AbuseIPDB

AbuseIPDB is a threat intelligence platform that enables users to report, check, and analyze abusive IP addresses to enhance network security.

AbuseIPDB is a leading threat intelligence platform for reporting and tracking abusive IP addresses across the internet. This connector enables Swimlane Turbine users to automate IP reputation checks, submit and retrieve abuse reports, and manage blacklists directly within their security workflows. By integrating AbuseIPDB, security teams can rapidly identify, report, and block malicious IPs, streamline incident response, and reduce manual effort in threat management. The connector supports bulk operations and granular controls, empowering users to efficiently protect their environments from abusive network activity.

Prerequisites

To use the AbuseIPDB connector, ensure you have the following prerequisites:

API Key Authentication is required to access AbuseIPDB services. You will need:

URL: The base endpoint for the AbuseIPDB API service.

API Key: A valid API key issued by AbuseIPDB for authenticating requests.

Capabilities

The AbuseIPDB connector has the following capabilities:

Check IP

Report IP

Report

Blacklist

Check CIDR block

Notes

The connector uses AbuseIPDB's version 2 API.

This connector was last tested against product version: v2 API

Additional Documentation

AbuseIPDB Connector Documentation

AbuseIPDB API Documentation

AbuseIPDB Authentication Guide

Configurations

API Key Authentication

Authenticates using an API Key

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
Key	API key	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

IP Blacklisting

Add an IP address to the AbuseIPDB blacklist to block its access to network resources and enhance security.

Endpoint

URL: api/v2/blacklist

Method: GET

Input

Argument Name	Type	Required	Description
parameters.confidenceMinimum	number	Optional	Parameters for the IP Blacklisting action
parameters.limit	number	Optional	Parameters for the IP Blacklisting action
parameters.plaintext	string	Optional	Parameters for the IP Blacklisting action
parameters.onlyCountries	string	Optional	Parameters for the IP Blacklisting action
parameters.exceptCountries	string	Optional	Parameters for the IP Blacklisting action

Input Example

{"parameters":{"confidenceMinimum":100,"limit":10000,"plaintext":"","onlyCountries":"US,CA","exceptCountries":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
meta	object	Output field: meta
meta.generatedAt	string	Output field: meta.generatedAt
data	array	Response data
data.ipAddress	string	Response data
data.countryCode	string	Response data
data.abuseConfidenceScore	number	Response data
data.lastReportedAt	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 15 Dec 2022 19:59:10 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, private","X-RateLimit-Limit":"5","X-RateLimit-Remaining":"3","CF-Cache-Status":"DYNAMIC","Report-To":"{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v3?s=npFMCp%2FiJ6B...","NEL":"{\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}","Server":"cloudflare","CF-RAY":"...

Bulk IP Reporting

Submit multiple IP addresses to AbuseIPDB for reporting abusive behavior or suspicious activity in a single request.

Endpoint

URL: api/v2/bulk-report

Method: POST

Input

Argument Name	Type	Required	Description
file	object	Optional	Parameter for Bulk IP Reporting
file.file	string	Optional	Parameter for Bulk IP Reporting
file.filename	string	Optional	Name of the resource

Input Example

{"file":{"file":"string","filename":"Example Name"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.savedReports	number	Response data
data.invalidReports	array	Response data
data.invalidReports.file_name	string	Response data
data.invalidReports.file	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 15 Dec 2022 20:42:26 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, private","X-RateLimit-Limit":"5","X-RateLimit-Remaining":"2","CF-Cache-Status":"DYNAMIC","Report-To":"{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v3?s=5PR4Q%2BYIz58...","NEL":"{\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}","Server":"cloudflare","CF-RAY":"...

IP Address Check

Query AbuseIPDB to determine if a specified IP address has been reported for abusive activity, using the ipAddress parameter.

Endpoint

URL: api/v2/check

Method: GET

Input

Argument Name	Type	Required	Description
parameters.ipAddress	string	Required	Parameters for the IP Address Check action
parameters.maxAgeInDays	number	Optional	Parameters for the IP Address Check action
parameters.verbose	string	Optional	Parameters for the IP Address Check action

Input Example

{"parameters":{"ipAddress":"8.8.8.8","maxAgeInDays":90,"verbose":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.ipAddress	string	Response data
data.isPublic	boolean	Response data
data.ipVersion	number	Response data
data.isWhitelisted	boolean	Response data
data.abuseConfidenceScore	number	Response data
data.countryCode	string	Response data
data.usageType	string	Response data
data.isp	string	Response data
data.domain	string	Response data
data.hostnames	array	Response data
data.countryName	string	Response data
data.totalReports	number	Response data
data.numDistinctUsers	number	Response data
data.lastReportedAt	string	Response data
data.reports	array	Response data
data.reports.reportedAt	string	Response data
data.reports.comment	string	Response data
data.reports.categories	array	Response data
data.reports.reporterId	number	Response data
data.reports.reporterCountryCode	string	Response data
data.reports.reporterCountryName	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 15 Dec 2022 19:55:44 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, private","X-RateLimit-Limit":"1000","X-RateLimit-Remaining":"999","CF-Cache-Status":"DYNAMIC","Report-To":"{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v3?s=EzwiKtgj%2BbP...","NEL":"{\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}","Server":"cloudflare","CF-R...

Check IP Block

Query AbuseIPDB to assess the reputation of all IP addresses within a specified network block using the required 'network' parameter.

Endpoint

URL: api/v2/check-block

Method: GET

Input

Argument Name	Type	Required	Description
parameters.network	string	Required	Parameters for the Check IP Block action
parameters.maxAgeInDays	number	Optional	Parameters for the Check IP Block action

Input Example

{"parameters":{"network":"127.0.0.1/24","maxAgeInDays":30}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.networkAddress	string	Response data
data.netmask	string	Response data
data.minAddress	string	Response data
data.maxAddress	string	Response data
data.numPossibleHosts	number	Response data
data.addressSpaceDesc	string	Response data
data.reportedAddress	array	Response data
data.reportedAddress.ipAddress	string	Response data
data.reportedAddress.numReports	number	Response data
data.reportedAddress.mostRecentReport	string	Response data
data.reportedAddress.abuseConfidenceScore	number	Response data
data.reportedAddress.countryCode	object	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 15 Dec 2022 19:57:03 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, private","X-RateLimit-Limit":"100","X-RateLimit-Remaining":"98","CF-Cache-Status":"DYNAMIC","Report-To":"{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v3?s=0psRvg6dUiCXk...","NEL":"{\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}","Server":"cloudflare","CF-RAY...

Clear IP Address

Remove a specified IP address from the AbuseIPDB blacklist by providing the ipAddress.

Endpoint

URL: api/v2/clear-address

Method: DELETE

Input

Argument Name	Type	Required	Description
ipAddress	string	Optional	Parameter for Clear IP Address

Input Example

{"json_body":{"ipAddress":"8.8.8.8"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.numReportsDeleted	number	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 15 Dec 2022 19:57:28 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, private","X-RateLimit-Limit":"5","X-RateLimit-Remaining":"4","CF-Cache-Status":"DYNAMIC","Report-To":"{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v3?s=3YFmagrDme5Hm...","NEL":"{\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}","Server":"cloudflare","CF-RAY":"...

Report IP Activity

Submit a report to AbuseIPDB for a specified IP address, including categories that describe the detected abusive activity.

Endpoint

URL: api/v2/report

Method: POST

Input

Argument Name	Type	Required	Description
ip	string	Optional	Parameter for Report IP Activity
categories	string	Optional	Parameter for Report IP Activity
comment	string	Optional	Parameter for Report IP Activity

Input Example

{"json_body":{"ip":"8.8.8.8","categories":"1,2","comment":""}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.ipAddress	string	Response data
data.abuseConfidenceScore	number	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 15 Dec 2022 19:57:44 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, private","X-RateLimit-Limit":"1000","X-RateLimit-Remaining":"999","CF-Cache-Status":"DYNAMIC","Report-To":"{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v3?s=KVzUEd%2FNFOG...","NEL":"{\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}","Server":"cloudflare","CF-R...

IP Address Reports

Retrieve reports for a specified IP address from AbuseIPDB using the required ipAddress parameter.

Endpoint

URL: api/v2/reports

Method: GET

Input

Argument Name	Type	Required	Description
parameters.ipAddress	string	Required	Parameters for the IP Address Reports action
parameters.maxAgeInDays	number	Optional	Parameters for the IP Address Reports action
parameters.page	number	Optional	Parameters for the IP Address Reports action
parameters.perPage	number	Optional	Parameters for the IP Address Reports action

Input Example

{"parameters":{"ipAddress":"8.8.8.8","maxAgeInDays":90,"page":1,"perPage":25}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.total	number	Response data
data.page	number	Response data
data.count	number	Response data
data.perPage	number	Response data
data.lastPage	number	Response data
data.nextPageUrl	string	Response data
data.previousPageUrl	object	Response data
data.results	array	Response data
data.results.reportedAt	string	Response data
data.results.comment	string	Response data
data.results.categories	array	Response data
data.results.reporterId	number	Response data
data.results.reporterCountryCode	string	Response data
data.results.reporterCountryName	string	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Thu, 15 Dec 2022 19:57:55 GMT","Content-Type":"application/json","Transfer-Encoding":"chunked","Connection":"keep-alive","Cache-Control":"no-cache, private","X-RateLimit-Limit":"100","X-RateLimit-Remaining":"99","CF-Cache-Status":"DYNAMIC","Report-To":"{\"endpoints\":[{\"url\":\"https:\\/\\/a.nel.cloudflare.com\\/report\\/v3?s=Z8Id6rR5ew4mW...","NEL":"{\"success_fraction\":0,\"report_to\":\"cf-nel\",\"max_age\":604800}","Server":"cloudflare","CF-RAY...

Response Headers

Header	Description	Example
Cache-Control	Directives for caching mechanisms	no-cache, private
CF-Cache-Status	HTTP response header: CF-Cache-Status	DYNAMIC
CF-RAY	HTTP response header: CF-RAY	77a1bf01a83f25e5-GIG
Connection	HTTP response header: Connection	keep-alive
Content-Encoding	HTTP response header: Content-Encoding	gzip
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 15 Dec 2022 19:57:03 GMT
NEL	HTTP response header: NEL	{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To	HTTP response header: Report-To	{"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v3?s=KVzUEd%2FNFOGIenl%2FSDbuxHW3Grix8CdE71hZ%2BhWuS7zwxSu4QaNjMD63aGGws7%2F7Yetx9Q1FH%2FTAPN4xM3yZ1UVv4UddfaAKs2hW1ywD1hXmDDnc%2BAVLjljyLss7Hv0g90c4"}],"group":"cf-nel","max_age":604800}
Server	Information about the software used by the origin server	cloudflare
Transfer-Encoding	HTTP response header: Transfer-Encoding	chunked
X-RateLimit-Limit	The number of requests allowed in the current rate limit window	100
X-RateLimit-Remaining	The number of requests remaining in the current rate limit window	4