64 blocklists. One instant, local lookup. No third-party queries.
Is your IP blacklisted? Check any IPv4 or IPv6 address against 64 downloaded blocklists — mail DNSBLs, attack and brute-force reports, abuse reputation feeds, malware trackers, Tor exits and open proxies — in milliseconds, with the exact listed network and a delisting link for every match. The three query-only operators (Spamhaus ZEN, SpamCop, Barracuda) are one click from the result.
Not downloadable, so not in the 60+: one click checks each operator's own list for this IP.
Other lookups: Microsoft Outlook.com ↗ Cisco Talos ↗ Abusix Mail Intelligence ↗
Most IP blacklist checkers fire live DNS queries at a few dozen DNSBLs and wait for the slowest one. We download every list in full and check it locally, so the answer is instant and no blocklist operator ever sees the IPs you look up. The three operators that publish no data — Spamhaus ZEN, SpamCop and Barracuda — are one click from the result, with the IP pre-filled.
Each blocklist is fetched on its own schedule — every 15 minutes to 24 hours, as often as its operator updates it — validated, and built into one database. A list whose download fails keeps its last good copy and is marked stale instead of silently looking clean.
A listing tells you more than yes or no: whether your single address is listed, a netblock around it, or the whole provider network (ASN-scope lists like UCEPROTECT Level 3 and Spamhaus ASN-DROP). That decides whether you can fix it yourself or need your hosting provider.
Because the lists are local, a check takes milliseconds, and no blocklist operator ever sees the IPs you look up. The same data powers the IP blacklist API, so your monitoring and this page always agree.
No single blacklist sees everything, so one check combines mail DNSBLs, attack reporters, abuse and malware feeds, web-spam lists and anonymizer lists. Figures are from the current data.
DNS blocklists of spam sources, backscatter senders and mail-server attackers, used by mail servers to reject or score incoming mail.
Addresses reported for comment, registration and contact-form spam on forums and websites.
Honeypot and intrusion reports of SSH, web, mail and VoIP brute force and scanning.
Aggregated abuse reputation plus hijacked and leased netblocks that should never originate traffic.
Botnet command-and-control servers and hosts that distribute malware.
Tor exit relays and public open proxies — not abuse by themselves, but blocked by many services.
Research and commercial internet-wide scanners.
One call checks an IP against every list and tells you which ones list it, which network matched, and where to request removal. Use it to monitor your mail servers, screen signups, or enrich security alerts.
GET /api/v1/ip/blacklist/{ip}?api_key={key}
# IP blacklist check (listed lists only)
curl "https://ip-api.io/api/v1/ip/blacklist/1.52.202.7?listed_only=true&api_key=YOUR_API_KEY"
{
"ip": "1.52.202.7",
"is_listed": true,
"listed_count": 2,
"checked_count": 64,
"listed_groups": ["mail"],
"data_as_of": "2026-10-22T08:00:03Z",
"lists": [
{
"id": "uceprotect-level-2",
"group": "mail",
"scope": "network",
"is_listed": true,
"matched_network": "1.52.202.0/24",
"delist_url": "https://www.uceprotect.net/en/rblcheck.php"
},
…
]
}
GET /api/v1/ip/blacklist/{ip}?api_key={key}
async function checkBlacklists(ip) {
const res = await fetch(
`https://ip-api.io/api/v1/ip/blacklist/${ip}?listed_only=true&api_key=YOUR_API_KEY`
);
const data = await res.json();
console.log(data.listed_count); // 2
console.log(data.lists.map(l => l.matched_network)); // ["1.52.202.0/24", …]
return data;
}
{
"ip": "1.52.202.7",
"is_listed": true,
"listed_count": 2,
"checked_count": 64,
"listed_groups": ["mail"],
"data_as_of": "2026-10-22T08:00:03Z",
"lists": [
{
"id": "uceprotect-level-2",
"group": "mail",
"scope": "network",
"is_listed": true,
"matched_network": "1.52.202.0/24",
"delist_url": "https://www.uceprotect.net/en/rblcheck.php"
},
…
]
}
GET /api/v1/ip/blacklist/{ip}?api_key={key}
import requests
res = requests.get(
"https://ip-api.io/api/v1/ip/blacklist/1.52.202.7",
params={"listed_only": "true", "api_key": "YOUR_API_KEY"}
)
data = res.json()
for l in data["lists"]:
print(l["name"], l["matched_network"], l["delist_url"])
{
"ip": "1.52.202.7",
"is_listed": true,
"listed_count": 2,
"checked_count": 64,
"listed_groups": ["mail"],
"data_as_of": "2026-10-22T08:00:03Z",
"lists": [
{
"id": "uceprotect-level-2",
"group": "mail",
"scope": "network",
"is_listed": true,
"matched_network": "1.52.202.0/24",
"delist_url": "https://www.uceprotect.net/en/rblcheck.php"
},
…
]
}
Bounces with “listed in” or “blocked using” in the error mean a blocklist names your mail server. Run the blacklist check on the mail server's IP here, fix the cause, and request removal from each list — then add the API to your monitoring so the next listing is caught before customers notice.
An IP on attack, spam and abuse lists at the same time is rarely a legitimate customer. Score signups, logins and checkouts by how many lists name the IP and which groups they belong to — a Tor exit is a policy decision, a botnet C2 host is not.
Enrich firewall and SIEM alerts with the lists an attacker IP appears on, and check a freshly assigned server or VPS IP before you send mail from it — recycled cloud addresses often arrive already listed.
An IP blacklist check looks up an IP address on public blocklists (also called blacklists, DNSBLs or RBLs) — lists of addresses that sent spam, attacked servers, hosted malware or act as anonymizers. Mail servers, firewalls and fraud systems use these lists to block or score traffic, so a listing can explain bounced email, blocked logins or CAPTCHAs.
Mostly. A DNSBL (DNS-based blocklist) or RBL (real-time blackhole list) check sends a DNS query for one IP to each list's zone and waits for every answer. This IP blacklist lookup checks the same data — a downloaded copy of each list that publishes one — plus lists that have no DNS zone at all, such as attack reporters and malware trackers. The result is the same yes-or-no per list, with the matched network added, in milliseconds instead of a round of DNS queries.
It checks 64 blocklists in seven groups: mail blocklists (DNSBLs) that publish their data, web and forum spam lists, attack and brute-force reporters, abuse reputation feeds and hijacked netblocks, malware and botnet C2 trackers, Tor exit relays and open proxies, and internet-wide scanners. The coverage section on this page shows how many lists and listed networks each group holds. A check names every list that lists your IP, with a delisting link for each.
Spamhaus DROP and ASN-DROP are part of the 64 lists. Spamhaus ZEN (SBL, XBL, PBL, CSS), SpamCop and Barracuda publish no data and only answer per-IP queries, so this page never sends your IP to them: the result shows them as query-only lists, and one click opens the operator's own lookup for the IP you checked.
Common causes: a compromised device or website on your network sending spam or attacking other servers, a misconfigured mail server (open relay, backscatter bounces), a shared or dynamic IP previously used by someone else, a VPN or proxy exit, or a hosting network with a bad reputation. The list that names your IP — and its group — usually points to the cause.
Fix the cause first (clean infected machines, close open relays, secure the mail server), then use the delisting link next to each list in the results. Many lists, including UCEPROTECT Level 1, PSBL, blocklist.de and SpamCop, also remove listings automatically once the abuse stops. Network-wide listings such as UCEPROTECT Level 2/3 or Spamhaus ASN-DROP have to be resolved by the hosting provider.
It is the listed network that contains your IP. A /32 (or /128) means your single address is listed; a wider block such as /24 means the list blocks the whole range — often because of other addresses near yours. Lists marked “whole networks (ASN)” list every address of a provider.
Every list is downloaded in full on a schedule — every 15 minutes to 24 hours depending on how often its operator updates it — and checked locally, so results come back in milliseconds and no third party sees the IPs you check. Each list shows when it was last updated.
Yes. GET https://ip-api.io/api/v1/ip/blacklist/{ip} returns every list with is_listed, the matched network and a delisting link; GET /api/v1/ip/blacklist/sources returns the catalog for free. The check on this page is free with no sign-up; API access is included in every paid plan.
They overlap. The blacklist check shows every one of the 64 lists, mail and anonymizer lists included, for deliverability and delisting work. The IP abuse check answers a narrower question — is this address reported for abusive behaviour? — from the attack, abuse, malware, spam and scanner lists plus our own flags and the reputation score, and has an API of its own.
Start small, scale as you grow. No hidden fees.
Mail DNSBLs, attack reports, abuse reputation, malware C2, Tor and proxies — with the matched network and delisting link for every listing. One endpoint for mail-server monitoring, fraud screening and alert enrichment.