IP Reputation
One call, one IP, a full report: every enabled blacklist engine's verdict, where the address lives, who announces it, what it is (cloud, CDN, crawler, Tor, relay …) and a single 0–100 risk score that agrees with the additive threat model used across the product.
/api/check-ipCosts 1 creditAPI keyCheck IP reputation
What you get back
- blacklists: per-engine
detectedverdicts plus totals.engines_countis the number that actually ran. - information: country / region / city / currency from GeoLite2,
isp, and provider facts derived from the lists providers publish about their own ranges:cloud_provider+aws_service(AWS, GCP, Azure, OCI, DigitalOcean, Linode, Vultr),edge_service(Cloudflare, Fastly, Bunny),is_google_bot/is_search_engine_bot/is_fake_bot(verified crawler ranges vs. a crawler reverse-DNS claim),is_spamhaus_drop,is_bogon,is_satellite,related_service_*(GitHub, Atlassian egress). - asn: number, organisation, and a
typeofhosting,isporbusiness. - anonymity:
is_torcomes only from Tor exit lists (never guessed),is_relayfrom Apple's Private Relay egress ranges,is_webproxyfrom corporate proxy egress (Zscaler),is_hostingfrom cloud / edge ranges and the ASN type.is_vpnandis_residential_proxyare best-effort.
Request
| Field | Type | Description |
|---|---|---|
| ip* | string | IP address to check (IPv4 or IPv6) |
Authenticate with API key. Send it as the X-API-Key header.
curl -X POST "https://api.senapati.io/api/check-ip" \
-H "X-API-Key: $SENAPATI_API_KEY" \
-H "Content-Type: application/json" \
-d '{"ip":"54.239.28.85"}'Response
Every success is wrapped in { "data": … } with a request_id; the fields below describe data. See Errors for the failure shape.
{"request_id": "req_8f2c1a7e","timestamp": "2026-08-27T11:59:46.179439+00:00","data": {"ip": "54.239.28.85","version": "IPv4","blacklists": {"engines": {"0": {"name": "0spam","detected": false,"reference": "https://0spam.org/","elapsed_ms": 15},"5": {"name": "Backscatterer","detected": false,"reference": "https://www.backscatterer.org/","elapsed_ms": 1181},"6": {"name": "Barracuda_Reputation_BL","detected": false,"reference": "https://barracudacentral.org/lookups","elapsed_ms": 7},"…": "60 more engines omitted from this example"},"detections": 0,"engines_count": 63,"detection_rate": "0%","scan_time_ms": 2002},"information": {"reverse_dns": null,"is_eu": false,"continent_code": "NA","continent_name": "North America","country_code": "US","country_name": "United States","currency": "USD","currency_name": "US Dollar","currency_name_plural": "US dollars","currency_symbol": "$","currency_symbol_native": "$","calling_code": "","emoji_flag": "🇺🇸","emoji_flag_unicode": "U+1F1FA U+1F1F8","region_name": "Virginia","city_name": "Ashburn","latitude": 39.0469,"longitude": -77.4903,"isp": "Amazon.com, Inc.","asn": "AS16509","is_bogon": false,"is_spamhaus_drop": false,"is_fake_bot": false,"is_google_bot": false,"is_search_engine_bot": false,"related_service_name": "","related_service_domain": "","related_service_type": "","is_major_provider_spf_ip": false,"is_public_dns": false,"cloud_provider": "Amazon AWS","cloud_provider_domain": "aws.amazon.com","aws_service": "AMAZON","is_google_service": false,"edge_service": "","edge_service_domain": "","is_satellite": false,"is_hosting": false},"asn": {"asn": "AS16509","asname": "Amazon.com, Inc.","route": "","status": "active","org": "Amazon.com, Inc.","country_code": "","created": "","days_since_created": 0,"updated": "","days_since_updated": 0,"address": "","abuse_email": "","domain": "","total_ipv4_prefixes": 0,"total_ipv4_ips": 0,"total_ipv6_prefixes": 0,"type": "hosting","rir": ""},"anonymity": {"is_proxy": false,"is_webproxy": false,"is_residential_proxy": false,"is_vpn": false,"is_hosting": true,"is_relay": false,"is_tor": false},"risk_score": {"result": 0},"elapsed_ms": 8,"sia_enrichment": null}}
blacklists.engines is abbreviated to three entries here; a real response lists every engine that ran, keyed by engine id.
| Field | Type | Description |
|---|---|---|
| ip* | string | |
| version* | string | |
| blacklists* | BlacklistsResponse | |
| ↳ engines* | dict<string, EngineResult> | |
| ↳ name* | string | |
| ↳ detected* | boolean | |
| ↳ reference* | string | |
| ↳ elapsed_ms | integer | default 0 |
| ↳ detections* | integer | |
| ↳ engines_count* | integer | |
| ↳ detection_rate* | string | |
| ↳ scan_time_ms* | integer | |
| information* | InformationResponse | |
| ↳ reverse_dns | string | null | |
| ↳ is_eu | boolean | default false |
| ↳ continent_code | string | default "" |
| ↳ continent_name | string | default "" |
| ↳ country_code | string | default "" |
| ↳ country_name | string | default "" |
| ↳ currency | string | default "" |
| ↳ currency_name | string | default "" |
| ↳ currency_name_plural | string | default "" |
| ↳ currency_symbol | string | default "" |
| ↳ currency_symbol_native | string | default "" |
| ↳ calling_code | string | default "" |
| ↳ emoji_flag | string | default "" |
| ↳ emoji_flag_unicode | string | default "" |
| ↳ region_name | string | default "" |
| ↳ city_name | string | default "" |
| ↳ latitude | number | default 0 |
| ↳ longitude | number | default 0 |
| ↳ isp | string | default "" |
| ↳ asn | string | default "" |
| ↳ is_bogon | boolean | default false |
| ↳ is_spamhaus_drop | boolean | default false |
| ↳ is_fake_bot | boolean | default false |
| ↳ is_google_bot | boolean | default false |
| ↳ is_search_engine_bot | boolean | default false |
| ↳ related_service_name | string | default "" |
| ↳ related_service_domain | string | default "" |
| ↳ related_service_type | string | default "" |
| ↳ is_major_provider_spf_ip | boolean | default false |
| ↳ is_public_dns | boolean | default false |
| ↳ cloud_provider | string | default "" |
| ↳ cloud_provider_domain | string | default "" |
| ↳ aws_service | string | default "" |
| ↳ is_google_service | boolean | default false |
| ↳ edge_service | string | default "" |
| ↳ edge_service_domain | string | default "" |
| ↳ is_satellite | boolean | default false |
| ↳ is_hosting | boolean | default false |
| asn* | ASNResponse | |
| ↳ asn | string | default "" |
| ↳ asname | string | default "" |
| ↳ route | string | default "" |
| ↳ status | string | default "" |
| ↳ org | string | default "" |
| ↳ country_code | string | default "" |
| ↳ created | string | default "" |
| ↳ days_since_created | integer | default 0 |
| ↳ updated | string | default "" |
| ↳ days_since_updated | integer | default 0 |
| ↳ address | string | default "" |
| ↳ abuse_email | string | default "" |
| ↳ domain | string | default "" |
| ↳ total_ipv4_prefixes | integer | default 0 |
| ↳ total_ipv4_ips | integer | default 0 |
| ↳ total_ipv6_prefixes | integer | default 0 |
| ↳ type | string | default "" |
| ↳ rir | string | default "" |
| anonymity* | AnonymityResponse | |
| ↳ is_proxy | boolean | default false |
| ↳ is_webproxy | boolean | default false |
| ↳ is_residential_proxy | boolean | default false |
| ↳ is_vpn | boolean | default false |
| ↳ is_hosting | boolean | default false |
| ↳ is_relay | boolean | default false |
| ↳ is_tor | boolean | default false |
| risk_score* | RiskScoreResponse | |
| ↳ result* | integer | |
| elapsed_ms* | integer | |
| sia_enrichment | SIAIPEnrichmentResponse | null | |
| ↳ listed* | boolean | |
| ↳ dataset | string | null | |
| ↳ botname | string | null | |
| ↳ detection | string | null | |
| ↳ heuristic | string | null | |
| ↳ rule | string | null | |
| ↳ listed_at | string | null | |
| ↳ valid_until | string | null | |
| ↳ seen_count | integer | null | |
| ↳ country_code | string | null | |
| ↳ asn | integer | null |
Errors
- 401missing or invalid API key / token
- 402not enough credits on the account
- 422the request body or a parameter failed validation
- 429plan rate limit exceeded
Risk score
Signals add up and the total is capped at 100, so a single strong signal is enough to condemn an address and clean infrastructure stays at 0 even when it is hosting.
| Signal | Points |
|---|---|
| 1 blacklist detection | 40 |
| 2 detections | 70 |
| 3 or more detections | 100 |
| is_tor | +100 |
| is_proxy / is_webproxy | +40 each |
| is_vpn | +35 |
| is_relay / is_residential_proxy | +30 each |
| is_fake_bot (claims to be a crawler, isn't) | +20 |
| bulletproof / offshore hosting ASN | +25 |
Spamhaus DROP and bogon membership are reported as information flags and as engine detections, so a DROP-listed address scores at least 40.
Notes
- IPv4 and IPv6 are both accepted;
versiontells you which was parsed. sia_enrichmentis populated only when a Spamhaus Intelligence API subscription is configured; otherwise it isnull.