{"uid":"cap_67YmviSG9h10ciYQxfcgW","slug":"sitecheck-web-intel-blocklist-de-ip-check-2fc39b0a","name":"SiteCheck Web Intel – Blocklist.de IP Check","description":"Checks an IPv4 address against the Blocklist.de 'all' list of IPs reported for attacks such as failed logins, SSH and mail abuse (about 24,000 addresses). A hit means it was reported recently; the list keeps only current reports.","url":"https://api.webintel-api.workers.dev/api/security/blocklist-de?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["ip"],"properties":{"ip":{"type":"string","description":"IPv4 address such as 1.10.176.3 (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_962TErrcaCYM_LbbEIPIV","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Checks whether a given IPv4 address appears on the Blocklist.de 'all' list of IPs recently reported for attacks such as brute-force logins, SSH abuse, and mail abuse (~24,000 addresses).","exampleAgentPrompt":"Can you check if the IP address 185.220.101.42 is on the Blocklist.de abuse list — I want to know if it's been reported for SSH or login attacks recently.","exampleUseCases":[{"title":"Block suspicious login attempt","prompt":"Someone just tried to log into our server from 45.33.32.156 — can you check if that IP is on any abuse blocklist, specifically Blocklist.de, to see if it's a known attacker?"},{"title":"Firewall rule vetting","prompt":"Before I whitelist 198.51.100.23 in our firewall, can you verify whether it's flagged on Blocklist.de for any recent attacks like SSH abuse or brute-force logins?"},{"title":"Incoming email sender check","prompt":"We're getting a lot of email from 91.121.87.143 and I'm suspicious — can you check if that IP has been reported for mail abuse on Blocklist.de?"}],"resultDescription":"Returns whether the queried IPv4 address appears on the Blocklist.de 'all' list, indicating whether it has been recently reported for attacks such as failed logins, SSH abuse, or mail abuse. The list is current and rotates out older entries, so a hit means a recent report.","failureModes":["Missing or invalid 'ip' query parameter returns an error","Non-IPv4 input (e.g. IPv6 or hostname) may not be supported","IP not found on list does not necessarily mean it is safe — absence only means no recent report","Blocklist.de data may lag by hours; very recent abusers may not yet appear","Rate limiting or upstream Blocklist.de unavailability could cause transient failures"],"whenToPreferThis":"Use this endpoint when you need a fast, low-cost check of whether a specific IPv4 address has been recently reported for attacks on Blocklist.de — particularly SSH brute force, failed logins, or mail abuse. Prefer this over broader threat intel APIs when you specifically want Blocklist.de's community-reported current offenders list, not historical WHOIS or passive scan data. Best suited for real-time gatekeeping of inbound connections or email senders.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-24T12:37:51.155Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-blocklist-de-ip-check-2fc39b0a"}