AbuseIPDB API reference. IP reputation and abuse report lookups.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Liberty91LTD/cti-skills272026년 9월 30일 업데이트
무료GitHub에 공개
lookup-abuseipdb
Use when you need abuse-report history for an IPv4/IPv6 address — confidence score, total reports, distinct reporters, usage type. IP-only. Commonly invoked by /ip-investigation. Retrieval only.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
실행 점수 미검증
설치 방법 보기포함된 파일(1)
- SKILL.md4.2 KB
SKILL.md(원문)
설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.
lookup-abuseipdb
Queries AbuseIPDB for IP reputation data. IP addresses only (v4 and v6). Retrieval only — do not interpret.
When to invoke
- User asks about abuse reports for an IP
- Investigation skill needs community-reported abuse context
- Triaging whether an IP has a history of malicious behavior
How to invoke
Two CLIs are provided. Pick by capability needed:
Basic check — Node CLI (zero deps)
node tools/clis/abuseipdb.js ip <ip>
Hits the /check endpoint with a 90-day window. Best for fast retrieval inside an investigation chain.
Full read-only suite — Python CLI (stdlib only)
python3 tools/clis/abuseipdb.py check <ip> [--max-age-in-days N] [--verbose]
python3 tools/clis/abuseipdb.py reports <ip> [--per-page N] [--page N]
python3 tools/clis/abuseipdb.py check-block <cidr> [--max-age-in-days N]
python3 tools/clis/abuseipdb.py blacklist [--confidence-min N] [--limit N]
[--ip-version 4|6]
[--only-countries CC,CC]
[--except-country CC,CC]
No external deps — Python 3 stdlib only, no venv needed.
Capabilities the Node CLI doesn't have:
- Verbose check (
check --verbose) — full per-report list including category, comment, reporter ID, country. - Reports endpoint — paginated raw report history (uses zero
check-quota). - CIDR-block check (
check-block) — reputation summary across an entire network range. Useful for triaging suspicious /24s, hosting providers, ASN sub-ranges. - Blacklist download — bulk pull of high-confidence abuse IPs filtered by country / IP version / confidence threshold. Useful for ingesting into block lists.
Examples:
# Detailed report list for a suspect IP
python3 tools/clis/abuseipdb.py check 185.220.101.45 --verbose
# What's been reported in this /24 in the last 30 days?
python3 tools/clis/abuseipdb.py check-block 185.220.101.0/24
# Pull RU-only IPs with 90%+ confidence, max 500
python3 tools/clis/abuseipdb.py blacklist --only-countries RU --confidence-min 90 --limit 500
Both CLIs accept --dry-run to preview the request without calling the API. Both exit code 2 if $ABUSEIPDB_API_KEY is unset (when not in dry-run). Report missing key; do not fabricate.
Write endpoints (deferred)
AbuseIPDB also exposes /report, /bulk-report, and /clear-address for contributing reports back. These are NOT wired into either CLI by default — this skill is retrieval-focused. To contribute reports, use the AbuseIPDB web UI or write a deliberate purpose-built script with a confirmation flow.
Response format
source: abuseipdb
indicator: <IP>
query_time: <ISO8601>
abuse_confidence: <0-100>
total_reports: <number>
distinct_reporters: <number>
last_reported: <date>
isp: <ISP>
usage_type: <type>
country: <country>
is_tor: <boolean>
recent_report_categories: [<list of category IDs>]
Rate limits
Free tier: 1000 checks/day. Paid tiers have higher limits.
Source reliability (Admiralty default)
Default rating for downstream /score-source: C3 (fairly reliable, possibly true). Community-reported; false positives possible. Upgrade to B2 if distinct_reporters >10 and abuse_confidence >75.
Operational notes
- IP addresses only. The CLI rejects non-IP inputs.
- A low abuse score does NOT mean the IP is clean — just that it hasn't been widely reported.
Related skills
/lookup-greynoise— scanner/noise classification for the same IP/lookup-virustotal,/lookup-shodan,/lookup-otx— additional IP context/ip-investigation
See also
- Integration setup:
tools/integrations/abuseipdb.md - Node CLI source:
tools/clis/abuseipdb.js - Python CLI source:
tools/clis/abuseipdb.py - Official API docs: https://docs.abuseipdb.com/
리뷰
아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.
댓글
로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.
아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.
같은 저장소의 스킬
ach
무료Analysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Runs on ungraded evidence when asked, labelled as such, unweighted, and capped at Moderate confidence.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Liberty91LTD/cti-skills272026년 9월 30일 업데이트
Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Liberty91LTD/cti-skills272026년 9월 30일 업데이트
Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Liberty91LTD/cti-skills272026년 9월 30일 업데이트
Censys API v2 reference. Host reconnaissance and certificate data.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Liberty91LTD/cti-skills272026년 9월 30일 업데이트
Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Liberty91LTD/cti-skills272026년 9월 30일 업데이트