What is the IPWhois Blacklist?

The IPWhois Blacklist is a free, community-driven IP threat intelligence database. It tracks IP addresses involved in brute-force attacks, spam, DDoS, port scanning, phishing and malware distribution. Anyone can check an IP or report malicious activity.

How do I check if an IP is blacklisted?

Enter the IP address in the search bar on bl.ipwhois.net or use the free API: GET https://bl.ipwhois.net/api/check?ip=1.2.3.4. The response includes threat type, confidence score and report history.

How do I report a malicious IP?

Click Report IP in the sidebar, enter the IP address, select the threat type (brute-force, spam, DDoS, scanning, phishing, malware or other), optionally add details, solve the verification challenge and submit. Registered IPWhois.net users can skip the verification.

Is the IPWhois Blacklist API free?

Yes. The public API allows 500 free lookups per day per IP address. For higher limits, API keys are available through api.ipwhois.net.

How many IPs are in the blacklist?

The IPWhois Blacklist currently contains 186,823 listed IP addresses with 8,318 total reports from community submissions and automated threat feeds.

IPWhois Blacklist | Community Threat Intelligence

IPWhois Blacklist

Community-driven IP threat intelligence. Search, check, and report malicious IP addresses.

186,823 IPs 8,318 reports Free API

Listed IPs (186,823) Page 1/9342

IP	Threat	Conf.	Reports	Last Seen
58.62.164.101	Brute-force	48%	2	May 21, 15:06
92.118.39.63	Brute-force	85%	5	May 21, 15:04
211.90.243.137	Brute-force	25%	1	May 21, 14:40
45.154.244.2	Brute-force	85%	1	May 21, 14:36
160.250.186.97	Brute-force	48%	2	May 21, 14:23
103.245.249.168	Brute-force	25%	1	May 21, 14:23
103.168.135.187	Brute-force	61%	3	May 21, 14:22
60.167.166.161	Brute-force	48%	2	May 21, 14:17
92.118.39.62	Brute-force	85%	5	May 21, 14:14
165.154.6.138	Brute-force	85%	2	May 21, 14:12
60.205.246.25	Brute-force	48%	2	May 21, 14:01
193.32.162.151	Brute-force	85%	6	May 21, 13:50
8.211.145.144	Brute-force	48%	2	May 21, 13:39
211.72.129.212	Brute-force	48%	2	May 21, 13:23
36.104.144.114	Brute-force	48%	2	May 21, 13:12
118.163.132.211	Brute-force	48%	2	May 21, 13:12
118.163.132.212	Brute-force	48%	2	May 21, 13:08
103.179.27.94	Brute-force	61%	3	May 21, 12:59
203.23.199.88	Brute-force	61%	3	May 21, 12:58
203.155.253.244	Brute-force	85%	2	May 21, 12:45

Type	Count
Attack	86,566
Brute-force	46,756
Scan	42,365
Multi-source	11,121
Malware	7
Compromised	4
Bot	2
Other	1
Spam	1

Source	Count
Blocklist.de	118,688
Ci-army	42,365
Ipsum-l3	11,121
Greensnow	8,649
Multiple	3,603
Honeypot	2,071
Fail2ban	267
Community	26
Bruteforceblocker	18
Fail2ban-live	6
Feodo-abuse.ch	5
Emergingthreats	4

Your API Key

API Reference

Base URL: https://bl.ipwhois.net/api · Free tier: 500 requests/day · JSON responses · Rate limit headers: X-RateLimit-Limit X-RateLimit-Remaining

GET Check IP

Check if an IP address is listed in the blacklist.

https://bl.ipwhois.net/api/check?ip=185.220.101.34

Parameters:

ip	IP address to check (IPv4 or IPv6) required

Response (listed):

{
  "ip": "185.220.101.34",
  "listed": true,
  "threat_type": "brute-force",
  "confidence": 95,
  "total_reports": 12,
  "first_seen": "2026-01-15 08:23:11",
  "last_seen": "2026-03-28 14:55:02",
  "source": "fail2ban-live",
  "country": "de",
  "isp": "Hetzner Online GmbH",
  "rate_limit": { "limit": 500, "remaining": 499 }
}

Response (clean):

{
  "ip": "8.8.8.8",
  "listed": false,
  "message": "Not found in IPWhois Blacklist",
  "rate_limit": { "limit": 500, "remaining": 498 }
}

Try it live

POST Report IP

Report a malicious IP address to the blacklist.

https://bl.ipwhois.net/api/report

Parameters (form-data or JSON):

ip	IP address to report required
type	`brute-force` `spam` `ddos` `scan` `phishing` `malware` `bot` `other`
message	Optional description of the incident

Example (cURL):

curl -X POST https://bl.ipwhois.net/api/report \
  -d "ip=185.220.101.34" \
  -d "type=brute-force" \
  -d "message=SSH+brute+force+attack+from+this+IP"

Rate Limits

Tier	Limit	Price
Free	500 requests / day	$0
Pro (coming soon)	10,000 requests / day	TBD
Enterprise (coming soon)	Unlimited	TBD

Rate limit resets daily at midnight UTC. Headers X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset are included in every response.