IP Blocklist API

Check any IP address against 140+ continuously updated threat intelligence feeds.

Quick start

One request, no registration. Paste this into your terminal:

curl -X POST https://ipguardian.net/api/check \
  -H "Content-Type: application/json" \
  -d '"8.8.8.8"'

Try it in the browser →

Endpoint

POST https://ipguardian.net/api/check
Content-Type: application/json

Only POST is accepted. A GET request returns 405.

Machine-readable description: OpenAPI 3.0 specification — import it into Postman, Insomnia or a client generator.

Request formats

Three shapes are accepted, so you can use whichever fits your client:

// A single address as a string
"8.8.8.8"

// An array of addresses (up to 100)
["8.8.8.8", "1.1.1.1", "192.0.2.77"]

// An object
{"ip": "8.8.8.8"}
{"ips": ["8.8.8.8", "1.1.1.1"]}

Both IPv4 and IPv6 addresses are accepted. Note that the source lists aggregated here are currently IPv4‑only — see the FAQ below.

Response format

A single address returns one result object; several addresses return an array.

{
  "success": true,
  "timestamp": "2026-08-31T14:00:33.585Z",
  "count": 1,
  "results": {
    "ip": "192.0.2.77",
    "found": true,
    "sources": [
      {
        "type": "subnet",
        "subnet": "192.0.2.0/24",
        "filename": "cidr_report_bogons.netset",
        "category": "unroutable",
        "maintainer": "CIDR Report"
      }
    ]
  }
}

Fields

Field	Meaning
found	true if the address appears in at least one list
sources	Lists the address was found in (at most 10 are returned)
type	direct — exact match; subnet — the address falls inside a listed range
subnet	The matching CIDR range (subnet matches only)
filename	Name of the source list
category	anonymizers, abuse, attacks, spam, malware, reputation, organizations, unroutable
maintainer	Who publishes the list
listed_since	When IPGuardian first saw the entry in this list; with listed_since_precision: "floor" the entry predates history tracking (October 2026) and was listed on or before that time
network	Announcing network for IPv4: asn, org, country, and a heuristic type (datacenter, mobile, isp, unrouted) with its type_source; null for IPv6
delisted	Lists the exact address left during the last 14 days and is no longer in, with removed_at

An address absent from every list returns "found": false with an empty sources array.

Limits

Limit	Value
Addresses per request	100
Requests per minute	100 per client IP
Maximum request body	1 MB

Batch your requests. Checking 100 addresses in one call is far cheaper than 100 separate calls — for both sides — and keeps you well inside the rate limit.

Error codes

Code	Meaning
200	Success
400	Malformed JSON, invalid IP address, empty list, or more than 100 addresses
405	Method other than POST
413	Request body over 1 MB
429	Rate limit exceeded — retry after a minute
503	Service temporarily unavailable

Code examples

cURL

curl -X POST https://ipguardian.net/api/check \
  -H "Content-Type: application/json" \
  -d '["8.8.8.8", "1.1.1.1"]'

Python

import requests

response = requests.post(
    "https://ipguardian.net/api/check",
    json=["8.8.8.8", "1.1.1.1"],
    timeout=10,
)
for result in response.json()["results"]:
    status = "BLOCKED" if result["found"] else "clean"
    print(result["ip"], status)

Node.js

const response = await fetch("https://ipguardian.net/api/check", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify(["8.8.8.8", "1.1.1.1"]),
});

const { results } = await response.json();
for (const r of results) {
  console.log(r.ip, r.found ? "BLOCKED" : "clean");
}

PHP

$ch = curl_init("https://ipguardian.net/api/check");
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ["Content-Type: application/json"],
    CURLOPT_POSTFIELDS     => json_encode(["8.8.8.8", "1.1.1.1"]),
]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

foreach ($data["results"] as $r) {
    echo $r["ip"], $r["found"] ? " BLOCKED" : " clean", PHP_EOL;
}

Go

body, _ := json.Marshal([]string{"8.8.8.8", "1.1.1.1"})

resp, err := http.Post(
    "https://ipguardian.net/api/check",
    "application/json",
    bytes.NewReader(body),
)
if err != nil {
    log.Fatal(err)
}
defer resp.Body.Close()

Checking a log file

Extract unique addresses from an nginx access log and check them in batches of 100:

awk '{print $1}' access.log | sort -u | head -100 \
  | jq -R . | jq -s . \
  | curl -X POST https://ipguardian.net/api/check \
      -H "Content-Type: application/json" --data-binary @- \
  | jq '.results[] | select(.found) | {ip, source: .sources[0].filename}'

Where the data comes from

The database aggregates 140+ curated public blocklists, rebuilt from source every day. Contributors include FireHOL, Spamhaus, Emerging Threats, DShield, TorProject, StopForumSpam, Project Honey Pot and others.

Category	What it covers
anonymizers	Tor exit nodes, open SOCKS and SSL proxies, anonymising networks
abuse	Addresses reported for abuse: forum spam, comment spam, form abuse
attacks	Sources of brute force, scanning and exploitation attempts
spam	Known email and comment spam sources
malware	Command-and-control servers and malware distribution hosts
reputation	General low-reputation address ranges
unroutable	Bogons and reserved ranges that should never appear on the internet

Live figures are on the statistics page.

Frequently asked questions

Do I need an API key?

No. There is no registration and no key. Send a request and you get an answer.

Is it really free?

Yes, within the limits above.

How often is the data updated?

Every source list is re-fetched and rebuilt once a day.

Does a match mean the address is malicious?

Not necessarily. It means the address appears in at least one public list, and the category tells you why. An address listed under anonymizers is running a proxy or Tor node — that is not the same as one listed under attacks. Weigh the category and the number of matching sources before you block anything.

Can I check IPv6?

Yes, IPv6 addresses are accepted and parsed correctly. Be aware, though, that the source lists currently aggregated here are IPv4‑only, so an IPv6 lookup will in practice always come back "found": false. That is a property of the upstream feeds, not a limitation of the API. IPv6 sources will be added as they become available.

Are the addresses I check stored?

No. The addresses submitted for checking are not written to logs — only the number of addresses per request is recorded. The shareable result pages (/ip/<address>) carry the address in the URL; our own access log masks it, and those pages load no analytics. See the privacy policy.