senapati
Documentation index

IP Reputation

One call, one IP, a full report: every enabled blacklist engine's verdict, where the address lives, who announces it, what it is (cloud, CDN, crawler, Tor, relay …) and a single 0–100 risk score that agrees with the additive threat model used across the product.

POST/api/check-ipCosts 1 creditAPI key

Check IP reputation

What you get back

  • blacklists: per-engine detected verdicts plus totals. engines_count is the number that actually ran.
  • information: country / region / city / currency from GeoLite2, isp, and provider facts derived from the lists providers publish about their own ranges: cloud_provider + aws_service (AWS, GCP, Azure, OCI, DigitalOcean, Linode, Vultr), edge_service (Cloudflare, Fastly, Bunny), is_google_bot / is_search_engine_bot / is_fake_bot (verified crawler ranges vs. a crawler reverse-DNS claim), is_spamhaus_drop, is_bogon, is_satellite, related_service_* (GitHub, Atlassian egress).
  • asn: number, organisation, and a type of hosting, isp or business.
  • anonymity: is_tor comes only from Tor exit lists (never guessed), is_relay from Apple's Private Relay egress ranges, is_webproxy from corporate proxy egress (Zscaler), is_hosting from cloud / edge ranges and the ASN type. is_vpn and is_residential_proxy are best-effort.

Request

JSON body
FieldTypeDescription
ip*stringIP address to check (IPv4 or IPv6)

Authenticate with API key. Send it as the X-API-Key header.

curl -X POST "https://api.senapati.io/api/check-ip" \
  -H "X-API-Key: $SENAPATI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ip":"54.239.28.85"}'

Response

Every success is wrapped in { "data": … } with a request_id; the fields below describe data. See Errors for the failure shape.

response: 200 OKIPReputationResponse
{
"request_id": "req_8f2c1a7e",
"timestamp": "2026-08-27T11:59:46.179439+00:00",
"data": {
"ip": "54.239.28.85",
"version": "IPv4",
"blacklists": {
"engines": {
"0": {
"name": "0spam",
"detected": false,
"reference": "https://0spam.org/",
"elapsed_ms": 15
},
"5": {
"name": "Backscatterer",
"detected": false,
"reference": "https://www.backscatterer.org/",
"elapsed_ms": 1181
},
"6": {
"name": "Barracuda_Reputation_BL",
"detected": false,
"reference": "https://barracudacentral.org/lookups",
"elapsed_ms": 7
},
"…": "60 more engines omitted from this example"
},
"detections": 0,
"engines_count": 63,
"detection_rate": "0%",
"scan_time_ms": 2002
},
"information": {
"reverse_dns": null,
"is_eu": false,
"continent_code": "NA",
"continent_name": "North America",
"country_code": "US",
"country_name": "United States",
"currency": "USD",
"currency_name": "US Dollar",
"currency_name_plural": "US dollars",
"currency_symbol": "$",
"currency_symbol_native": "$",
"calling_code": "",
"emoji_flag": "🇺🇸",
"emoji_flag_unicode": "U+1F1FA U+1F1F8",
"region_name": "Virginia",
"city_name": "Ashburn",
"latitude": 39.0469,
"longitude": -77.4903,
"isp": "Amazon.com, Inc.",
"asn": "AS16509",
"is_bogon": false,
"is_spamhaus_drop": false,
"is_fake_bot": false,
"is_google_bot": false,
"is_search_engine_bot": false,
"related_service_name": "",
"related_service_domain": "",
"related_service_type": "",
"is_major_provider_spf_ip": false,
"is_public_dns": false,
"cloud_provider": "Amazon AWS",
"cloud_provider_domain": "aws.amazon.com",
"aws_service": "AMAZON",
"is_google_service": false,
"edge_service": "",
"edge_service_domain": "",
"is_satellite": false,
"is_hosting": false
},
"asn": {
"asn": "AS16509",
"asname": "Amazon.com, Inc.",
"route": "",
"status": "active",
"org": "Amazon.com, Inc.",
"country_code": "",
"created": "",
"days_since_created": 0,
"updated": "",
"days_since_updated": 0,
"address": "",
"abuse_email": "",
"domain": "",
"total_ipv4_prefixes": 0,
"total_ipv4_ips": 0,
"total_ipv6_prefixes": 0,
"type": "hosting",
"rir": ""
},
"anonymity": {
"is_proxy": false,
"is_webproxy": false,
"is_residential_proxy": false,
"is_vpn": false,
"is_hosting": true,
"is_relay": false,
"is_tor": false
},
"risk_score": {
"result": 0
},
"elapsed_ms": 8,
"sia_enrichment": null
}
}

blacklists.engines is abbreviated to three entries here; a real response lists every engine that ran, keyed by engine id.

data · IPReputationResponse
FieldTypeDescription
ip*string
version*string
blacklists*BlacklistsResponse
↳ engines*dict<string, EngineResult>
↳ name*string
↳ detected*boolean
↳ reference*string
↳ elapsed_msintegerdefault 0
↳ detections*integer
↳ engines_count*integer
↳ detection_rate*string
↳ scan_time_ms*integer
information*InformationResponse
↳ reverse_dnsstring | null
↳ is_eubooleandefault false
↳ continent_codestringdefault ""
↳ continent_namestringdefault ""
↳ country_codestringdefault ""
↳ country_namestringdefault ""
↳ currencystringdefault ""
↳ currency_namestringdefault ""
↳ currency_name_pluralstringdefault ""
↳ currency_symbolstringdefault ""
↳ currency_symbol_nativestringdefault ""
↳ calling_codestringdefault ""
↳ emoji_flagstringdefault ""
↳ emoji_flag_unicodestringdefault ""
↳ region_namestringdefault ""
↳ city_namestringdefault ""
↳ latitudenumberdefault 0
↳ longitudenumberdefault 0
↳ ispstringdefault ""
↳ asnstringdefault ""
↳ is_bogonbooleandefault false
↳ is_spamhaus_dropbooleandefault false
↳ is_fake_botbooleandefault false
↳ is_google_botbooleandefault false
↳ is_search_engine_botbooleandefault false
↳ related_service_namestringdefault ""
↳ related_service_domainstringdefault ""
↳ related_service_typestringdefault ""
↳ is_major_provider_spf_ipbooleandefault false
↳ is_public_dnsbooleandefault false
↳ cloud_providerstringdefault ""
↳ cloud_provider_domainstringdefault ""
↳ aws_servicestringdefault ""
↳ is_google_servicebooleandefault false
↳ edge_servicestringdefault ""
↳ edge_service_domainstringdefault ""
↳ is_satellitebooleandefault false
↳ is_hostingbooleandefault false
asn*ASNResponse
↳ asnstringdefault ""
↳ asnamestringdefault ""
↳ routestringdefault ""
↳ statusstringdefault ""
↳ orgstringdefault ""
↳ country_codestringdefault ""
↳ createdstringdefault ""
↳ days_since_createdintegerdefault 0
↳ updatedstringdefault ""
↳ days_since_updatedintegerdefault 0
↳ addressstringdefault ""
↳ abuse_emailstringdefault ""
↳ domainstringdefault ""
↳ total_ipv4_prefixesintegerdefault 0
↳ total_ipv4_ipsintegerdefault 0
↳ total_ipv6_prefixesintegerdefault 0
↳ typestringdefault ""
↳ rirstringdefault ""
anonymity*AnonymityResponse
↳ is_proxybooleandefault false
↳ is_webproxybooleandefault false
↳ is_residential_proxybooleandefault false
↳ is_vpnbooleandefault false
↳ is_hostingbooleandefault false
↳ is_relaybooleandefault false
↳ is_torbooleandefault false
risk_score*RiskScoreResponse
↳ result*integer
elapsed_ms*integer
sia_enrichmentSIAIPEnrichmentResponse | null
↳ listed*boolean
↳ datasetstring | null
↳ botnamestring | null
↳ detectionstring | null
↳ heuristicstring | null
↳ rulestring | null
↳ listed_atstring | null
↳ valid_untilstring | null
↳ seen_countinteger | null
↳ country_codestring | null
↳ asninteger | null

Errors

  • 401missing or invalid API key / token
  • 402not enough credits on the account
  • 422the request body or a parameter failed validation
  • 429plan rate limit exceeded

Risk score

Signals add up and the total is capped at 100, so a single strong signal is enough to condemn an address and clean infrastructure stays at 0 even when it is hosting.

SignalPoints
1 blacklist detection40
2 detections70
3 or more detections100
is_tor+100
is_proxy / is_webproxy+40 each
is_vpn+35
is_relay / is_residential_proxy+30 each
is_fake_bot (claims to be a crawler, isn't)+20
bulletproof / offshore hosting ASN+25

Spamhaus DROP and bogon membership are reported as information flags and as engine detections, so a DROP-listed address scores at least 40.

Notes

  • IPv4 and IPv6 are both accepted; version tells you which was parsed.
  • sia_enrichment is populated only when a Spamhaus Intelligence API subscription is configured; otherwise it is null.