# AbuseIPDB

> Check IP addresses against AbuseIPDB, the shared database of addresses seen attacking servers: get an abuse confidence score, see who reported an address and why, check a whole network, pull the blacklist of the most-reported addresses, and report attackers yourself.

App · Compliance & Security · 7 actions. Web page: https://docs.lodol.com/docs/integrations/abuseipdb

## Actions

### Check IP address

Find out how likely an IP address is to be abusive: its abuse confidence score from 0 to 100, how often it was reported, and who runs it (company, kind of network and country). An address nobody reported is an answer, not an error: its score is 0.

**Inputs**

- IP address (`ip_address`, text, required): The IPv4 or IPv6 address to look up.
- Days to look back (`max_age_days`, number): Only count reports from this many days back. From 1 to 365. Default: `30`.

**Outputs**

- `abuse_confidence_score` (number): How sure AbuseIPDB is that the address is abusive, from 0 to 100. AbuseIPDB recommends blocking at 75 or more
- `country_code` (text): Two-letter code of the country it is in, e.g. US
- `distinct_reporters` (number): How many different users reported it
- `domain` (text): That company's domain
- `hostnames` (list): Host names that point to the address
- `ip_address` (text): The address checked
- `ip_version` (number): 4 or 6
- `is_public` (true/false): False for private and reserved addresses, like 192.168.x.x
- `is_tor` (true/false): True for a Tor exit node
- `is_whitelisted` (true/false): True when it is on one of AbuseIPDB's lists of known-good addresses. Empty when not looked up
- `isp` (text): The company that runs the network
- `last_reported_at` (text): When it was last reported (ISO 8601), or empty if never
- `total_reports` (number): How many times it was reported in the days looked back
- `usage_type` (text): What kind of network it belongs to, such as Data Center/Web Hosting/Transit, Fixed Line ISP or Mobile ISP

**Example output**

```json
{
  "abuse_confidence_score": 100,
  "country_code": "CN",
  "distinct_reporters": 17,
  "domain": "tencent.com",
  "hostnames": [],
  "ip_address": "118.25.6.39",
  "ip_version": 4,
  "is_public": true,
  "is_tor": false,
  "is_whitelisted": false,
  "isp": "Tencent Cloud Computing (Beijing) Co. Ltd",
  "last_reported_at": "2026-09-26T20:55:14+00:00",
  "total_reports": 42,
  "usage_type": "Data Center/Web Hosting/Transit"
}
```

### Check network

Find every reported IP address in a network, such as 203.0.113.0/24, with each one's abuse confidence score. Give a single IP address to check the /24 network around it. The free plan checks networks up to /24, going back up to 30 days.

**Inputs**

- Network (`network`, text, required): The network in CIDR notation, like 203.0.113.0/24, or one IP address to check the /24 around it.
- Days to look back (`max_age_days`, number): Only reports from this many days back. The free plan allows up to 30. From 1 to 365. Default: `30`.

**Outputs**

- `network` (text): The network checked, in CIDR notation, e.g. 203.0.113.0/24. A single address given as the network comes back as the /24 around it (the /64 for IPv6)
- `reported_address_count` (number): How many addresses were reported
- `reported_addresses` (list): The reported addresses, highest confidence first

**Example output**

```json
{
  "network": "118.25.6.0/24",
  "reported_address_count": 1,
  "reported_addresses": [
    {
      "abuse_confidence_score": 100,
      "country_code": "CN",
      "ip_address": "118.25.6.39",
      "last_reported_at": "2026-09-26T20:55:14+00:00",
      "report_count": 42
    }
  ]
}
```

### Delete my reports

Delete every report your account made of an IP address, for example one reported by mistake. Other users' reports stay.

**Inputs**

- IP address (`ip_address`, text, required): The address whose reports to delete.

**Outputs**

- `deleted_count` (number): How many of your reports were deleted
- `ip_address` (text): The address

**Example output**

```json
{
  "deleted_count": 1,
  "ip_address": "118.25.6.39"
}
```

### Get blacklist

Get AbuseIPDB's blacklist: the most-reported IP addresses, most certain and most recently reported first. Use it to keep a firewall or blocklist up to date.

**Inputs**

- Minimum confidence (`confidence_minimum`, number): Only addresses AbuseIPDB is at least this sure are abusive, from 25 to 100. Paid plans only: free accounts always get 100. From 25 to 100. Default: `100`.
- Maximum IP addresses (`limit`, number): How many addresses to get, up to 10,000. From 1 to 10000. Default: `100`.
- IP version (`ip_version`, text): Which kind of address to include. One of: `all` (IPv4 and IPv6), `4` (IPv4 only), `6` (IPv6 only). Default: `all`.

**Outputs**

- `count` (number): How many addresses came back
- `generated_at` (text): When AbuseIPDB built this list (ISO 8601)
- `ip_addresses` (list): The blacklisted addresses

**Example output**

```json
{
  "count": 2,
  "generated_at": "2026-09-27T19:54:11+00:00",
  "ip_addresses": [
    {
      "abuse_confidence_score": 100,
      "ip_address": "5.188.10.179",
      "last_reported_at": "2026-09-27T19:17:02+00:00"
    },
    {
      "abuse_confidence_score": 100,
      "ip_address": "185.222.209.14",
      "last_reported_at": "2026-09-27T19:17:02+00:00"
    }
  ]
}
```

### List reports

Get the reports filed against an IP address, newest first: when, what for, and what each reporter saw.

**Inputs**

- IP address (`ip_address`, text, required): The IPv4 or IPv6 address to look up.
- Days to look back (`max_age_days`, number): Only reports from this many days back. From 1 to 365. Default: `30`.
- Maximum reports (`limit`, number): How many reports to get, up to 100. From 1 to 100. Default: `25`.
- Page (`page`, number): Which page of reports to get when there are more than the maximum. Page 1 is the newest. At least 1. Default: `1`.

**Outputs**

- `has_more` (true/false): True when there are older reports on later pages
- `ip_address` (text): The address
- `last_page` (number): The number of the last page
- `page` (number): This page's number
- `reports` (list): The reports on this page, newest first
- `total` (number): How many reports there are in all

**Example output**

```json
{
  "has_more": true,
  "ip_address": "118.25.6.39",
  "last_page": 2,
  "page": 1,
  "reports": [
    {
      "categories": [
        "Brute-Force",
        "SSH"
      ],
      "comment": "Invalid user oracle from 118.25.6.39",
      "reported_at": "2026-09-26T20:55:14+00:00",
      "reporter_country_code": "US",
      "reporter_country_name": "United States of America",
      "reporter_id": 1
    }
  ],
  "total": 42
}
```

### Report IP address

Report an IP address that attacked you, and get back its updated abuse confidence score. AbuseIPDB takes one report of an address from your account every 15 minutes: a second one comes back with 'reported' false instead of stopping the run.

**Inputs**

- IP address (`ip_address`, text, required): The IPv4 or IPv6 address to report.
- Categories (`categories`, list, required): What the address did. Choose every category that fits, for example Brute-Force and SSH for repeated SSH login attempts. One or more of: `19` (Bad Web Bot), `12` (Blog Spam), `18` (Brute-Force), `4` (DDoS Attack), `1` (DNS Compromise), `2` (DNS Poisoning), `11` (Email Spam), `20` (Exploited Host), `5` (FTP Brute-Force), `3` (Fraud Orders), and 13 more.
- Comment (`comment`, text): What you saw, such as log lines or the port that was attacked. It is public, so leave out names, email addresses and anything else personal.
- When it happened (`attacked_at`, date and time): When the attack happened, or when you first saw it. Leave it empty for now. It can't be more than two months ago.

**Outputs**

- `abuse_confidence_score` (number): Its abuse confidence score after this report, from 0 to 100. Empty when not reported
- `categories` (list): The categories it was reported for
- `ip_address` (text): The address reported
- `reported` (true/false): True when the report was saved. False when your account already reported this address in the last 15 minutes

**Example output**

```json
{
  "abuse_confidence_score": 52,
  "categories": [
    "Brute-Force",
    "SSH"
  ],
  "ip_address": "118.25.6.39",
  "reported": true
}
```

### Report IP addresses in bulk

Report up to 9,999 IP addresses at once, all with the same categories and comment. Addresses that can't be reported (not an IP address, or a duplicate) are listed with the reason, and the rest are still reported.

**Inputs**

- IP addresses (`ip_addresses`, list, required): The addresses to report. A list from an earlier step, or addresses separated by commas or new lines.
- Categories (`categories`, list, required): What the address did. Choose every category that fits, for example Brute-Force and SSH for repeated SSH login attempts. One or more of: `19` (Bad Web Bot), `12` (Blog Spam), `18` (Brute-Force), `4` (DDoS Attack), `1` (DNS Compromise), `2` (DNS Poisoning), `11` (Email Spam), `20` (Exploited Host), `5` (FTP Brute-Force), `3` (Fraud Orders), and 13 more.
- Comment (`comment`, text): What you saw, such as log lines or the port that was attacked. It is public, so leave out names, email addresses and anything else personal.
- When it happened (`attacked_at`, date and time): When the attack happened, or when you first saw it. Leave it empty for now. It can't be more than two months ago.

**Outputs**

- `categories` (list): The categories it was reported for
- `rejected` (list): The entries that were not reported
- `rejected_count` (number): How many could not be reported
- `reported_count` (number): How many addresses were reported

**Example output**

```json
{
  "categories": [
    "Brute-Force",
    "SSH"
  ],
  "rejected": [
    {
      "ip_address": "127.0.foo.bar",
      "reason": "Not an IP address"
    }
  ],
  "rejected_count": 1,
  "reported_count": 2
}
```