AbuseIPDB.

AbuseIPDB is a project dedicated to helping make the internet safer by providing a central repository for reporting and checking IP addresses associated with malicious activities.

Supported tools and triggers

Each tool is a typed function your agent can call. Each trigger fires an agent run when something changes upstream.

Bulk Report

Submit multiple IP abuse reports to AbuseIPDB in bulk via CSV upload. Use this when you need to report many malicious IPs at once instead of one-by-one. Returns the count of successfully saved reports and details about any invalid entries.

TOOL

Check Block

Tool to check the reputation of all IP addresses in a CIDR range. Use when you need aggregated abuse data for a network block.

TOOL

Check IP Reputation

Tool to check the reputation of an IP address. Use when you need to determine if an IP address has been reported for abusive activity within a specified look-back period. Example: CheckIp(ipAddress='8.8.8.8', maxAgeInDays=90).

TOOL

Clear Address Reports

Tool to remove all reports associated with a specific IP address. Use when you need to purge your own abuse records after verifying control of the IP.

TOOL

Get Abuse Reports

Retrieve abuse reports for a specific IP address from AbuseIPDB. Use this tool to view the history of abuse complaints filed against an IP address, including the reported abuse categories, reporter details, and timestamps. Supports pagination for IPs with many reports.

TOOL

Retrieve IP Blacklist

Retrieves a list of the most reported malicious IP addresses from AbuseIPDB's database. Use this tool to build dynamic blocklists, threat intelligence feeds, or firewall rules. The blacklist is updated hourly and contains IPs with high abuse confidence scores. Free accounts receive up to 10,000 IPs. Paid subscriptions unlock filtering options (confidenceMinimum, country filters) and higher limits (up to 500,000 IPs).

TOOL

Integrations›AbuseIPDB