IP Abuse Check — Is This IP Reported for Abuse?
Abuse, attack, spam, malware and scanner lists, plus our own flags. Instant, from our data.
Is this IP abusive? Our abuse IP lookup checks any IPv4 or IPv6 address against the attack, abuse, malware, spam and scanner lists among our 60+ downloaded blocklists — with the matched network and a delisting link for every listing — together with our own bot, proxy, VPN, Tor and datacenter flags and the 0–100 reputation score. One instant answer from data we hold: no third-party queries, and no crowd-sourced reports.
—
—
—
Check a list of IPs at once
Paste up to 100 addresses: each row shows our flags for the address, and one click opens its full abuse check with the lists.
One per line or comma-separated. Lines that are not addresses are listed, not silently dropped.
| IP address | Our flags | Network | Lists |
|---|
POST /api/v1/ip/batch; the lists come from GET /api/v1/ip/abuse/{ip} per address.
What the IP Abuse Check Covers
"Reported" here means a public abuse-related blocklist names the address, or our own data flags it. ip-api.io does not collect crowd-sourced abuse reports: this is a check of public lists and our intelligence data, not a report database. Everything is answered from data we hold, so no blocklist operator ever sees the IPs you look up.
Five abuse-related list groups
Attack and brute-force reporters, abuse reputation feeds, malware and botnet trackers, forum and comment spam lists, and internet-wide scanners — the groups among our 60+ downloaded blocklists that mean abusive behaviour. Each listing shows the matched network and a delisting link. Mail and anonymizer listings are counted separately.
Our own flags
Verified bot or crawler (with the operator when it publishes its ranges), proxy, VPN, Tor exit, datacenter and threat-feed membership — what the address is, next to what others reported about it.
The reputation score
The same 0–100 score the IP reputation check computes, so this page and that page always agree: Tor, proxy and threat membership weigh most, VPN and datacenter less, and a verified good bot takes the datacenter penalty back.
IP Abuse Check API
One call returns what this page shows: the abuse-related listings with matched network and delisting link, our flags with the bot operator, the network and the 0–100 reputation score with its level.
GET /api/v1/ip/abuse/{ip}?api_key={key}
# IP abuse check: listings, flags and score in one call
curl "https://ip-api.io/api/v1/ip/abuse/1.52.202.7?api_key=YOUR_API_KEY"
{
"ip": "1.52.202.7",
"is_public": true,
"state": "reported",
"listed_count": 1,
"other_listings": 1,
"checked_count": 64,
"total_lists": 64,
"listings": [
{
"id": "blocklist-de-ssh",
"name": "blocklist.de — SSH",
"group": "attack",
"scope": "ip",
"matched_network": "1.52.202.7/32",
"updated_at": "2026-11-04T06:00:03Z",
"homepage": "https://www.blocklist.de/",
"delist_url": "https://www.blocklist.de/en/delist.html"
}
],
"flags": {
"is_bot": false,
"bot_name": null,
"is_proxy": false,
"is_vpn": false,
"is_tor": false,
"is_datacenter": false,
"is_threat": true
},
"network": {
"asn": "AS7552",
"organisation": "Viettel Group"
},
"reputation_score": 25,
"reputation_level": "LOW",
"data_as_of": "2026-11-04T06:00:03Z"
}
GET /api/v1/ip/abuse/{ip}?api_key={key}
async function abuseCheck(ip) {
const res = await fetch(
`https://ip-api.io/api/v1/ip/abuse/${ip}?api_key=YOUR_API_KEY`
);
const data = await res.json();
console.log(data.state, data.listed_count); // reported 1
return data;
}
{
"ip": "1.52.202.7",
"is_public": true,
"state": "reported",
"listed_count": 1,
"other_listings": 1,
"checked_count": 64,
"total_lists": 64,
"listings": [
{
"id": "blocklist-de-ssh",
"name": "blocklist.de — SSH",
"group": "attack",
"scope": "ip",
"matched_network": "1.52.202.7/32",
"updated_at": "2026-11-04T06:00:03Z",
"homepage": "https://www.blocklist.de/",
"delist_url": "https://www.blocklist.de/en/delist.html"
}
],
"flags": {
"is_bot": false,
"bot_name": null,
"is_proxy": false,
"is_vpn": false,
"is_tor": false,
"is_datacenter": false,
"is_threat": true
},
"network": {
"asn": "AS7552",
"organisation": "Viettel Group"
},
"reputation_score": 25,
"reputation_level": "LOW",
"data_as_of": "2026-11-04T06:00:03Z"
}
GET /api/v1/ip/abuse/{ip}?api_key={key}
import requests
res = requests.get(
"https://ip-api.io/api/v1/ip/abuse/1.52.202.7",
params={"api_key": "YOUR_API_KEY"}
)
data = res.json()
for l in data["listings"]:
print(l["name"], l["matched_network"], l["delist_url"])
{
"ip": "1.52.202.7",
"is_public": true,
"state": "reported",
"listed_count": 1,
"other_listings": 1,
"checked_count": 64,
"total_lists": 64,
"listings": [
{
"id": "blocklist-de-ssh",
"name": "blocklist.de — SSH",
"group": "attack",
"scope": "ip",
"matched_network": "1.52.202.7/32",
"updated_at": "2026-11-04T06:00:03Z",
"homepage": "https://www.blocklist.de/",
"delist_url": "https://www.blocklist.de/en/delist.html"
}
],
"flags": {
"is_bot": false,
"bot_name": null,
"is_proxy": false,
"is_vpn": false,
"is_tor": false,
"is_datacenter": false,
"is_threat": true
},
"network": {
"asn": "AS7552",
"organisation": "Viettel Group"
},
"reputation_score": 25,
"reputation_level": "LOW",
"data_as_of": "2026-11-04T06:00:03Z"
}
GET /api/v1/ip/abuse/{ip}?api_key={key}
$data = json_decode(file_get_contents(
"https://ip-api.io/api/v1/ip/abuse/1.52.202.7?api_key=YOUR_API_KEY"
));
echo $data->state, " ", $data->reputation_score; // reported 25
{
"ip": "1.52.202.7",
"is_public": true,
"state": "reported",
"listed_count": 1,
"other_listings": 1,
"checked_count": 64,
"total_lists": 64,
"listings": [
{
"id": "blocklist-de-ssh",
"name": "blocklist.de — SSH",
"group": "attack",
"scope": "ip",
"matched_network": "1.52.202.7/32",
"updated_at": "2026-11-04T06:00:03Z",
"homepage": "https://www.blocklist.de/",
"delist_url": "https://www.blocklist.de/en/delist.html"
}
],
"flags": {
"is_bot": false,
"bot_name": null,
"is_proxy": false,
"is_vpn": false,
"is_tor": false,
"is_datacenter": false,
"is_threat": true
},
"network": {
"asn": "AS7552",
"organisation": "Viettel Group"
},
"reputation_score": 25,
"reputation_level": "LOW",
"data_as_of": "2026-11-04T06:00:03Z"
}
When to Run an IP Abuse Check
Log and alert triage
An unfamiliar address in the SSH log, the firewall or the SIEM: paste it and see in one screen whether brute-force reporters, scanner lists or malware trackers already name it, and whether it is a datacenter, proxy or Tor address. Enrich the alert instead of guessing.
Signup and checkout screening
Score a new account or an order by the abuse state and the reputation score of its IP: a reported address on attack and spam lists at once is rarely a legitimate customer, while a verified crawler should never trip a fraud rule.
Your own addresses
Check a freshly assigned server, VPS or mail IP before you put it to work — recycled cloud addresses often arrive already reported — and watch it afterwards with the API so a new listing is caught before customers notice.
IP Abuse Check — FAQs
What is an IP abuse check?
An IP abuse check tells you whether an address has been reported for abusive behaviour: brute-force attacks, scanning, spam, malware hosting or botnet traffic. This page answers it from public blocklists in the attack, abuse, malware, spam and scanner groups, plus ip-api.io's own bot, proxy, VPN, Tor and datacenter flags and the 0–100 reputation score — instantly, from data we hold.
What does "reported" mean here, and what does it not mean?
"Reported" means at least one public abuse-related blocklist names the address (we show which, the matched network and when the list last updated). It does not mean a person filed a complaint about it: ip-api.io does not collect crowd-sourced abuse reports, and this check is not a report database. If you need to see or file user reports, that is a different kind of service.
Which lists does the abuse check cover?
The attack, abuse, malware, spam and scanner groups of our %{n} downloaded blocklists: honeypot and brute-force reporters (blocklist.de, CINS Army, GreenSnow, DataPlane and others), abuse reputation feeds (AbuseIPDB's published list, Emerging Threats, AlienVault and others), malware and botnet trackers (Feodo Tracker, ThreatFox and others), forum and comment spam lists (StopForumSpam, CleanTalk, Project Honey Pot) and internet-wide scanners. Mail blocklists and Tor/proxy lists are counted separately as "other listings" — the IP blacklist check shows them in full.
What are the flags next to the listings?
Our own intelligence data for the address: a verified bot or crawler (with its operator, such as Google or OpenAI, when the operator publishes its ranges), proxy, VPN, Tor exit, datacenter and threat-feed membership. A listing says what others reported; the flags say what the address is.
How is the reputation score computed?
It is the same 0–100 score the IP reputation check returns: Tor, proxy and threat-feed membership weigh most, VPN and datacenter less, and a verified good bot takes the datacenter penalty back. 0–19 reads clean, 20–59 some signals, 60–79 risky, 80–100 abusive.
My IP is reported — what can I do?
Find the cause first: a compromised device, an open relay or a misconfigured service on your network usually explains a listing. Fix it, then use the delisting link next to each list; many lists remove an address automatically once the abuse stops. A listing on a provider-wide (ASN) list has to be resolved by your hosting provider.
Does it support IPv6 and bulk checks?
Yes. The single-IP check accepts IPv4 and IPv6; the bulk box takes up to 100 addresses per run and shows our flags for each (the per-list detail is one click away per row), with a CSV download.
Is there an API for the IP abuse check?
Yes: GET /api/v1/ip/abuse/{ip} returns the same answer as this page — the abuse-related listings with matched network and delisting link, the flags, the network and the reputation score — in one call, metered like an IP lookup. It is also available as the ip_abuse_check tool of our MCP server.
Simple, transparent pricing
Start small, scale as you grow. No hidden fees.
Is this IP reported? One call answers
Attack, abuse, malware, spam and scanner listings with the matched network and delisting link, our bot, proxy, VPN, Tor and datacenter flags, and the 0–100 reputation score — one endpoint for log triage, signup screening and monitoring your own addresses.