IP Blocklist

{
  "type": "object",
  "required": [
    "blocklists",
    "cidr",
    "ip",
    "is-bot",
    "is-dshield",
    "is-exploit-bot",
    "is-hijacked",
    "is-listed",
    "is-malware",
    "is-proxy",
    "is-spam-bot",
    "is-spider",
    "is-spyware",
    "is-tor",
    "is-vpn",
    "last-seen",
    "list-count",
    "sensors"
  ],
  "properties": {
    "blocklists": {
      "type": "array",
      "description": "An array of strings indicating which blocklist categories this IP is listed on",
      "items": {
        "type": "string"
      }
    },
    "cidr": {
      "type": "string",
      "description": "The CIDR address for this listing (only set if the IP is listed)"
    },
    "ip": {
      "type": "string",
      "description": "The IP address"
    },
    "is-bot": {
      "type": "boolean",
      "description": "IP is hosting a malicious bot or is part of a botnet. This is a broad category which includes brute-force crackers"
    },
    "is-dshield": {
      "type": "boolean",
      "description": "IP has been flagged as a significant attack source by DShield (dshield.org)"
    },
    "is-exploit-bot": {
      "type": "boolean",
      "description": "IP is hosting an exploit finding bot or is running exploit scanning software"
    },
    "is-hijacked": {
      "type": "boolean",
      "description": "IP is part of a hijacked netblock or a netblock controlled by a criminal organization"
    },
    "is-listed": {
      "type": "boolean",
      "description": "Is this IP on a blocklist"
    },
    "is-malware": {
      "type": "boolean",
      "description": "IP is involved in distributing or is running malware"
    },
    "is-proxy": {
      "type": "boolean",
      "description": "IP has been detected as an anonymous web proxy or anonymous HTTP proxy"
    },
    "is-spam-bot": {
      "type": "boolean",
      "description": "IP address is hosting a spam bot, comment spamming or any other spamming type software"
    },
    "is-spider": {
      "type": "boolean",
      "description": "IP is running a hostile web spider / web crawler"
    },
    "is-spyware": {
      "type": "boolean",
      "description": "IP is involved in distributing or is running spyware"
    },
    "is-tor": {
      "type": "boolean",
      "description": "IP is a Tor node or running a Tor related service"
    },
    "is-vpn": {
      "type": "boolean",
      "description": "IP belongs to a public VPN provider (only set if the 'vpn-lookup' option is enabled)"
    },
    "last-seen": {
      "type": "integer",
      "format": "int32",
      "description": "The unix time when this IP was last seen on any blocklist. IPs are automatically removed after 7 days therefor this value will never be older than 7 days"
    },
    "list-count": {
      "type": "integer",
      "format": "int32",
      "description": "The number of blocklists the IP is listed on"
    },
    "sensors": {
      "type": "array",
      "description": "An array of objects containing details on which specific sensors detected the IP",
      "items": {
        "type": "object",
        "required": [
          "id",
          "blocklist",
          "description"
        ],
        "properties": {
          "blocklist": {
            "type": "string",
            "description": "The primary blocklist category this sensor belongs to"
          },
          "description": {
            "type": "string",
            "description": "Contains details about the sensor source and what type of malicious activity was detected"
          },
          "id": {
            "type": "integer",
            "format": "int32",
            "description": "The sensor ID. This is a permanent and unique ID for each sensor"
          }
        }
      }
    }
  }
}