IP and domain reputation API with threat feeds and blocklist export
Plain-language standing for any IP or domain, delist requests, and open threat feeds you can query or export.
What it does
- This family answers two questions. First: is this IP or domain in good standing? You get good, suspect, poor or blocked, a 0 to 100 score, and the kinds of abuse behind it (spam, phishing, brute force and so on). Second: which open threat feeds list it? Feeds include Tor exit nodes, Feodo, ThreatFox, Spamhaus DROP, Cymru bogons, blocklist.de, FireHOL, URLhaus and Phishing Army.
- It solves the gap between "my logs look bad" and "what do I do about it". Report abuse you see, read the standing, ask for a review if you were listed unfairly, and export the feeds as a blocklist your firewall can load.
- Feed lookups give hits, not a verdict. A name with no hits returns an empty list and the number of feeds consulted. There is no "clean" stamp, because the data does not support one.
- Affordable by design. Start free* within platform limits for connected ShadowCradle organizations, with affordable pricing beyond that. *Free within platform limits; usage beyond limits may be charged to maintain the platform.
See how it works
Check standing, act on what you find
Example use cases
Gate sign-ups and logins
Product teams check the standing of the connecting IP and add friction when it is poor or blocked.
Mail and domain triage
Ops teams check a sender domain against phishing and malware feeds before releasing quarantined mail.
Share abuse you see
Security teams file a report with the reason, event count and a sample log line. Reports decay over time instead of staying forever.
Get an address reviewed
An MSP whose client address was flagged sends a delist request from that address. A platform admin approves or denies it.
Load a blocklist into the firewall
Export feed data as plain CIDR lines, nftables, ipset, a Postfix table, JSON or CSV, filtered by source, category and confidence.
Try it
Standing of an IP
curl -s "https://app.takelan.com/api/v1/ip/198.51.100.9/standing" \ -H "X-API-Key: $TAKELAN_API_KEY"
Response (fictional, fields abbreviated): { "standing": "suspect", "score": 38, "reasons": [{ "reason": "brute_force", "share": 0.8 }], "cache_ttl_seconds": 300 }. Cache no longer than cache_ttl_seconds.
Feed hits for a domain, and a blocklist export
curl -s "https://app.takelan.com/api/v1/domain/example.net/reputation" -H "X-API-Key: $TAKELAN_API_KEY" curl -s "https://app.takelan.com/api/v1/reputation/export/ips?format=nftables" -H "X-API-Key: $TAKELAN_API_KEY"
Formats: plain, nftables, ipset, postfix, json, csv. Bogons are left out unless you ask for them by name.
Endpoints
GET /api/v1/ip/{ip}/standingStanding: good, suspect, poor or blocked, with score and reasons.GET /api/v1/domain/{domain}/standingStanding: same for a domain name.GET /api/v1/reputation/policyStanding: scoring rules, reasons, TTLs and caching guidance.POST /api/v1/reputation/reportsReports: file abuse for an IP or domain (reason, activity, amount, sample).POST /api/v1/reputation/reports/bulkReports: file many at once.DELETE /api/v1/reputation/reports/{report_id}Reports: retract a report.GET /api/v1/ip/{ip}/reportsReports: details, only when called from that address.GET /api/v1/domain/{domain}/reportsReports: details, only from an address the domain resolves to.POST /api/v1/ip/{ip}/delist-requestsDelist: ask for a review, from the address itself.POST /api/v1/domain/{domain}/delist-requestsDelist: ask for a review of a domain, from an address it resolves to.GET /api/v1/domain/{domain}/reputationFeeds: every feed hit for a domain; include_subdomains optional.GET /api/v1/domain/{domain}/addressesFeeds: addresses seen for a name, forward and PTR; resolve=true for a live DNS check.GET /api/v1/ip/{ip}/reputationFeeds: feed hits for an IP.GET /api/v1/reputation/sourcesFeeds: what is ingested, last refresh, entry counts.GET /api/v1/reputation/export/summaryExport: counts per kind and category.GET /api/v1/reputation/export/ipsExport: blocklist of address ranges (filters: sources, category, min_confidence, ip_version).GET /api/v1/reputation/export/domainsExport: blocklist of domains.
MCP
Available as tools through /mcp/utils. Read tools work by default with an API key. Anything that writes is off until your tenant turns on the writes switch, and a read-only key never writes. Calls run with your own permissions. Report and delist calls are writes, so an agent cannot file them unless writes are on. About MCP
Common questions
How do I check if an IP address is blacklisted by API?
GET /api/v1/ip/{ip}/standing for the plain-language standing, and /api/v1/ip/{ip}/reputation for the raw feed hits.
How do I check a domain reputation by API?
GET /api/v1/domain/{domain}/reputation. Each hit names the feed, its category, its confidence if it publishes one, and whether the listing is exact or on a parent name.
Which threat intelligence feeds are included?
Tor exit nodes, Feodo, ThreatFox, Spamhaus DROP, Cymru bogons, blocklist.de, FireHOL, URLhaus and Phishing Army. GET /reputation/sources shows what is ingested and when it last refreshed.
How do I get my IP removed from a blocklist?
For Takelan standing, send a delist request from the address itself. A platform admin reviews it. For third-party feeds, contact the feed operator; Takelan only mirrors them.
Can I export a blocklist for my firewall?
Yes. /reputation/export/ips supports plain CIDR, nftables, ipset, Postfix, JSON and CSV.
Is there a rate limit on abuse reports?
Yes. New reports are limited per reporter per rolling hour (default 100). Responses carry X-RateLimit headers, and a 429 adds Retry-After. A repeat of a live report does not use a slot.
Does a good standing mean the IP is safe?
No. Good means no live reports say otherwise. It is the default.
How do I authenticate?
X-API-Key or a bearer token. Reading standing and feeds uses the ip.read scope; filing reports uses ip.report.