IP reputation (Spamhaus DROP + FireHOL + Tor) API

Returns a 0-100 risk score and verdict for an IPv4 address by joining the Spamhaus DROP list (hijacked/criminal netblocks), the FireHOL level-1 blocklist, and the dan.me.uk Tor exit-node list. Answers 'is this IP malicious', 'IP reputation / risk score', 'is this a Tor exit node', 'is this IP on a blocklist'.

Price$0.01per request

MethodPOST

Route/v1/security/ip-reputation

StatusLive

MIME typeapplication/json

Rate limit60/minute

Cache3600s public

securityipreputationspamhausfireholtorblocklistthreat

API URLhttps://x402.hexl.dev/v1/security/ip-reputation

Integration docs

Example request

{
  "ip": "185.220.101.1"
}

Example response

{
  "ip": "185.220.101.1",
  "score": 30,
  "verdict": "suspicious",
  "private": false,
  "listings": {
    "spamhausDrop": false,
    "fireholLevel1": false,
    "torExit": true
  },
  "signals": [
    "Active Tor exit node."
  ]
}

Input schema

{
  "type": "object",
  "required": [
    "ip"
  ],
  "properties": {
    "ip": {
      "type": "string",
      "examples": [
        "185.220.101.1"
      ]
    }
  }
}

Output schema

{
  "type": "object",
  "additionalProperties": true
}