inbound, … }
```

The response

Everything in a single call.

/v1/ipblacklistlookupapplication/json

ipAddress"185.220.101.1"

isIPBlacklistedtrue

inboundfound, description

outbound—

threatLevel"high"

ipDetailsip, country, region, timezone, city, coordinates, countryName, regionName, postalCode, continent, continentName, accuracyRadius

Use cases

What developers build with it.

Real applications shipping on this endpoint today — each with the numbers that made it worth wiring up.

See every use case

Email Deliverability Monitoring

Proactively monitor your sending IPs with our API. Check if your IP appears on inbound blocklists that email providers use to filter spam.

Check inbound threat blocklistsEarly warning before delivery issuesQuick detection of blocklist entries

Monitor IPsproactively

Preventdeliverability issues

Fast detectionsub-second response

Fraud & Threat Detection

Check visitor IPs against our blocklist API. Block or flag IPs on inbound threat lists. Add an extra layer of security to your fraud prevention stack.

Block known threat IPsReduce fraud and abuseDaily updated blocklists

Block threatsat the door

Prevent attacksbefore they start

Fast detectionsub-second response

Start coding

Call it in your language.

Copy a working request, or install a typed SDK. Same endpoint, same key.

const res = await fetch("https://api.apiverve.com/v1/ipblacklistlookup?ip=185.220.101.1", {
  headers: { "x-api-key": "YOUR_API_KEY" },
});
const { data } = await res.json();
console.log(data);

Included in your key

One subscription, the whole check ip reputation across major blocklists stack.

Every related API ships with your key — no separate plans, no extra keys, one bill.

See pricing

8APIs in this bundle

99.9%uptime SLA

The bundle

ipblacklistlookupYou’re hereiplookup vpndetector tordetect botdetector phishingcheck asnlookup reversednslookup

No code required

Wire it into the tools you already run.

Ready-made recipes for Zapier, Make, and n8n — trigger on an event, and the data lands where your team works.

Google Sheets

IP Blacklist Check in Google Sheets

WhenNew row added in Google Sheets

ThenFetch IP blacklist lookup for IP in row → write isIPBlacklisted, threatLevel, and inbound.found back to the row

Slack

Blacklisted IP Alert in Slack

WhenNew login or signup event

ThenFetch IP blacklist lookup → if isIPBlacklisted is true, post ipAddress, threatLevel, and inbound.description to Slack

Airtable

Blacklist Check on Airtable Records

WhenNew record created in Airtable

ThenFetch IP blacklist lookup for IP field → update record with isIPBlacklisted, threatLevel, and inbound.found

Notion

IP Threat Database in Notion

WhenNew page created in Notion

ThenFetch IP blacklist lookup for IP on page → update with isIPBlacklisted, threatLevel, and ipDetails.countryName

Salesforce

IP Reputation Check on Salesforce Leads

WhenNew lead created in Salesforce

ThenFetch IP blacklist lookup for lead IP → update lead with isIPBlacklisted and threatLevel

GitHub

IP Blacklist Context in GitHub Issues

WhenNew issue created in GitHub

ThenFetch IP blacklist lookup for reported IP → add isIPBlacklisted, threatLevel, and inbound.description as issue comment

Browse all integrations

Learn

Understand the data behind the API.

Understanding IP Blacklists

Learn how IP blacklists work and why they matter for security.

Email Deliverability and IP Reputation

How IP reputation affects email delivery and what to do about it.

IP Threat Intelligence for Security

Using IP reputation data to enhance security posture.

Questions about the API

Which blacklists do you check?

We check against 50+ major blacklists including Spamhaus (SBL, XBL, PBL), Barracuda, SORBS, SpamCop, UCEPROTECT, Invaluement, and other DNS-based blocklists (DNSBLs) used by email providers and security tools.

What are inbound vs outbound blocklists?

Inbound blocklists contain IPs known for spam, scanning, and brute-force attacks (threats coming TO you). Outbound blocklists contain known malicious destinations like C2 servers and malware hosts (threats your systems might connect TO).

Why is my IP blacklisted?

IPs get blacklisted for spam, malware distribution, being part of a botnet, or sending unsolicited traffic. Shared hosting and VPS IPs are often listed due to other users' actions.

How do I get removed from a blacklist?

Each blacklist has its own delisting process. Identify which list you are on and contact them directly. Most require stopping the offending behavior and requesting removal through their website.

How often are blocklists updated?

Our blocklists are updated multiple times daily to ensure accurate threat intelligence. The API queries our updated database when you make a request.

Can I monitor my IP continuously?

Yes! Set up scheduled API calls to monitor your mail server or critical IPs. Alert when an IP appears on blocklists. Our plans support the polling frequency you need.

Does this affect email deliverability?

Yes. Major email providers check blocklists when receiving mail. If your sending IP is listed on inbound threat lists, emails may be rejected or sent to spam. Regular monitoring helps maintain deliverability.

What is the ipDetails field?

With premium plans, you also get geolocation details for the IP address including country, region, and other location data. This helps identify where threats are originating from.

Can I check outbound connections?

Yes! Check if destination IPs are on outbound blocklists to detect if your systems are trying to connect to known malicious servers (potential compromise indicator).