Hazard report

On this page

The Hazard Report API provides a consolidated, machine-readable assessment of IP address risk, combining reactive signals (evidence of past malicious behaviour such as blocklist appearances and known anonymiser detections) with proactive indicators (the likelihood that an IP belongs to a hosting or data-centre environment with no real user behind it).

This dual approach helps you identify threats before they act — a meaningful advantage for zero-day defence — while still leveraging historical evidence where available. Key outputs include hostingLikelihood (0–10), AS and provider context, anonymiser indicators, and related hazard flags. For background on the model and concepts, see What is Hosting Likelihood? and Understanding the Hazard Report.

If you need geolocation with confidence area polygons in the same response, use the IP Geolocation with Confidence Area and Hazard Report API. For a simplified risk verdict (low, moderate, or high), see the User Risk API.

Endpoint

GEThttps://api-bdc.net/data/hazard-report

Parameters

ParameterTypeRequiredDescription
ipstringOptionalIPv4 IP address in a string or numeric format or IPv6 IP address in a string format. If omitted, the caller’s IP address is assumed
keystringOptionalYour API key

Responses

200OK

Sample Request

https://api-bdc.net/data/hazard-report?ip=216.73.216.46&key=[YOUR API KEY]

Sample Response

JSON View

Response Schema

isKnownAsTorServerbooleanDetermines whether the requested ip address is known as utilised by a TOR server
isKnownAsVpnbooleanDetermines whether the requested ip address is known as utilised by a VPN server
isKnownAsProxybooleanDetermines whether the requested ip address is known as utilised by a proxy server
isSpamhausDropbooleanDetermines whether the requested ip address is listed on the Spamhaus drop all traffic list. The Spamhaus drop (don't route or peer) lists are advisory 'drop all traffic' lists, consisting of netblocks that are 'hijacked' or leased by professional spam or cyber-crime operations (used for dissemination of malware, trojan downloaders, botnet controllers)
isSpamhausEdropbooleanDetermines whether the requested ip address is listed on the Spamhaus edrop list According to Spamhaus, edrop is an extension of the drop list that includes sub-allocated netblocks controlled by spammers or cyber criminals
isSpamhausAsnDropbooleanDetermines whether the requested IP address is listed on the Spamhaus ASN-drop list. According to Spamhaus, asn-drop contains a list of autonomous system numbers controlled by spammers or cyber criminals, as well as hijacked asns
isBlacklistedUceprotectbooleanDetermines whether the requested ip address is blacklisted at uceprotect.net or backscatterer.org
isBlacklistedBlocklistDebooleanDetermines whether the requested ip address is blacklisted at blocklist.de
isKnownAsMailServerbooleanDetermines whether the requested ip address is known as utilised by an SMTP mail server
mailServerDomainstringThe last detected SMTP domain name making use of this ip address
isKnownAsPublicRouterbooleanDetermines whether the requested ip address is known as utilised by a public router
isBogonbooleanIndicates whether the IP address is excluded from public Internet use by the authorities but announced into the global routing table via BGP
isUnreachablebooleanDetermines whether the requested ip address is not reachable via the public Internet
hostingLikelihoodintegerThe likelihood (0–10) that this IP address originates from a hosting, data centre, or cloud environment. A value of 0 indicates no hosting signals detected; 10 indicates very high confidence of hosting origin.
isHostingAsnbooleanDetermines whether the requested ip address was announced by an autonomous system which is likely to publish hosting networks
isCellularbooleanDetermines whether the requested ip address was detected as utilised within a cellular network
iCloudPrivateRelaybooleanDetermines whether the requested ip address was detected as Apple iCloud Private Relay address

403Access denied, or your quota limit has exceeded

Sample Response

JSON View

405The requested IP address is not valid

Sample Response

JSON View

500An error has occurred and did not complete your request. Please try again

Sample Response

JSON View