# AbuseIPDB

AbuseIPDB is a project dedicated to helping make the internet safer by providing a central repository for reporting and checking IP addresses associated with malicious activities.

- **Category:** security & identity tools
- **Auth:** API_KEY
- **Composio Managed App Available?** N/A
- **Tools:** 6
- **Triggers:** 0
- **Slug:** `ABUSELPDB`
- **Version:** 20260211_00

## Tools

### Retrieve IP Blacklist

**Slug:** `ABUSELPDB_BLACKLIST`

Retrieves a list of the most reported malicious IP addresses from AbuseIPDB's database. Use this tool to build dynamic blocklists, threat intelligence feeds, or firewall rules. The blacklist is updated hourly and contains IPs with high abuse confidence scores. Free accounts receive up to 10,000 IPs. Paid subscriptions unlock filtering options (confidenceMinimum, country filters) and higher limits (up to 500,000 IPs).

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `limit` | integer | No | Maximum number of IP addresses to return. Free accounts are limited to 10,000 IPs. Paid plans allow up to 100,000 or 500,000 depending on tier. |
| `ipVersion` | integer ("4" | "6") | No | Filter by IP version: 4 for IPv4 addresses only, 6 for IPv6 addresses only. Omit to include both. |
| `onlyCountries` | string | No | Comma-separated ISO 3166-1 alpha-2 country codes to include (e.g., 'US,CA,MX'). Only IPs from these countries are returned. Requires a paid subscription. |
| `exceptCountries` | string | No | Comma-separated ISO 3166-1 alpha-2 country codes to exclude (e.g., 'CN,RU'). IPs from these countries are filtered out. Requires a paid subscription. |
| `confidenceMinimum` | integer | No | Minimum abuse confidence score (25-100) to filter reported IPs. Only IPs with scores at or above this threshold are returned. Requires a paid subscription. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Bulk Report

**Slug:** `ABUSELPDB_BULK_REPORT`

Submit multiple IP abuse reports to AbuseIPDB in bulk via CSV upload. Use this when you need to report many malicious IPs at once instead of one-by-one. Returns the count of successfully saved reports and details about any invalid entries.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `csv` | string | Yes | CSV content containing IP abuse reports. Must include headers: IP, Categories, ReportDate, Comment. IP: Valid IPv4 or IPv6 address. Categories: Comma-separated category IDs (e.g., '18,22' for SSH abuse). Common categories: 3=Fraud Orders, 4=DDoS Attack, 5=FTP Brute-Force, 6=Ping of Death, 7=Phishing, 10=Email Spam, 11=Blog Spam, 14=Port Scan, 18=Brute-Force, 19=Bad Web Bot, 21=Web Spam, 22=SSH, 23=IoT Targeted. ReportDate: ISO 8601 format recommended (e.g., '2024-01-15T10:00:00-05:00'). Comment: Description of the attack (max 1024 characters). Limit: 10,000 rows max, 8MB max file size. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Check Block

**Slug:** `ABUSELPDB_CHECK_BLOCK`

Tool to check the reputation of all IP addresses in a CIDR range. Use when you need aggregated abuse data for a network block.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `network` | string | Yes | IPv4 network in CIDR notation (e.g., '192.168.1.0/24'). Free plans only support /24 networks; paid plans may use wider ranges up to /16. |
| `maxAgeInDays` | integer | No | Number of days back to include abuse reports (1-365). Free plans are limited to 30 days max. Defaults to 30. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Check IP Reputation

**Slug:** `ABUSELPDB_CHECK_IP`

Tool to check the reputation of an IP address. Use when you need to determine if an IP address has been reported for abusive activity within a specified look-back period. Example: CheckIp(ipAddress='8.8.8.8', maxAgeInDays=90).

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `verbose` | boolean | No | When true, includes detailed abuse reports with comments, categories, and reporter information. |
| `ipAddress` | string | Yes | IP address (IPv4 or IPv6) to check for abuse reports. |
| `maxAgeInDays` | integer | No | Look-back period for reports in days (default=30, max=365). |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Clear Address Reports

**Slug:** `ABUSELPDB_CLEAR_ADDRESS`

Tool to remove all reports associated with a specific IP address. Use when you need to purge your own abuse records after verifying control of the IP.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `ipAddress` | string | Yes | A valid IPv4 or IPv6 address whose reports will be removed. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Abuse Reports

**Slug:** `ABUSELPDB_GET_REPORTS`

Retrieve abuse reports for a specific IP address from AbuseIPDB. Use this tool to view the history of abuse complaints filed against an IP address, including the reported abuse categories, reporter details, and timestamps. Supports pagination for IPs with many reports.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `page` | integer | No | Page number for pagination (1-indexed). Default is 1. |
| `perPage` | integer | No | Number of reports to return per page (1-100). Default is 25. |
| `ipAddress` | string | Yes | IPv4 or IPv6 address to retrieve reports for |
| `maxAgeInDays` | integer | No | Only return reports from the last N days (1-365). Default is 30 days. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |