Blacklist / DNSBL module

{
    "ok": true,
    "id": "blacklist-c15b5a27e0b81a54",
    "version": "2026-04-15-b1",
    "generated_at": "2026-04-17T16:29:40+00:00",
    "generated_at_ts": 1776443380,
    "ip": "216.73.216.171",
    "public_ip": true,
    "reverse_dns": "",
    "request": {
        "host": "cpa.tg",
        "scheme": "https",
        "request_uri": "/check/blacklist.php",
        "user_agent": "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])",
        "observed_at": "2026-04-17T16:29:40+00:00"
    },
    "config": {
        "enabled": true,
        "cache_ttl_seconds": 1800,
        "timeout_seconds": 3,
        "limited_mode": true
    },
    "provider_catalog": [
        {
            "id": "spamhaus_zen",
            "kind": "dnsbl",
            "label": "Spamhaus ZEN",
            "enabled": false,
            "configured": true,
            "zone": "zen.spamhaus.org",
            "requires_key": false,
            "url_template": "",
            "threshold": null,
            "notes": "Classic DNSBL zone. Disabled by default and only runs when explicitly enabled."
        },
        {
            "id": "spamcop_bl",
            "kind": "dnsbl",
            "label": "Spamcop BL",
            "enabled": false,
            "configured": true,
            "zone": "bl.spamcop.net",
            "requires_key": false,
            "url_template": "",
            "threshold": null,
            "notes": "Optional DNSBL scaffold for a second provider."
        },
        {
            "id": "abuseipdb",
            "kind": "http_json",
            "label": "AbuseIPDB",
            "enabled": false,
            "configured": false,
            "zone": "",
            "requires_key": true,
            "url_template": "https://api.abuseipdb.com/api/v2/check?ipAddress=%s\u0026maxAgeInDays=90\u0026verbose",
            "threshold": 25,
            "notes": "HTTP JSON scaffold. Only runs when an API key is configured and the provider is explicitly enabled."
        }
    ],
    "providers": [],
    "local_reputation": {
        "available": true,
        "state": "detected",
        "headline": "Local reputation signals detected",
        "summary": "Existing IP intelligence sees route traits that should be reviewed together with DNS, WebRTC and transport.",
        "signals": [
            "datacenter",
            "cloud:AWS"
        ],
        "risk_score": null,
        "source": "ipwho.is",
        "proxy": null,
        "vpn": null,
        "tor": null,
        "datacenter": true,
        "cloud_provider": "AWS",
        "hostname": ""
    },
    "summary": {
        "status": "limited",
        "label": "Limited",
        "reason": "No DNSBL providers are configured yet, but local reputation signals already suggest this route deserves scrutiny.",
        "configured_provider_count": 0,
        "checked_provider_count": 0,
        "listed_provider_count": 0,
        "local_signal_count": 2
    },
    "notes": [
        "Limited mode: no blacklist providers are enabled yet.",
        "Set at least one provider flag in app.env to switch from scaffold-only mode to a real lookup.",
        "Local reputation still detected route traits: datacenter, cloud:AWS."
    ],
    "cache": {
        "hit": false,
        "key": "c15b5a27e0b81a5400e1253b774bd75743a66e78a82bc2aa55498fe46e59e76a",
        "ttl_seconds": 1800
    }
}