What is the IPWhois Blacklist?

The IPWhois Blacklist is a free, community-driven IP threat intelligence database. It tracks IP addresses involved in brute-force attacks, spam, DDoS, port scanning, phishing and malware distribution. Anyone can check an IP or report malicious activity.

How do I check if an IP is blacklisted?

Enter the IP address in the search bar on bl.ipwhois.net or use the free API: GET https://bl.ipwhois.net/api/check?ip=1.2.3.4. The response includes threat type, confidence score and report history.

How do I report a malicious IP?

Click Report IP in the sidebar, enter the IP address, select the threat type (brute-force, spam, DDoS, scanning, phishing, malware or other), optionally add details, solve the verification challenge and submit. Registered IPWhois.net users can skip the verification.

Is the IPWhois Blacklist API free?

Yes. The public API allows 500 free lookups per day per IP address. For higher limits, API keys are available through api.ipwhois.net.

How many IPs are in the blacklist?

The IPWhois Blacklist currently contains 186,821 listed IP addresses with 8,312 total reports from community submissions and automated threat feeds.

IPWhois Blacklist | Community Threat Intelligence

IPWhois Blacklist

Community-driven IP threat intelligence. Search, check, and report malicious IP addresses.

186,821 IPs 8,312 reports Free API

Listed IPs (186,821) Page 1/9342

IP	Threat	Conf.	Reports	Last Seen
60.167.166.161	Brute-force	48%	2	May 21, 14:17
92.118.39.62	Brute-force	85%	5	May 21, 14:14
165.154.6.138	Brute-force	85%	2	May 21, 14:12
60.205.246.25	Brute-force	48%	2	May 21, 14:01
92.118.39.63	Brute-force	85%	5	May 21, 14:00
193.32.162.151	Brute-force	85%	6	May 21, 13:50
8.211.145.144	Brute-force	48%	2	May 21, 13:39
211.90.243.137	Brute-force	25%	1	May 21, 13:36
45.154.244.2	Brute-force	85%	1	May 21, 13:29
211.72.129.212	Brute-force	48%	2	May 21, 13:23
36.104.144.114	Brute-force	48%	2	May 21, 13:12
118.163.132.211	Brute-force	48%	2	May 21, 13:12
118.163.132.212	Brute-force	48%	2	May 21, 13:08
103.179.27.94	Brute-force	61%	3	May 21, 12:59
203.23.199.88	Brute-force	61%	3	May 21, 12:58
203.155.253.244	Brute-force	85%	2	May 21, 12:45
58.98.197.137	Brute-force	85%	3	May 21, 12:42
195.178.110.30	Brute-force	85%	6	May 21, 12:37
156.227.233.77	Brute-force	85%	2	May 21, 12:35
203.192.227.203	Brute-force	25%	1	May 21, 12:28

Type	Count
Attack	86,566
Brute-force	46,754
Scan	42,365
Multi-source	11,121
Malware	7
Compromised	4
Bot	2
Other	1
Spam	1

Source	Count
Blocklist.de	118,689
Ci-army	42,365
Ipsum-l3	11,121
Greensnow	8,649
Multiple	3,601
Honeypot	2,071
Fail2ban	266
Community	26
Bruteforceblocker	18
Fail2ban-live	6
Feodo-abuse.ch	5
Emergingthreats	4

Your API Key

API Reference

Base URL: https://bl.ipwhois.net/api · Free tier: 500 requests/day · JSON responses · Rate limit headers: X-RateLimit-Limit X-RateLimit-Remaining

GET Check IP

Check if an IP address is listed in the blacklist.

https://bl.ipwhois.net/api/check?ip=185.220.101.34

Parameters:

ip	IP address to check (IPv4 or IPv6) required

Response (listed):

{
  "ip": "185.220.101.34",
  "listed": true,
  "threat_type": "brute-force",
  "confidence": 95,
  "total_reports": 12,
  "first_seen": "2026-01-15 08:23:11",
  "last_seen": "2026-03-28 14:55:02",
  "source": "fail2ban-live",
  "country": "de",
  "isp": "Hetzner Online GmbH",
  "rate_limit": { "limit": 500, "remaining": 499 }
}

Response (clean):

{
  "ip": "8.8.8.8",
  "listed": false,
  "message": "Not found in IPWhois Blacklist",
  "rate_limit": { "limit": 500, "remaining": 498 }
}

Try it live

POST Report IP

Report a malicious IP address to the blacklist.

https://bl.ipwhois.net/api/report

Parameters (form-data or JSON):

ip	IP address to report required
type	`brute-force` `spam` `ddos` `scan` `phishing` `malware` `bot` `other`
message	Optional description of the incident

Example (cURL):

curl -X POST https://bl.ipwhois.net/api/report \
  -d "ip=185.220.101.34" \
  -d "type=brute-force" \
  -d "message=SSH+brute+force+attack+from+this+IP"

Rate Limits

Tier	Limit	Price
Free	500 requests / day	$0
Pro (coming soon)	10,000 requests / day	TBD
Enterprise (coming soon)	Unlimited	TBD

Rate limit resets daily at midnight UTC. Headers X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset are included in every response.