AbuseIPDB API reference. IP reputation and abuse report lookups.
インストールする前に、エージェントに与えられる指示の中身を確認できます。
https://api.abuseipdb.com/api/v2
Header: Key: $ABUSEIPDB_API_KEY
Also: Accept: application/json
curl -s "https://api.abuseipdb.com/api/v2/check" \
-G -d "ipAddress={ip}" -d "maxAgeInDays=90" -d "verbose" \
-H "Key: $ABUSEIPDB_API_KEY" -H "Accept: application/json"
Useful fields:
data.abuseConfidenceScore — 0-100 abuse confidencedata.totalReports — number of abuse reportsdata.numDistinctUsers — unique reportersdata.lastReportedAt — most recent reportdata.isp — ISP namedata.usageType — usage type (Data Center, ISP, etc.)data.countryCode — countrydata.domain — associated domaindata.isTor — Tor exit node flagdata.reports[] — individual reports (with verbose)curl -s "https://api.abuseipdb.com/api/v2/check-block" \
-G -d "network={cidr}" -d "maxAgeInDays=90" \
-H "Key: $ABUSEIPDB_API_KEY" -H "Accept: application/json"
| Score | Meaning |
|---|---|
| 0 | No reports, clean |
| 1-25 | Low confidence of abuse |
| 26-50 | Moderate — some reports |
| 51-75 | High — significant abuse reports |
| 76-100 | Very high — widely reported as abusive |
ip: <IP>
abuse_confidence: <0-100>
total_reports: <number>
distinct_reporters: <number>
last_reported: <date>
isp: <ISP>
usage_type: <type>
country: <country>
is_tor: <true/false>
verdict: clean|low-risk|suspicious|malicious
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Analysis of Competing Hypotheses — structured technique for evaluating multiple explanations against evidence. Use when facing ambiguous attribution or multiple plausible scenarios. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Runs on ungraded evidence when asked, labelled as such, unweighted, and capped at Moderate confidence.
日本語の概要は準備中です。原文の説明を表示しています。
Use when documenting a named campaign across time and victims, the user asks to start or update a campaign record, or another skill identified a multi-incident cluster that warrants formal tracking. Provides the template (timeline, attribution, victimology, attack chain, Diamond Model mapping, IOC clusters) and the lifecycle from active to historical.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user asks about carding, BIN attacks, payment-card breach markets, fullz/CVV2 trade, autoshops (BidenCash, Brian's Club, Russianmarket, B1ack's Stash), or financial-fraud TTPs. Self-updating knowledge cell.
日本語の概要は準備中です。原文の説明を表示しています。
Censys API v2 reference. Host reconnaissance and certificate data.
日本語の概要は準備中です。原文の説明を表示しています。
Use when the user asks about Chinese state-sponsored cyber operations or specific PRC-aligned actors (APT41, Volt Typhoon, Mustang Panda, APT10, APT31, Salt Typhoon, etc.), MSS/PLA-attributed campaigns, or PRC sector targeting. Self-updating knowledge cell.
日本語の概要は準備中です。原文の説明を表示しています。
Use when a report or article needs to be split into individual claims before it is graded, cited or used as evidence — the user asks "what does this report actually claim?", "split this into claims", "separate the facts from the judgements", or another skill needs a claim list. Turns one document into five to twelve atomic claims, each typed (observation, attribution, assessment, actor claim, victim disclosure) and anchored to the verbatim sentence it rests on, so every extraction can be checked against the source. Preserves the source's own hedging. Does not grade. Invoked by /quality-of-information-check; its output feeds /ach, /key-assumptions-check, /intelligence-writing, /writing-assessments and /threat-actor-profiling.
日本語の概要は準備中です。原文の説明を表示しています。