NetSight beta

Blocklist Check

Check any IPv4 address against fifteen curated threat feeds at once. Results are grouped into attack, mail abuse, botnet C2, anonymizer and hijacked-range categories with a confirmation count.

What this checks

One address is matched against fifteen curated threat feeds in a single request. Instead of listing which feed produced which hit, results are grouped into categories with a confirmation count, so you can see at a glance whether one feed is an outlier or several agree.

  • Attack: hosts reported for brute-force, scanning or exploit attempts.
  • Mail abuse: hosts reported for spam or attacks against mail servers.
  • Compromised host: machines known to be under third-party control.
  • Botnet C2: active command-and-control infrastructure. A single hit here is a strong signal.
  • Anonymizer: exit nodes of public anonymity networks.
  • Hijacked or bogon range: networks that should never originate legitimate traffic.
  • NetSight Honeypot: addresses seen attacking our own sensors.

Why confirmations matter

Threat feeds disagree. A residential address that got flagged once after a malware infection can sit in one feed for weeks after the machine was cleaned, while a genuinely hostile host usually appears in several at once.

The confirmation count is the number of independent feeds that agree within a category. Treat a single confirmation as a reason to look closer, and several as a reason to act.

How it stays fast

The feeds are not queried per request. They are merged every six hours into a single sorted index of addresses and network ranges, which the lookup searches directly. A check therefore costs one binary search rather than fifteen downloads, and the answer does not depend on whether an upstream feed is reachable at that moment.

The result reports how long ago the index was rebuilt, so you can judge how current the answer is.

When it's useful

  • Checking whether your own mail server's address has landed on an abuse list and is causing delivery failures.
  • Triaging an address from server logs before writing a firewall rule.
  • Deciding whether a login came from an anonymity network.
  • Verifying that a new hosting IP is clean before putting a service on it.

Questions

My address is listed. How do I get removed?
Removal is handled by whichever feed listed it, not by NetSight. Most feeds delist automatically once the reports stop, typically within 24 to 48 hours. First find and fix the cause: an infected machine, an open relay or a compromised account. Delisting without fixing the source only restarts the clock.
Does a single hit mean the address is dangerous?
Not necessarily. Feeds vary in how aggressively they list and how quickly they expire entries. One confirmation in the attack category is common for dynamic residential addresses that were briefly misused by a previous holder. Several confirmations across categories is a much stronger signal.
Why is my home address listed as an anonymizer?
Public anonymity networks run exit nodes on ordinary connections. If your provider reassigned an address that recently hosted one, it can still be in the feed. These entries expire, usually within a few days.
Does this check IPv6?
Not yet. The feeds this tool merges publish IPv4 addresses and ranges. An IPv6 address returns an error rather than a misleading clean result.
How current are the results?
The merged index is rebuilt every six hours, and each result reports its own age. The live DNSBL portion is queried per address and cached for one hour.
Can I use this from a script?
Yes. The same data is available at /api/blocklists?ip=. See the API reference for rate limits.