Skip to main content
POST
Compare every source
The companion to Check an IP address, not a cheaper version of it. That endpoint asks three vendors and returns one verdict. This one shows what each source says and leaves the judgement to you. Free, and free structurally. The published blocklists are held locally, so consulting them is a database lookup rather than a request. The paid vendors are not called at all — their rows appear only when a recent check on the same address is still cached, which is what cached_check reports. Nothing is charged and no free allowance is spent.

Do not compare the vendors’ numbers directly

Each vendor row carries score_metric, risk_metric and score_derived, and they exist because the columns invite a comparison the numbers cannot support:
  • score is a measurement for some vendors and a band midpoint for others. When score_derived is true, that vendor published no number of its own and ours is arithmetic, not their finding.
  • risk is not the same question twice. One vendor reports a risk level; another reports how frequently the address is seen abusing. A high score beside a low wording is those two fields answering different questions, not a vendor contradicting itself.

Body

string
required
A public IPv4 or IPv6 address. Private and reserved ranges are refused.

Response

object[]
Every published list held locally, whether or not it contains the address: source, label, claim, listed, network, attribution and synced_at.Silent sources are included on purpose — a table of hits alone cannot be told apart from one whose corpus never loaded. Check synced_at before trusting a listed: false: null means that list has never loaded here.claim says what membership would mean, and the three are not interchangeable. blocklist is a publisher saying not to route the address, and it is the only one that decides a verdict. recent_abuse is a honeypot report from the last couple of days, which ordinary residential addresses pass through routinely. tor_exit describes what the address is, not what it did.network is the matching range rather than the address you asked about — a /20 listing and a single-host listing are different claims.
object | null
The vendors’ rows from a recent check on this address, reused for free: vendors (same shape as in Check an IP address), verdict and risk_score.null means no vendor was asked — not that every vendor was unreachable. This endpoint never calls one.

Errors

Example

Response