The risk score now flags hijacked networks

What changed

Some blocks of IP addresses have been taken over by spammers or criminal groups, often by hijacking ranges that nobody was using. We now check every lookup against a daily list of these networks, for both IPv4 and IPv6. An address inside one gets 70 points on its risk score, which puts it in the high band on its own.

What it means for you

Traffic from these networks is not expected to be legitimate, so blocking or challenging it is a reasonable default. Because a match is high risk by itself, you no longer need other signals to line up before the score warns you. A match also outranks the verified bot label: an address that is both is still flagged.

The data comes from the DROP list (Don’t Route Or Peer), © The Spamhaus Project. We credit it wherever a match is shown.

How to use it

• Look up an address on the IP lookup page. A match is listed on the risk panel with its source.
• On Pro and above, the API‘s security group carries is_drop_listed and drop_sbl_id, the list’s reference for the network. On every plan, the answer’s attribution includes the credit when a match is behind the score.
• Checking many addresses? Bulk IP lookup scores each one the same way.

If you show our results to others, show the credits that come with them. Our data sources page lists every source.