Response fields
threat
Threat flags, blocklists and verified crawlers.
Threat flags from named public feeds (refreshed daily) plus verified crawler identification from 19 official IP-range feeds (re-fetched daily).
| Field | Type | Description |
|---|---|---|
is_abusive | boolean | IP appears on abuse-focused threat feeds. |
is_bogon | boolean | IP falls in unallocated or reserved space (Team Cymru bogon data). |
is_crawler | boolean | IP belongs to a known crawler or AI bot. |
is_spammer | boolean | IP is a known spam source. |
is_scanner | boolean | IP belongs to known internet-wide scanner ranges (e.g. Shodan, Censys). |
is_botnet | boolean | IP appears in botnet C2 data (Feodo Tracker). |
is_cgnat | boolean | IP is in a carrier-grade NAT range shared by many users. Risk scores are capped for CGNAT ranges. |
threat_types | string[] | Every threat category that applies to this IP. |
blocklist_count | number | Number of blocklists currently listing this IP. |
blocklist_sources | string[] | Names of the blocklists that listed this IP. |
dnsbl_sources | string[] | Which of the 4 DNS blocklist zones listed this IP. |
crawler.verified | boolean | Crawler identity confirmed against its operator's official IP ranges. |
crawler.unverified | boolean | Crawler-like identity that could not be confirmed against official ranges. |
crawler.spoofed | boolean | Reserved; not populated yet (always false). A lookup does not see the User-Agent, so compare crawler.verified with the identity the request claims. |
crawler.name | string | Crawler name, e.g. "Googlebot", "GPTBot". |
crawler.operator | string | Organization operating the crawler. |
crawler.category | string | Crawler category. |
crawler.verification_method | string | How the crawler identity was verified. |
botnet.role | string | Role in the botnet, when known. |
botnet.family | string | Malware family, when known. |
botnet.last_seen | string | ISO 8601 timestamp of the last botnet sighting. |
honeypot.hits_30d | number | Honeypot interactions recorded in the last 30 days. |
honeypot.type | string | Type of honeypot interaction, when any exists. |
honeypot.last_hit | string | ISO 8601 timestamp of the last honeypot interaction. |
spammer_last_seen | string | ISO 8601 timestamp of the last spam sighting. |
A field with no value comes back as the string "none", or 0 for numbers. The API never returns null.
Example
The threat group for 8.8.8.8, from a real lookup on 24 October 2026. Values change as the data is refreshed.
{
"threat": {
"is_abusive": false,
"is_bogon": false,
"is_crawler": false,
"is_spammer": false,
"is_scanner": false,
"is_botnet": false,
"is_cgnat": false,
"threat_types": [],
"blocklist_count": 0,
"blocklist_sources": [],
"dnsbl_sources": [],
"crawler": {
"verified": false,
"unverified": false,
"spoofed": false,
"name": "none",
"operator": "none",
"category": "none",
"verification_method": "none"
},
"botnet": {
"role": "none",
"family": "none",
"last_seen": "none"
},
"honeypot": {
"hits_30d": 0,
"type": "none",
"last_hit": "none"
},
"spammer_last_seen": "none"
}
}