IP Blacklist Check

Overview

An IP blacklist check API for firewalls, fraud checks and signup screening. Send an IPv4 address and IP Blacklist Lookup checks it against an IP blacklist database of inbound threats (spam, scanning and brute-force sources) and outbound threats (command-and-control servers, malware and phishing hosts), refreshed four times a day. Every plan returns whether the IP is listed and whether it is a public address; paid plans add which list it is on, a threat level, Tor exit status, the ASN, the hosting provider, the IP's location, whether it is a VPN or datacenter address, live results from four public DNS blocklists (DroneBL, UCEPROTECT, 0spam and PSBL), and how many neighbouring addresses in the same /24 are listed.

Live Test IP Blacklist Check Source →

Formula

One function covers the whole catalog: the first argument names the source, the rest are its inputs, and the "field" pair says which single value lands in the cell. Formulas covers the grammar that applies to all of them.

=VERVE("ipblacklistlookup", A2, "field", "ipAddress")

A2 holds the ip you are looking up. Drag the formula down and each row resolves on its own.

With literal values

Nothing has to come from a cell — typed values work the same way.

=VERVE("ipblacklistlookup", "185.220.101.1", "field", "ipAddress")

Inputs

Required inputs are positional, in the order below. Everything else is passed as a "name", value pair after them — the same shape as SUMIFS. Premium inputs are accepted on every plan but only take effect on plans that include them.

Input	Type	Where it goes	Description
`ip`Required	string	argument 2 (A2)	The IP address to check against blocklists ip

What lands in your sheet

The "field" pair is what makes the formula resolve to one cell. Its value is a dot-path from the table below, so swapping it is how you pull a different value — one formula per column.

Seeing everything at once

Drop the "field" pair and the formula returns the whole response instead: two columns, field name on the left and value on the right, spilling from the cell you typed in.

=VERVE("ipblacklistlookup", A2)

Good for exploring, not for filling down

The second row's table would land on top of the first's, and every cell after the first reads #REF! (#SPILL! in Excel). Keep one per sheet, or name a field, and leave the cells below and to the right empty.

Response fields

Paths are relative to data. Each one is exactly what the "field" pair accepts, so swapping it is how you pull a different value into a cell. On a plan without a Premium field the cell reads #PREMIUM(field) rather than a value, so a locked field never looks like a real answer.

Use as "field"	Type	Example cell value	Description
`ipAddress`	string	`185.220.101.1`	The IP address that was checked
`isIPBlacklisted`	boolean	`true`	Whether IP appears on any known blocklists
`isPublic`	boolean	`true`	Whether the IP is a public, routable address; false for private, loopback, link-local, carrier-grade NAT and other reserved ranges, which no blocklist covers
`inbound`Premium	object	`{…}`	Inbound threat assessment for attacker/spam sources
`inbound.found`Premium	boolean	`true`	Whether IP is on inbound attacker blocklist
`inbound.description`Premium	string	`IP is known for malicious inbound activity (spam, scanning, brute-force attacks)`	Description of inbound threat type if found
`outbound`Premium	object	`{…}`	Outbound threat assessment for malicious destinations
`outbound.found`Premium	boolean	`true`	Whether IP is on outbound C2/malware blocklist
`outbound.description`Premium	string	`IP is a known malicious destination (C2 server, malware host, phishing)`	Description of outbound threat type if found
`threatLevel`Premium	string	`critical`	Overall threat severity assessment level
`isTor`Premium	boolean	`true`	Whether the IP is a known Tor exit node; null if the Tor list could not be checked
`ipDetails`Premium	object	`{…}`	Geolocation details for the IP address
`ipDetails.ip`Premium	string	`185.220.101.1`	The queried IP address
`ipDetails.country`Premium	string	`DE`	Two-letter country code of IP location
`ipDetails.region`Premium	string	`BB`	Region/state code of IP location
`ipDetails.timezone`Premium	string	`Europe/Berlin`	Timezone of IP geolocation
`ipDetails.city`Premium	string	`Brandenburg an der Havel`	City name of IP location
`ipDetails.coordinates`Premium	array	`[52.6171,13.1207]`	Latitude and longitude coordinates of IP
`ipDetails.countryName`Premium	string	`Germany`	Full country name of IP location
`ipDetails.regionName`Premium	string	`Brandenburg`	Full region/state name of IP location
`ipDetails.postalCode`Premium	string	`14621`	Postal code of IP geolocation
`ipDetails.continent`Premium	string	`EU`	Continent code of IP location
`ipDetails.continentName`Premium	string	`Europe`	Full continent name of IP location
`ipDetails.accuracyRadius`Premium	number	`20`	Accuracy radius in kilometers for IP geolocation
`ipDetails.isEU`Premium	boolean	`true`	Whether the IP is located in a European Union member state
`asn`Premium	string	`AS60729`	Autonomous System Number announcing the IP (e.g., AS60729); null if unrouted
`asnName`Premium	string	`TORSERVERS-NET`	Registered name of that AS (e.g., TORSERVERS-NET), not always the company name
`hostingProvider`Premium	object	`null`	The cloud or hosting company the IP belongs to, such as Amazon Web Services, DigitalOcean, Hetzner or M247, for about 30 providers that carry most server and bot traffic; null for home and mobile networks and for providers not on the list
`listedInSubnet`Premium	number	`255`	How many other addresses in the same /24 (the 256 addresses sharing the first three octets) are on the blocklists; null for IPv6
`isRiskySubnet`Premium	boolean	`true`	Whether 5 or more other addresses in the same /24 are listed. Unlisted IPs in such ranges were added to the lists 36 times more often than average over two weeks in October 2026; null for IPv6
`isVpn`Premium	boolean	`true`	Whether the IP is in a known commercial VPN range, from the same daily-refreshed list as VPN Proxy Detector; null if the list could not be read
`isDatacenter`Premium	boolean	`true`	Whether the IP is in a cloud or hosting datacenter range, from the same daily-refreshed list as VPN Proxy Detector; null if the list could not be read
`isRelay`Premium	boolean	`false`	Whether the IP is an iCloud Private Relay egress address, from the list Apple publishes. The VPN list also covers these ranges, so isVpn is true for them too, but their users are ordinary Safari users; null if the list could not be read
`blocklists`Premium	array[4]		Live results from four public DNS blocklists (DroneBL, UCEPROTECT Level 1, 0spam and PSBL), one entry per list; null for IPv6 and for private or reserved addresses
`blocklists.0.name`Premium	string	`DroneBL`	The blocklist's name, such as DroneBL
`blocklists.0.zone`Premium	string	`dnsbl.dronebl.org`	The DNS zone that was queried, such as dnsbl.dronebl.org
`blocklists.0.listed`Premium	boolean	`false`	Whether that blocklist lists the IP; null if the list refused the query or did not answer within 1.5 seconds
`blocklistsListed`Premium	number	`0`	How many of the DNS blocklists list the IP; null when blocklists is null

Filling a whole column

Both platforms make one batched call for a column rather than one request per cell, and both cost the same — 10 credits per row looked up. How you write it differs, because the two runtimes batch at different points.

Rows 2–100 in one call

=VERVE("ipblacklistlookup", A2:A100, "field", "ipAddress")

In Google Sheets, give the arguments ranges and the answers spill down from the cell you typed in. Custom functions there run synchronously and in isolation, so dragged cells cannot be coalesced — the range form is how a column becomes one call. The "field" pair is required here: a per-row two-column table has nowhere to spill. Use a full column per input (A2:A100, not A2) — a single-cell reference is read as row 1 only and the rest of the column comes back blank.

In Excel, type the formula once and fill down — no range form and none needed, because its runtime is asynchronous and the add-in coalesces the calls a fill produces into a single batched request. Do not hand VERVE.CALL a range: Excel flattens it into positional arguments, so A2:A100 arrives as a hundred separate arguments and the cell reads #ERR rather than filling.

Either way, column A holds your ip values and the answers land beside them, one row each, blank rows skipped.

When a cell doesn't fill

A failed lookup returns readable text starting with #ERR rather than a spreadsheet error, because Excel cannot show a custom message on a real error — you would get a bare #VALUE! with no reason. The trade-off is that IFERROR() will not catch it; test with LEFT(cell, 4) = "#ERR" instead. Error handling covers the rest.

Cell reads	What happened
`#ERR Not connected`	No API key saved. Open the side panel and connect your account.
`#ERR Replace <name> with a cell or value`	A preview formula was copied as-is. Swap the placeholder for a cell reference.
`#ERR No "x" in ipblacklistlookup`	An option name this source does not take. The message lists the ones it does.
`#ERR No data point "…"`	The `"field"` path is not in the response. Check it against the table above.
`#PREMIUM(field)`	The field exists but your plan does not include it.
`#ERR Out of credits`	The cycle's credits are spent. Usage resets on your billing date.

Before the formula works

The add-in reads the API key you saved once in the side panel — the key never goes in the formula, so a shared sheet does not leak it and a collaborator without access simply sees the last calculated values.

Install the add-in for Google Sheets or Excel.
Open the side panel and sign in, or paste a key from your dashboard.
Type the formula above into any cell.

Use cases

Firewall Enhancement: Automatically block connections to/from known malicious IPs to strengthen your security posture
Threat Detection: Identify if incoming traffic originates from known malicious sources before processing requests
Outbound Security: Detect if your systems are attempting to connect to known command-and-control or malware servers
Security Auditing: Check historical connection logs against current threat intelligence to identify past compromises

Other ways to use IP Blacklist Check

Set up IP Blacklist Check on VerveSheets, or reach the same source a different way. Your VerveSheets account and credits work on all of them — one key, one balance.

Call it as a REST APIOne HTTPS endpoint and an x-api-key header, with SDKs for Node, Python and .NET.APIVerve →Reference →

Give it to an AI agentConnect over MCP and your agent calls it as a native tool — Claude, Cursor, ChatGPT.VerveKit →Reference →

Ground an agent on itA cited, machine-checkable fact your model can't produce on its own.VerveContext →Reference →