2026-09-05

IP lookups check the Spamhaus and abuse.ch threat blocklists

is_blocklisted and blocklist flag netblocks on Spamhaus DROP, operators on Spamhaus ASN-DROP and active botnet C2 servers from abuse.ch, worth 80 risk points.

POST /api/v1/ip now consults three public threat blocklists: Spamhaus DROP (netblocks hijacked or leased by spam and cybercrime operations, IPv4 and IPv6), Spamhaus ASN-DROP (the network operators behind them, matched by the address's ASN) and abuse.ch's Feodo Tracker list of active botnet C2 servers. is_blocklisted is the tri-state flag and blocklist names the list.
A blocklisted address adds 80 to risk_score, between unallocated space (100) and Tor (70). risk_signals carries it as blocklist with the dataset threat-blocklists, which also appears in sources with its sync date.
The lists are compiled locally like every other feed, so nothing about the lookup leaves the server. ASN-DROP can only answer once the ASN database resolves the address, so is_blocklisted stays null rather than false when neither a range list nor the ASN could be checked.
Bulk result files carry is_blocklisted and blocklist after hosting_provider; the connectors and the Node types know the two fields.
The Spamhaus lists sync daily with the other feeds; the botnet C2 list refreshes hourly.

markdown version: /changelog/2026-09-05-ip-threat-blocklists.md · atom feed: /changelog.atom

All releases