API Basics
Data Tools
Browser Bot
HTML Clean
URL Info
Security and Networking
Legacy APIs

IP Blocklist Download

This API is a direct feed to our IP blocklist data.

You can download the entire blocklist data set in CSV or TXT format. The CSV format has 2 columns, the first column is the IP address and the second column contains the blocklist categories. If an IP address appears on more than one blocklist then the blocklist categories appear as colon separated values. The TXT format is just a simple plain text dump of all the currently listed IP addresses with no specific blocklist data included.

• The 'vpn' category is only available for Tier 3 or higher accounts.
• We recommend enabling the 'cidr' option for IPv4 because it allows for listing large network ranges efficiently which would otherwise not be included in the download due to being too many addresses to list individually.
• The 'ip6' option only supports output in CIDR format, this is required because the IPv6 address space is too vast to include individual IP addresses.

End Point

API Request
formatnostringcsvThe data format. Can be either CSV or TXT
cidrnobooleanfalseOutput IPs using CIDR notation. This option should be preferred but is off by default for backwards compatibility
ip6nobooleanfalseOutput the IPv6 version of the blocklist, the default is to output IPv4 only. Note that this option enables CIDR notation too as this is the only notation currently supported for IPv6
categorynostringallThe category of IP addresses to include in the download file, possible values are:
  • all - all IPs available on your current plan (excludes VPN providers for any plans lower than Tier 3)
  • bot - all IPs hosting a malicious bot or part of a botnet. This is a broad category which includes brute-force crackers
  • exploit-bot - all IPs hosting an exploit finding bot or running exploit scanning software
  • hijacked - all IPs that are part of a hijacked netblock or a netblock controlled by a criminal organization
  • malware - all IPs involved in distributing or running malware
  • proxy - all IPs detected as an anonymous web proxy or anonymous HTTP proxy
  • spam-bot - all IPs hosting a spam bot, comment spamming or any other spamming type software
  • spider - all IPs running a hostile web spider / web crawler
  • spyware - all IPs involved in distributing or running spyware
  • tor - all IPs that are Tor nodes or running a Tor related service
  • vpn - all IPs belonging to public VPN providers (only available for Tier 3 or higher accounts)
output-encodingnostringSet this option to 'gzip' to have the output file compressed using gzip
checksumnobooleanfalseDo not download the file but just return the current files MurmurHash3 checksum. You can use this feature to check if the file has changed since a previous check
API Response

API Example
curl https://neutrinoapi.net/ip-blocklist-download \ --header "User-ID: <your-user-id>" \ --header "API-Key: <your-api-key>> \ --data-urlencode "format=csv" \ --data-urlencode "cidr=false" \ --data-urlencode "ip6=false" \ --data-urlencode "category=all" \ --data-urlencode "output-encoding=" \ --data-urlencode "checksum=false" \ --output "ip-blocklist-download.csv"