IPWhois.net Blacklist

Community-driven IP threat intelligence. Search, check, and report malicious IP addresses.

184,733 IPs 7,370 reports Free API

Server & Firewall

Block + report banned IPs automatically. The most popular integration.

Sync blacklisted IPs to ConfigServer Security & Firewall deny list.

iptables / nftables

Block IPs at the kernel firewall level using ipset and nftables sets.

Block blacklisted IPs directly in Nginx config with auto-updated deny list.

Block IPs via .htaccess or mod_rewrite with auto-generated deny rules.

Block at the edge with Workers or Firewall Rules before traffic reaches your server.

Parse server logs and report malicious IPs on a schedule via cron.

CMS & Applications

Block + report on wp-login, wp-admin and XML-RPC. Plugin or mu-plugin.

Protect Joomla administrator login and forms from blacklisted IPs.

Custom module to block blacklisted IPs on admin and login routes.

Protect back office and checkout from blacklisted IPs.

Languages & Frameworks

Standalone function with file cache and Laravel middleware.

Express and Fastify middleware with in-memory cache.

Flask, Django and FastAPI middleware for IP blocking.

HTTP middleware for net/http, Gin, Echo and Chi.

Rack middleware for Rails and Sinatra.

Command-line examples for checking and reporting IPs.

Quick Start

All integrations use the IPWhois.net Blacklist API. The two key endpoints are:

Check if an IP is blacklisted

GET https://bl.ipwhois.net/api/check?ip=1.2.3.4

Report a malicious IP

POST https://bl.ipwhois.net/api/report
  ip=1.2.3.4&type=brute-force&message=Description+here

Threat types: brute-force, spam, ddos, scan, phishing, malware, bot, other

Rate limit: The public API allows 500 free requests per day per source IP. For higher limits, use an API key from the API page.