AbuseIPDB
App · Compliance & Security · 7 actions
Check IP addresses against AbuseIPDB, the shared database of addresses seen attacking servers: get an abuse confidence score, see who reported an address and why, check a whole network, pull the blacklist of the most-reported addresses, and report attackers yourself.
Actions
| Action | What it does |
|---|---|
| Check IP address | Find out how likely an IP address is to be abusive: its abuse confidence score from 0 to 100, how often it was reported, and who runs it (company, kind of network and country). |
| Check network | Find every reported IP address in a network, such as 203.0.113.0/24, with each one's abuse confidence score. |
| Delete my reports | Delete every report your account made of an IP address, for example one reported by mistake. |
| Get blacklist | Get AbuseIPDB's blacklist: the most-reported IP addresses, most certain and most recently reported first. |
| List reports | Get the reports filed against an IP address, newest first: when, what for, and what each reporter saw. |
| Report IP address | Report an IP address that attacked you, and get back its updated abuse confidence score. |
| Report IP addresses in bulk | Report up to 9,999 IP addresses at once, all with the same categories and comment. |
Check IP address
Find out how likely an IP address is to be abusive: its abuse confidence score from 0 to 100, how often it was reported, and who runs it (company, kind of network and country). An address nobody reported is an answer, not an error: its score is 0.
Inputs
- IP address
ip_addresstextRequired - The IPv4 or IPv6 address to look up.
- Days to look back
max_age_daysnumber - Only count reports from this many days back.From 1 to 365. Default:
30.
Outputs
abuse_confidence_scorenumber- How sure AbuseIPDB is that the address is abusive, from 0 to 100. AbuseIPDB recommends blocking at 75 or more
country_codetext- Two-letter code of the country it is in, e.g. US
distinct_reportersnumber- How many different users reported it
domaintext- That company's domain
hostnameslist- Host names that point to the address
ip_addresstext- The address checked
ip_versionnumber- 4 or 6
is_publictrue/false- False for private and reserved addresses, like 192.168.x.x
is_tortrue/false- True for a Tor exit node
is_whitelistedtrue/false- True when it is on one of AbuseIPDB's lists of known-good addresses. Empty when not looked up
isptext- The company that runs the network
last_reported_attext- When it was last reported (ISO 8601), or empty if never
total_reportsnumber- How many times it was reported in the days looked back
usage_typetext- What kind of network it belongs to, such as Data Center/Web Hosting/Transit, Fixed Line ISP or Mobile ISP
Example output
{
"abuse_confidence_score": 100,
"country_code": "CN",
"distinct_reporters": 17,
"domain": "tencent.com",
"hostnames": [],
"ip_address": "118.25.6.39",
"ip_version": 4,
"is_public": true,
"is_tor": false,
"is_whitelisted": false,
"isp": "Tencent Cloud Computing (Beijing) Co. Ltd",
"last_reported_at": "2026-09-26T20:55:14+00:00",
"total_reports": 42,
"usage_type": "Data Center/Web Hosting/Transit"
}Check network
Find every reported IP address in a network, such as 203.0.113.0/24, with each one's abuse confidence score. Give a single IP address to check the /24 network around it. The free plan checks networks up to /24, going back up to 30 days.
Inputs
- Network
networktextRequired - The network in CIDR notation, like 203.0.113.0/24, or one IP address to check the /24 around it.
- Days to look back
max_age_daysnumber - Only reports from this many days back. The free plan allows up to 30.From 1 to 365. Default:
30.
Outputs
networktext- The network checked, in CIDR notation, e.g. 203.0.113.0/24. A single address given as the network comes back as the /24 around it (the /64 for IPv6)
reported_address_countnumber- How many addresses were reported
reported_addresseslist- The reported addresses, highest confidence first
Example output
{
"network": "118.25.6.0/24",
"reported_address_count": 1,
"reported_addresses": [
{
"abuse_confidence_score": 100,
"country_code": "CN",
"ip_address": "118.25.6.39",
"last_reported_at": "2026-09-26T20:55:14+00:00",
"report_count": 42
}
]
}Delete my reports
Delete every report your account made of an IP address, for example one reported by mistake. Other users' reports stay.
Inputs
- IP address
ip_addresstextRequired - The address whose reports to delete.
Outputs
deleted_countnumber- How many of your reports were deleted
ip_addresstext- The address
Example output
{
"deleted_count": 1,
"ip_address": "118.25.6.39"
}Get blacklist
Get AbuseIPDB's blacklist: the most-reported IP addresses, most certain and most recently reported first. Use it to keep a firewall or blocklist up to date.
Inputs
- Minimum confidence
confidence_minimumnumber - Only addresses AbuseIPDB is at least this sure are abusive, from 25 to 100. Paid plans only: free accounts always get 100.From 25 to 100. Default:
100. - Maximum IP addresses
limitnumber - How many addresses to get, up to 10,000.From 1 to 10000. Default:
100. - IP version
ip_versiontext - Which kind of address to include.One of:
all(IPv4 and IPv6),4(IPv4 only),6(IPv6 only). Default:all.
Outputs
countnumber- How many addresses came back
generated_attext- When AbuseIPDB built this list (ISO 8601)
ip_addresseslist- The blacklisted addresses
Example output
{
"count": 2,
"generated_at": "2026-09-27T19:54:11+00:00",
"ip_addresses": [
{
"abuse_confidence_score": 100,
"ip_address": "5.188.10.179",
"last_reported_at": "2026-09-27T19:17:02+00:00"
},
{
"abuse_confidence_score": 100,
"ip_address": "185.222.209.14",
"last_reported_at": "2026-09-27T19:17:02+00:00"
}
]
}List reports
Get the reports filed against an IP address, newest first: when, what for, and what each reporter saw.
Inputs
- IP address
ip_addresstextRequired - The IPv4 or IPv6 address to look up.
- Days to look back
max_age_daysnumber - Only reports from this many days back.From 1 to 365. Default:
30. - Maximum reports
limitnumber - How many reports to get, up to 100.From 1 to 100. Default:
25. - Page
pagenumber - Which page of reports to get when there are more than the maximum. Page 1 is the newest.At least 1. Default:
1.
Outputs
has_moretrue/false- True when there are older reports on later pages
ip_addresstext- The address
last_pagenumber- The number of the last page
pagenumber- This page's number
reportslist- The reports on this page, newest first
totalnumber- How many reports there are in all
Example output
{
"has_more": true,
"ip_address": "118.25.6.39",
"last_page": 2,
"page": 1,
"reports": [
{
"categories": [
"Brute-Force",
"SSH"
],
"comment": "Invalid user oracle from 118.25.6.39",
"reported_at": "2026-09-26T20:55:14+00:00",
"reporter_country_code": "US",
"reporter_country_name": "United States of America",
"reporter_id": 1
}
],
"total": 42
}Report IP address
Report an IP address that attacked you, and get back its updated abuse confidence score. AbuseIPDB takes one report of an address from your account every 15 minutes: a second one comes back with 'reported' false instead of stopping the run.
Inputs
- IP address
ip_addresstextRequired - The IPv4 or IPv6 address to report.
- Categories
categorieslistRequired - What the address did. Choose every category that fits, for example Brute-Force and SSH for repeated SSH login attempts.One or more of:
19(Bad Web Bot),12(Blog Spam),18(Brute-Force),4(DDoS Attack),1(DNS Compromise),2(DNS Poisoning),11(Email Spam),20(Exploited Host),5(FTP Brute-Force),3(Fraud Orders), and 13 more. - Comment
commenttext - What you saw, such as log lines or the port that was attacked. It is public, so leave out names, email addresses and anything else personal.
- When it happened
attacked_atdate and time - When the attack happened, or when you first saw it. Leave it empty for now. It can't be more than two months ago.
Outputs
abuse_confidence_scorenumber- Its abuse confidence score after this report, from 0 to 100. Empty when not reported
categorieslist- The categories it was reported for
ip_addresstext- The address reported
reportedtrue/false- True when the report was saved. False when your account already reported this address in the last 15 minutes
Example output
{
"abuse_confidence_score": 52,
"categories": [
"Brute-Force",
"SSH"
],
"ip_address": "118.25.6.39",
"reported": true
}Report IP addresses in bulk
Report up to 9,999 IP addresses at once, all with the same categories and comment. Addresses that can't be reported (not an IP address, or a duplicate) are listed with the reason, and the rest are still reported.
Inputs
- IP addresses
ip_addresseslistRequired - The addresses to report. A list from an earlier step, or addresses separated by commas or new lines.
- Categories
categorieslistRequired - What the address did. Choose every category that fits, for example Brute-Force and SSH for repeated SSH login attempts.One or more of:
19(Bad Web Bot),12(Blog Spam),18(Brute-Force),4(DDoS Attack),1(DNS Compromise),2(DNS Poisoning),11(Email Spam),20(Exploited Host),5(FTP Brute-Force),3(Fraud Orders), and 13 more. - Comment
commenttext - What you saw, such as log lines or the port that was attacked. It is public, so leave out names, email addresses and anything else personal.
- When it happened
attacked_atdate and time - When the attack happened, or when you first saw it. Leave it empty for now. It can't be more than two months ago.
Outputs
categorieslist- The categories it was reported for
rejectedlist- The entries that were not reported
rejected_countnumber- How many could not be reported
reported_countnumber- How many addresses were reported
Example output
{
"categories": [
"Brute-Force",
"SSH"
],
"rejected": [
{
"ip_address": "127.0.foo.bar",
"reason": "Not an IP address"
}
],
"rejected_count": 1,
"reported_count": 2
}