This API is a direct feed to our IP blocklist data.
You can download the entire blocklist data set in CSV or TXT format.
The CSV format has 2 columns, the first column is the IP address and the second column contains the blocklist categories.
If an IP address appears on more than one blocklist then the blocklist categories appear as colon separated values.
The TXT format is just a simple plain text dump of all the currently listed IP addresses with no specific blocklist data included.
Notes:
• To access this API you must have a Tier 1 or higher account.
• The 'vpn' category is only available for Tier 3 or higher accounts.
• We recommend enabling the 'cidr' option for IPv4 because it allows for listing large network ranges efficiently which would otherwise not be
included in the download due to being too many addresses to list individually.
• The 'ip6' option only supports output in CIDR format, this is required because the IPv6 address space is too vast to include individual IP addresses.
End Point
https://neutrinoapi.net/ip-blocklist-download
API Request
Parameter
Required
Type
Default
Description
format
no
string
csv
The data format. Can be either CSV or TXT
cidr
no
boolean
false
Output IPs using CIDR notation. This option should be preferred but is off by default for backwards compatibility
ip6
no
boolean
false
Output the IPv6 version of the blocklist, the default is to output IPv4 only. Note that this option enables CIDR notation too as this is the only notation currently supported for IPv6
category
no
string
all
The category of IP addresses to include in the download file, possible values are:
all - all IPs available on your current plan (excludes VPN providers for any plans lower than Tier 3)
bot - all IPs hosting a malicious bot or part of a botnet. This is a broad category which includes brute-force crackers
exploit-bot - all IPs hosting an exploit finding bot or running exploit scanning software
hijacked - all IPs that are part of a hijacked netblock or a netblock controlled by a criminal organization
malware - all IPs involved in distributing or running malware
proxy - all IPs detected as an anonymous web proxy or anonymous HTTP proxy
spam-bot - all IPs hosting a spam bot, comment spamming or any other spamming type software
spider - all IPs running a hostile web spider / web crawler
spyware - all IPs involved in distributing or running spyware
tor - all IPs that are Tor nodes or running a Tor related service
vpn - all IPs belonging to public VPN providers (only available for Tier 3 or higher accounts)
output-encoding
no
string
Set this option to 'gzip' to have the output file compressed using gzip
checksum
no
boolean
false
Do not download the file but just return the current files MurmurHash3 checksum. You can use this feature to check if the file has changed since a previous check