# IP lookups check the Spamhaus and abuse.ch threat blocklists

is_blocklisted and blocklist flag netblocks on Spamhaus DROP, operators on Spamhaus ASN-DROP and active botnet C2 servers from abuse.ch, worth 80 risk points.

Date: 2026-09-05

- `POST /api/v1/ip` now consults three public threat blocklists: Spamhaus DROP (netblocks hijacked or leased by spam and cybercrime operations, IPv4 and IPv6), Spamhaus ASN-DROP (the network operators behind them, matched by the address's ASN) and abuse.ch's Feodo Tracker list of active botnet C2 servers. `is_blocklisted` is the tri-state flag and `blocklist` names the list.
- A blocklisted address adds 80 to `risk_score`, between unallocated space (100) and Tor (70). `risk_signals` carries it as `blocklist` with the dataset `threat-blocklists`, which also appears in `sources` with its sync date.
- The lists are compiled locally like every other feed, so nothing about the lookup leaves the server. ASN-DROP can only answer once the ASN database resolves the address, so `is_blocklisted` stays null rather than false when neither a range list nor the ASN could be checked.
- Bulk result files carry `is_blocklisted` and `blocklist` after `hosting_provider`; the connectors and the Node types know the two fields.
- The Spamhaus lists sync daily with the other feeds; the botnet C2 list refreshes hourly.

Reference: https://spaw.co/changelog/2026-09-05-ip-threat-blocklists