IP Reputation API Reference
Check the reputation of an IPv4 or IPv6 address using multiple IP blacklist services, with detection details, risk score and IP information.
Service details and pricing: IP Reputation API
Request example
Query the endpoint via an HTTPS POST request (replace YOUR_API_KEY_HERE with your API key):
curl -X POST "https://api.apivoid.com/v2/ip-reputation" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY_HERE" \
-d '{"ip": "80.82.77.139"}'The same request in PHP:
$ip = '80.82.77.139';
$apiKey = 'YOUR_API_KEY_HERE';
$curl = curl_init('https://api.apivoid.com/v2/ip-reputation');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['ip' => $ip]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);
if ($httpCode === 200) {
$responseData = json_decode($response, true);
print_r($responseData);
} else {
print_r('An error occurred: '.$response);
}Request parameters
Required
Public IPv4 or IPv6 address to scan.
⚠ Private or internal IP addresses (e.g. 127.0.0.1) are not allowed.
Optional
List of comma-separated engines to exclude, e.g. BlockedServersRBL,NordSpam.
Your Spamhaus DBL DQS key, this will enable the Spamhaus engine.
Disable reverse DNS lookup to reduce the response time.
Bonus Tip: How to reduce response time
If you require a response in less than 500ms you can use these parameters:
{"ip":"1.2.3.4","disable_reverse_dns":true,"exclude_engines":"0spam,RealtimeBLACKLIST,IBM_Cobion,JustSpam_org,S5hbl,BlockedServersRBL,EFnet_RBL"}This disables the reverse DNS lookup and excludes the engines that are occasionally slow to respond.
This way the response time should always be less than 500ms.
Response example
A successful request returns HTTP 200 with a JSON body:
{
"ip": "80.82.77.139",
"version": "IPv4",
"blacklists": {
"engines": {
"0": {
"name": "0spam",
"detected": false,
"reference": "https://0spam.org/",
"elapsed_ms": 0
},
"1": {
"name": "Anti-Attacks BL",
"detected": false,
"reference": "https://www.anti-attacks.com/",
"elapsed_ms": 0
},
"2": {
"name": "AntiSpam_by_CleanTalk",
"detected": false,
"reference": "https://cleantalk.org/",
"elapsed_ms": 0
},
"3": {
"name": "APEWS-L2",
"detected": false,
"reference": "http://www.apews.org/",
"elapsed_ms": 0
},
"4": {
"name": "AZORult Tracker",
"detected": false,
"reference": "https://azorult-tracker.net/",
"elapsed_ms": 0
},
"5": {
"name": "Backscatterer",
"detected": true,
"reference": "https://www.backscatterer.org/",
"elapsed_ms": 0
},
"6": {
"name": "Barracuda_Reputation_BL",
"detected": false,
"reference": "https://barracudacentral.org/lookups",
"elapsed_ms": 0
},
"7": {
"name": "BitNinja",
"detected": true,
"reference": "https://bitninja.com/",
"elapsed_ms": 0
},
"8": {
"name": "BlockedServersRBL",
"detected": true,
"reference": "https://www.blockedservers.com/",
"elapsed_ms": 0
},
...
},
"detections": 27,
"engines_count": 80,
"detection_rate": "33%",
"scan_time_ms": 5
},
"information": {
"reverse_dns": "dojo.census.shodan.io",
"is_eu": true,
"continent_code": "EU",
"continent_name": "Europe",
"country_code": "NL",
"country_name": "Netherlands (Kingdom of the)",
"currency": "EUR",
"currency_name": "Euro",
"currency_name_plural": "euros",
"currency_symbol": "€",
"currency_symbol_native": "€",
"calling_code": "31",
"emoji_flag": "🇳🇱",
"emoji_flag_unicode": "U+1F1F3 U+1F1F1",
"region_name": "Noord-Holland",
"city_name": "Amsterdam",
"latitude": 52.378502,
"longitude": 4.89998,
"isp": "FiberXpress BV",
"asn": "AS202425",
"is_bogon": false,
"is_spamhaus_drop": false,
"is_fake_bot": false,
"is_google_bot": false,
"is_search_engine_bot": false,
"related_service_name": "",
"related_service_domain": "",
"related_service_type": "",
"is_major_provider_spf_ip": false,
"is_public_dns": false,
"cloud_provider": "",
"cloud_provider_domain": "",
"aws_service": "",
"is_google_service": false,
"edge_service": "",
"edge_service_domain": "",
"is_satellite": false
},
"asn": {
"asn": "AS202425",
"asname": "INT-NETWORK",
"route": "80.82.77.0/24",
"status": "active",
"org": "IP Volume inc",
"country_code": "SC",
"created": "2018-05-17",
"days_since_created": 2773,
"updated": "2024-01-25",
"days_since_updated": 694,
"address": "Seychelles",
"abuse_email": "abuse@ipvolume.net",
"domain": "ipvolume.net",
"total_ipv4_prefixes": 55,
"total_ipv4_ips": 14848,
"total_ipv6_prefixes": 1,
"type": "hosting",
"rir": "RIPE"
},
"anonymity": {
"is_proxy": false,
"is_webproxy": false,
"is_residential_proxy": false,
"is_vpn": false,
"is_hosting": true,
"is_relay": false,
"is_tor": false
},
"risk_score": {
"result": 100
},
"elapsed_ms": 98
}Response fields
The fields returned in the JSON response:
ipstring
IP address submitted for scanning.
versionstring
IP version of the submitted address: IPv4 or IPv6.
blacklists → enginesobject
List of scanning engines with detection status and reference link.
blacklists → engines → [index] → namestring
Name of the scanning engine.
blacklists → engines → [index] → detectedboolean
Returns true if this engine flagged the submitted IP address.
blacklists → engines → [index] → referencestring
Link to the engine's website or listing details.
blacklists → engines → [index] → elapsed_msinteger
Time taken by this engine to complete its check, in milliseconds.
blacklists → detectionsinteger
Number of scanning engines that detected the submitted IP.
blacklists → engines_countinteger
Number of scanning engines used to scan the IP.
blacklists → detection_ratestring
Percentage of engines that detected the IP address, e.g. 33%.
blacklists → scan_time_msinteger
Time taken to scan the IP address across all engines, in milliseconds.
information → reverse_dnsstring
Hostname (reverse DNS) assigned to the IP address.
information → is_euboolean
Returns true if the IP address is located in the EU (Europe).
information → continent_codestring
Continent code (e.g. AS) of where the IP address is located.
information → continent_namestring
Continent name (e.g. Asia) of where the IP address is located.
information → country_codestring
Country code (e.g. CN) of where the IP address is located.
information → country_namestring
Country name of where the IP address is located.
information → currencystring
The local currency code (ISO 4217), e.g. EUR.
information → currency_namestring
Name of the currency used in the country, e.g. Euro.
information → currency_name_pluralstring
Plural name of the currency, e.g. euros.
information → currency_symbolstring
The symbol of the local currency, e.g. € for Euro.
information → currency_symbol_nativestring
Native symbol of the currency, e.g. €.
information → calling_codestring
The international calling code of the country, e.g. 1 for US.
information → emoji_flagstring
The country flag emoji.
information → emoji_flag_unicodestring
The Unicode code points of the country flag emoji.
information → region_namestring
The region or state associated with the IP.
information → city_namestring
The city associated with the IP.
information → latitudefloat
The estimated latitude of the city.
information → longitudefloat
The estimated longitude of the city.
information → ispstring
Internet Service Provider (ISP) of the IP address.
information → asnstring
IP Autonomous System Number (ASN), such as AS16509.
information → is_bogonboolean
Returns true if the IP is a bogon address.
information → is_spamhaus_dropboolean
Returns true if the IP is listed in the Spamhaus DROP list.
information → is_fake_botboolean
Returns true if the IP claims to be a search engine bot but is not verified.
information → is_google_botboolean
Returns true if the IP belongs to a verified Google bot.
information → is_search_engine_botboolean
Returns true if the IP belongs to a known and verified search engine bot.
information → related_service_namestring
The name of the service associated with the IP, e.g. AhrefBot.
information → related_service_domainstring
The domain name associated with the related service, e.g. ahrefs.com.
information → related_service_typestring
The service category, can be Crawler, Search Engine Bot, SaaS, Payments, Monitoring, Identity or Marketing.
information → is_major_provider_spf_ipboolean
Returns true if the IP belongs to a major email provider SPF range.
information → is_public_dnsboolean
Returns true if the IP is a public DNS resolver (e.g. 8.8.8.8).
information → cloud_providerstring
The name of the major cloud service provider, e.g. Amazon AWS.
information → cloud_provider_domainstring
The primary domain name of the cloud service provider, e.g. amazonaws.com.
information → aws_servicestring
The AWS service associated with the IP (e.g. EC2, S3, CloudFront, Route53, API Gateway).
information → is_google_serviceboolean
Returns true if the IP belongs to a Google service.
information → edge_servicestring
The edge or CDN service associated with the IP, e.g. Fastly.
information → edge_service_domainstring
The domain name associated with the edge or CDN service, e.g. fastly.com.
information → is_satelliteboolean
Returns true if the IP is associated with satellite connectivity.
asn → asnstring
The AS number, e.g. AS202425.
asn → asnamestring
The AS name, e.g. INT-NETWORK.
asn → routestring
The IP prefix announced by the AS (CIDR notation), e.g. 80.82.77.0/24.
asn → statusstring
The current registration status of the AS (e.g. active).
asn → orgstring
The organization that owns or operates the AS, e.g. IP Volume inc.
asn → country_codestring
The country code of the AS (ISO 3166-1 alpha-2).
asn → createdstring
The date in format Y-m-d (e.g. 2018-05-17) the AS was registered.
asn → days_since_createdinteger
The number of days since the AS was created.
asn → updatedstring
The date in format Y-m-d (e.g. 2024-01-25) the AS information was last updated.
asn → days_since_updatedinteger
The number of days since the AS information was last updated.
asn → addressstring
The registered address or location associated with the AS.
asn → abuse_emailstring
The abuse contact email address for the AS.
asn → domainstring
The primary domain name associated with the AS.
asn → total_ipv4_prefixesinteger
The total number of IPv4 prefixes announced by the AS.
asn → total_ipv4_ipsinteger
The total number of IPv4 addresses announced by the AS.
asn → total_ipv6_prefixesinteger
The total number of IPv6 prefixes announced by the AS.
asn → typestring
The AS classification, can be hosting, isp, business (default), education, government or banking.
asn → rirstring
The Regional Internet Registry responsible for the AS, can be RIPE, APNIC, ARIN, JPNIC, LACNIC or AFRINIC.
anonymity → is_proxyboolean
Returns true if IP is an open proxy (HTTP/SOCKS).
anonymity → is_webproxyboolean
Returns true if IP is a web proxy.
anonymity → is_residential_proxyboolean
Returns true if IP is a residential proxy.
anonymity → is_vpnboolean
Returns true if IP is a VPN service, e.g. NordVPN.
anonymity → is_hostingboolean
Returns true if IP is a hosting provider, e.g. DigitalOcean.
anonymity → is_relayboolean
Returns true if the IP address belongs to a relay service (e.g. Apple Private Relay).
anonymity → is_torboolean
Returns true if IP is a Tor node.
risk_score → resultinteger
Returns risk score, a number between 0 (safe) and 100 (dangerous).
elapsed_msinteger
Time taken to process the request, in milliseconds.