IP Blocklist API

Check any IP address against 160+ continuously updated threat intelligence feeds.

Quick start

One request, no registration. Paste this into your terminal:

curl -X POST https://ipguardian.net/api/check \
  -H "Content-Type: application/json" \
  -d '"8.8.8.8"'

Try it in the browser →

Endpoint

POST https://ipguardian.net/api/check
Content-Type: application/json

Only POST is accepted. A GET request returns 405.

Request formats

Three shapes are accepted, so you can use whichever fits your client:

// A single address as a string
"8.8.8.8"

// An array of addresses (up to 100)
["8.8.8.8", "1.1.1.1", "192.0.2.77"]

// An object
{"ip": "8.8.8.8"}
{"ips": ["8.8.8.8", "1.1.1.1"]}

Both IPv4 and IPv6 are supported.

Response format

A single address returns one result object; several addresses return an array.

{
  "success": true,
  "timestamp": "2026-08-31T14:00:33.585Z",
  "count": 1,
  "results": {
    "ip": "192.0.2.77",
    "found": true,
    "sources": [
      {
        "type": "subnet",
        "subnet": "192.0.2.0/24",
        "filename": "cidr_report_bogons.netset",
        "category": "unroutable",
        "maintainer": "CIDR Report"
      }
    ]
  }
}

Fields

Field	Meaning
found	true if the address appears in at least one list
sources	Every list the address was found in
type	direct — exact match; subnet — the address falls inside a listed range
subnet	The matching CIDR range (subnet matches only)
filename	Name of the source list
category	anonymizers, abuse, attacks, spam, malware, reputation, organizations, unroutable
maintainer	Who publishes the list

An address absent from every list returns "found": false with an empty sources array.

Limits

Limit	Value
Addresses per request	100
Requests per minute	100 per client IP
Maximum request body	1 MB

Batch your requests. Checking 100 addresses in one call is far cheaper than 100 separate calls — for both sides — and keeps you well inside the rate limit.

Error codes

Code	Meaning
200	Success
400	Malformed JSON, invalid IP address, empty list, or more than 100 addresses
405	Method other than POST
413	Request body over 1 MB
429	Rate limit exceeded — retry after a minute
503	Service temporarily unavailable

Code examples

cURL

curl -X POST https://ipguardian.net/api/check \
  -H "Content-Type: application/json" \
  -d '["8.8.8.8", "1.1.1.1"]'

Python

import requests

response = requests.post(
    "https://ipguardian.net/api/check",
    json=["8.8.8.8", "1.1.1.1"],
    timeout=10,
)
for result in response.json()["results"]:
    status = "BLOCKED" if result["found"] else "clean"
    print(result["ip"], status)

Node.js

const response = await fetch("https://ipguardian.net/api/check", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify(["8.8.8.8", "1.1.1.1"]),
});

const { results } = await response.json();
for (const r of results) {
  console.log(r.ip, r.found ? "BLOCKED" : "clean");
}

PHP

$ch = curl_init("https://ipguardian.net/api/check");
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ["Content-Type: application/json"],
    CURLOPT_POSTFIELDS     => json_encode(["8.8.8.8", "1.1.1.1"]),
]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

foreach ($data["results"] as $r) {
    echo $r["ip"], $r["found"] ? " BLOCKED" : " clean", PHP_EOL;
}

Go

body, _ := json.Marshal([]string{"8.8.8.8", "1.1.1.1"})

resp, err := http.Post(
    "https://ipguardian.net/api/check",
    "application/json",
    bytes.NewReader(body),
)
if err != nil {
    log.Fatal(err)
}
defer resp.Body.Close()

Checking a log file

Extract unique addresses from an nginx access log and check them in batches of 100:

awk '{print $1}' access.log | sort -u | head -100 \
  | jq -R . | jq -s . \
  | curl -X POST https://ipguardian.net/api/check \
      -H "Content-Type: application/json" --data-binary @- \
  | jq '.results[] | select(.found) | {ip, source: .sources[0].filename}'

Where the data comes from

The database aggregates 160+ curated public blocklists, rebuilt from source every day. Contributors include FireHOL, Spamhaus, Emerging Threats, DShield, TorProject, StopForumSpam, Project Honey Pot and others.

Category	What it covers
anonymizers	Tor exit nodes, open SOCKS and SSL proxies, anonymising networks
abuse	Addresses reported for abuse: forum spam, comment spam, form abuse
attacks	Sources of brute force, scanning and exploitation attempts
spam	Known email and comment spam sources
malware	Command-and-control servers and malware distribution hosts
reputation	General low-reputation address ranges
unroutable	Bogons and reserved ranges that should never appear on the internet

Live figures are on the statistics page.

Frequently asked questions

Do I need an API key?

No. There is no registration and no key. Send a request and you get an answer.

Is it really free?

Yes, within the limits above.

How often is the data updated?

Every source list is re-fetched and rebuilt once a day.

Does a match mean the address is malicious?

Not necessarily. It means the address appears in at least one public list, and the category tells you why. An address listed under anonymizers is running a proxy or Tor node — that is not the same as one listed under attacks. Weigh the category and the number of matching sources before you block anything.

Can I check IPv6?

Yes. Both IPv4 and IPv6 addresses are accepted.

Are the addresses I check stored?

No. The addresses submitted for checking are not written to logs — only the number of addresses per request is recorded. See the privacy policy.