Blocklist Check
Check any IPv4 address against fifteen curated threat feeds at once. Results are grouped into attack, mail abuse, botnet C2, anonymizer and hijacked-range categories with a confirmation count.
What this checks
One address is matched against fifteen curated threat feeds in a single request. Instead of listing which feed produced which hit, results are grouped into categories with a confirmation count, so you can see at a glance whether one feed is an outlier or several agree.
- Attack: hosts reported for brute-force, scanning or exploit attempts.
- Mail abuse: hosts reported for spam or attacks against mail servers.
- Compromised host: machines known to be under third-party control.
- Botnet C2: active command-and-control infrastructure. A single hit here is a strong signal.
- Anonymizer: exit nodes of public anonymity networks.
- Hijacked or bogon range: networks that should never originate legitimate traffic.
- NetSight Honeypot: addresses seen attacking our own sensors.
Why confirmations matter
Threat feeds disagree. A residential address that got flagged once after a malware infection can sit in one feed for weeks after the machine was cleaned, while a genuinely hostile host usually appears in several at once.
The confirmation count is the number of independent feeds that agree within a category. Treat a single confirmation as a reason to look closer, and several as a reason to act.
How it stays fast
The feeds are not queried per request. They are merged every six hours into a single sorted index of addresses and network ranges, which the lookup searches directly. A check therefore costs one binary search rather than fifteen downloads, and the answer does not depend on whether an upstream feed is reachable at that moment.
The result reports how long ago the index was rebuilt, so you can judge how current the answer is.
When it's useful
- Checking whether your own mail server's address has landed on an abuse list and is causing delivery failures.
- Triaging an address from server logs before writing a firewall rule.
- Deciding whether a login came from an anonymity network.
- Verifying that a new hosting IP is clean before putting a service on it.