Enter an IPv4 address or CIDR range and see if it appears in active FireHOL-based blocklists. Useful for checking server IP reputation, investigating abuse reports, reviewing suspicious traffic / debugging abuse-related network issues.
The indexed lists are refreshed multiple times a day. API rate limits apply. Allowed CIDR prefix range /16 through /32. stats: 9.2M IP records indexed, last sync 2026-07-25 17:20 UTC.
Mail RBL checks are mainly useful for email blacklist checks and delivery issues. This API checks FireHOL-based IP blocklists, which cover broader security signals such as scanners, abuse, malware, botnets, proxies and attack sources.
For matching IPs, the API shows which blocklists contain the address, maintainer and source information where available, when it was first seen and last seen, and if the match was based on the IP itself or a larger network range (CIDR). Historical results can also show if an IP was listed before but is no longer active.
FireHOL collects n publishes many different types of IP lists. Our API focuses only on active security-related IP blocklists, indexes their blocklists, stores historical data, and makes the information easy to search and query. We do not maintain the original lists and cannot remove any IPs from them. You can also view the indexed blocklists currently used by this search.
Not all blocklists carry the same weight. Some feeds are strict, some are broader, and false positives can happen. Treat a match as context for further investigation, not as proof that a server is compromised or that a service will block your IP.
Use the API from your own scripts or monitoring tools to check one IP, a CIDR range or a small batch of addresses. For DirectAdmin servers, we also maintain a DirectAdmin plugin that shows whether the server's public IPv4 addresses appear on any indexed FireHOL-based blocklist.