POST/api/v1/phishing/blacklist

IP Blacklist Check

Check one or more IP addresses against five major DNS-based blacklists (DNSBL) to determine if they are listed as sources of spam, malware, or other abuse.

Credits

1

Flat rate, regardless of IP count

Max IPs

20

Per request

Plans

All

Free, Starter, Professional, Enterprise

Blacklists Checked

ProviderDNSBL Zone
Spamhaus SBL/XBLzen.spamhaus.org
SpamCopbl.spamcop.net
Barracudab.barracudacentral.org
SORBSdnsbl.sorbs.net
UCEPROTECT Level 1dnsbl-1.uceprotect.net

Private IPs are skipped. If you pass RFC 1918 addresses (e.g. 10.0.0.1, 192.168.1.1), they are automatically excluded from the check and will not appear in the results.

Credits are deducted once per request, not per IP. Sending 1 IP or 20 IPs costs the same 1 credit.

Request Body

FieldTypeRequiredDescription
ipsstring[]YesArray of IPv4 addresses to check (max 20)

Code Examples

cURL

curl -X POST https://dfir-lab.ch/api/v1/phishing/blacklist \
  -H "Authorization: Bearer sk-dfir-your-key-here" \
  -H "Content-Type: application/json" \
  -d '{
    "ips": ["185.220.101.34", "91.243.44.11", "8.8.8.8"]
  }'

Python

import requests

response = requests.post(
    "https://dfir-lab.ch/api/v1/phishing/blacklist",
    headers={
        "Authorization": "Bearer sk-dfir-your-key-here",
        "Content-Type": "application/json",
    },
    json={
        "ips": ["185.220.101.34", "91.243.44.11", "8.8.8.8"]
    },
)

data = response.json()
for ip_result in data["results"]:
    if ip_result["listed"]:
        print(f"⚠ {ip_result['ip']} listed on: {ip_result['blacklists']}")
    else:
        print(f"✓ {ip_result['ip']} is clean")

Example Response

{
  "success": true,
  "results": [
    {
      "ip": "185.220.101.34",
      "listed": true,
      "blacklists": [
        {
          "provider": "Spamhaus SBL/XBL",
          "zone": "zen.spamhaus.org",
          "listed": true,
          "return_code": "127.0.0.2"
        },
        {
          "provider": "SpamCop",
          "zone": "bl.spamcop.net",
          "listed": true,
          "return_code": "127.0.0.2"
        },
        {
          "provider": "Barracuda",
          "zone": "b.barracudacentral.org",
          "listed": false,
          "return_code": null
        },
        {
          "provider": "SORBS",
          "zone": "dnsbl.sorbs.net",
          "listed": true,
          "return_code": "127.0.0.6"
        },
        {
          "provider": "UCEPROTECT Level 1",
          "zone": "dnsbl-1.uceprotect.net",
          "listed": false,
          "return_code": null
        }
      ]
    },
    {
      "ip": "91.243.44.11",
      "listed": false,
      "blacklists": [
        {
          "provider": "Spamhaus SBL/XBL",
          "zone": "zen.spamhaus.org",
          "listed": false,
          "return_code": null
        },
        {
          "provider": "SpamCop",
          "zone": "bl.spamcop.net",
          "listed": false,
          "return_code": null
        },
        {
          "provider": "Barracuda",
          "zone": "b.barracudacentral.org",
          "listed": false,
          "return_code": null
        },
        {
          "provider": "SORBS",
          "zone": "dnsbl.sorbs.net",
          "listed": false,
          "return_code": null
        },
        {
          "provider": "UCEPROTECT Level 1",
          "zone": "dnsbl-1.uceprotect.net",
          "listed": false,
          "return_code": null
        }
      ]
    },
    {
      "ip": "8.8.8.8",
      "listed": false,
      "blacklists": [
        {
          "provider": "Spamhaus SBL/XBL",
          "zone": "zen.spamhaus.org",
          "listed": false,
          "return_code": null
        },
        {
          "provider": "SpamCop",
          "zone": "bl.spamcop.net",
          "listed": false,
          "return_code": null
        },
        {
          "provider": "Barracuda",
          "zone": "b.barracudacentral.org",
          "listed": false,
          "return_code": null
        },
        {
          "provider": "SORBS",
          "zone": "dnsbl.sorbs.net",
          "listed": false,
          "return_code": null
        },
        {
          "provider": "UCEPROTECT Level 1",
          "zone": "dnsbl-1.uceprotect.net",
          "listed": false,
          "return_code": null
        }
      ]
    }
  ],
  "summary": {
    "total_ips": 3,
    "listed_count": 1,
    "clean_count": 2,
    "skipped_private": 0
  },
  "credits_used": 1,
  "credits_remaining": 487
}