{"slug":"2s-io-api-security-ip-reputation-e44ddf","title":"Multi-source IP reputation with one combined authority score (0-100)","host":"2s.io","method":"GET","resource":"https://2s.io/api/security/ip-reputation","category":"other","description":"Multi-source IP reputation with one combined authority score (0-100). Polls four independent reputation sources in parallel and blends them: AbuseIPDB (crowd-sourced abuse confidence), abuse.ch threat-lists (Feodo botnet C2 + ThreatFox + Spamhaus DROP + Tor exit nodes), blocklist.de (fail2ban attack","price_listed":0.009,"price_asked":0.009,"state":"answering","state_label":"Answering","checks_7d":1,"answered_7d":1,"latency_ms_median":257,"reported_calls_30d":2,"reported_payers_30d":2,"networks":["eip155:8453","solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"method":"GET","queryParams":{"ip":"118.25.6.39"},"type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"properties":{"method":{"const":"GET"},"queryParams":{"properties":{"ip":{"description":"IPv4 or IPv6 address.","type":"string"}},"required":["ip"]},"type":{"const":"http"}},"required":["type","method","queryParams"],"type":"object"}},"required":["input"],"type":"object"},"history":[{"day":"2026-10-18","reachable":true,"status":402,"valid_402":true,"asked_usdc":0.009,"price_match":true,"latency_ms":257,"error":null}],"description_full":"Multi-source IP reputation with one combined authority score (0-100). Polls four independent reputation sources in parallel and blends them: AbuseIPDB (crowd-sourced abuse confidence), abuse.ch threat-lists (Feodo botnet C2 + ThreatFox + Spamhaus DROP + Tor exit nodes), blocklist.de (fail2ban attack-report network), and StopForumSpam. Returns combinedScore, a verdict (clean / low / suspicious / malicious), which sources flagged it, per-source opinions (score + weight + detail), and enrichment (ISP, usage type, country, ASN, Tor). An authoritative threat-list hit (botnet/malware/hijacked netblock) hard-floors the verdict at malicious. Per-source isolation: a down feed degrades that opinion only. The one-call answer for 'should I trust this IP?' instead of trusting a single feed.","last_updated":"2026-10-13T14:37:32.034Z","schemes":["exact"]}