POST/api/v1/phishing/blacklist

IP Blacklist Check

Check one or more IP addresses against five major DNS-based blacklists (DNSBL) to determine if they are listed as sources of spam, malware, or other abuse.

Try this endpoint in the playground →

Credits

Flat rate, regardless of IP count

Max IPs

Per request

Plans

All

Free, Starter, Professional, Enterprise

Blacklists Checked

Provider	DNSBL Zone
Spamhaus ZEN	zen.spamhaus.org
SpamCop	bl.spamcop.net
Barracuda	b.barracudacentral.org
SORBS	dnsbl.sorbs.net
UCEPROTECT Level 1	dnsbl-1.uceprotect.net

Private IPs are skipped. If you pass RFC 1918 addresses (e.g. 10.0.0.1, 192.168.1.1), they are not checked against any blacklist. They still appear in the results with skipped: true and a reason field.

Credits are deducted once per request, not per IP. Sending 1 IP or 20 IPs costs the same 1 credit.

Request Body

Field	Type	Required	Description
ips	string[]	Yes	Array of IPv4 addresses to check (max 20)

Code Examples

cURL

curl -X POST https://api.dfir-lab.ch/v1/phishing/blacklist \
  -H "Authorization: Bearer sk-dfir-your-key-here" \
  -H "Content-Type: application/json" \
  -d '{
    "ips": ["185.220.101.34", "91.243.44.11", "10.0.0.1"]
  }'

Python

import requests

response = requests.post(
    "https://api.dfir-lab.ch/v1/phishing/blacklist",
    headers={
        "Authorization": "Bearer sk-dfir-your-key-here",
        "Content-Type": "application/json",
    },
    json={
        "ips": ["185.220.101.34", "91.243.44.11", "10.0.0.1"]
    },
)

data = response.json()
for ip, result in data["data"]["results"].items():
    if result.get("skipped"):
        print(f"⊘ {ip} skipped: {result['reason']}")
    elif result["listed"]:
        rbls = [l["rbl"] for l in result["listings"]]
        print(f"⚠ {ip} listed on: {', '.join(rbls)}")
    else:
        print(f"✓ {ip} is clean")

Example Response

{
  "data": {
    "results": {
      "185.220.101.34": {
        "ip": "185.220.101.34",
        "listed": true,
        "listings": [
          { "rbl": "Spamhaus ZEN", "result": "127.0.0.2" },
          { "rbl": "SpamCop", "result": "127.0.0.2" },
          { "rbl": "SORBS", "result": "127.0.0.6" }
        ],
        "skipped": false
      },
      "91.243.44.11": {
        "ip": "91.243.44.11",
        "listed": false,
        "listings": [],
        "skipped": false
      },
      "10.0.0.1": {
        "ip": "10.0.0.1",
        "listed": false,
        "listings": [],
        "skipped": true,
        "reason": "private/reserved IP"
      }
    },
    "summary": {
      "total": 3,
      "checked": 2,
      "skipped": 1,
      "listed": 1
    }
  },
  "meta": {
    "request_id": "req_abc123",
    "credits_used": 1,
    "credits_remaining": 487,
    "processing_time_ms": 1823
  }
}