# SiteCheck Web Intel – Blocklist.de IP Check

> SiteCheck Web Intel – Blocklist.de IP Check is a paid API for AI agents from api.webintel-api.workers.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-24).

Checks whether a given IPv4 address appears on the Blocklist.de 'all' list of IPs recently reported for attacks such as brute-force logins, SSH abuse, and mail abuse (~24,000 addresses).

## Facts

- Endpoint: GET https://api.webintel-api.workers.dev/api/security/blocklist-de?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-24
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sitecheck-web-intel-blocklist-de-ip-check-2fc39b0a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_67YmviSG9h10ciYQxfcgW

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sitecheck-web-intel-blocklist-de-ip-check-2fc39b0a
```

Example prompt: Can you check if the IP address 185.220.101.42 is on the Blocklist.de abuse list — I want to know if it's been reported for SSH or login attacks recently.

## When to prefer this

Use this endpoint when you need a fast, low-cost check of whether a specific IPv4 address has been recently reported for attacks on Blocklist.de — particularly SSH brute force, failed logins, or mail abuse. Prefer this over broader threat intel APIs when you specifically want Blocklist.de's community-reported current offenders list, not historical WHOIS or passive scan data. Best suited for real-time gatekeeping of inbound connections or email senders.

## Known failure modes

- Missing or invalid 'ip' query parameter returns an error
- Non-IPv4 input (e.g. IPv6 or hostname) may not be supported
- IP not found on list does not necessarily mean it is safe — absence only means no recent report
- Blocklist.de data may lag by hours; very recent abusers may not yet appear
- Rate limiting or upstream Blocklist.de unavailability could cause transient failures

## How this service works

Checks an IPv4 address against the Blocklist.de 'all' list of IPs reported for attacks such as failed logins, SSH and mail abuse (about 24,000 addresses). A hit means it was reported recently; the list keeps only current reports.

## Output

Returns whether the queried IPv4 address appears on the Blocklist.de 'all' list, indicating whether it has been recently reported for attacks such as failed logins, SSH abuse, or mail abuse. The list is current and rotates out older entries, so a hit means a recent report.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 address such as 1.10.176.3 (required)"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sitecheck-web-intel-blocklist-de-ip-check-2fc39b0a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.webintel-api.workers.dev](https://www.zero.xyz/host/api.webintel-api.workers.dev/llms.txt)