abuseipdb-api

Query AbuseIPDB to check IP reputation and parse abuse reports.

15|5|Updated Apr 6, 2026

Search Tags:#api #incident-response #threat-intelligence #network-security #abuseipdb #ip-reputation

Ready to run

npx skills add https://github.com/Liberty91LTD/cti-skills --skill abuseipdb-api

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: abuseipdb-api
Source: https://github.com/Liberty91LTD/cti-skills/tree/main/skills/abuseipdb-api
Command: npx skills add https://github.com/Liberty91LTD/cti-skills --skill abuseipdb-api

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Quickly determine if an IP is associated with abuse and gather context for incident response by querying AbuseIPDB.

Core Features & Use Cases

IP reputation checks: Validate an IP's abuse risk with confidence scores and reports from AbuseIPDB.
Abuse reports overview: Retrieve detailed history and sources to guide triage decisions.
Use Case: During network investigations, enrich alerts with abuse data to decide if the IP should be blocked or monitored.

Quick Start

Query the AbuseIPDB API for a given IP to assess its reputation and abuse history.

Frequently Asked Questions about abuseipdb-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I check IP reputation scores for incident response?▼

You can check IP reputation by querying the AbuseIPDB API to retrieve an abuse confidence score, total reports, country, and detailed abuse history to guide network security triage decisions.

Can I retrieve abuse reports and history for a specific IP address?▼

Yes, querying the AbuseIPDB API returns detailed abuse reports and history for a specific IP, exposing fields like total reports, country, and report details to guide security investigations.

Do I need an API key to query AbuseIPDB for threat intelligence?▼

Yes, you need to provide an API key to authenticate with the AbuseIPDB API when querying an IP address to retrieve its abuse history and reputation data.

What is the best way to enrich network security alerts with IP abuse data?▼

The best way to enrich network security alerts is by querying AbuseIPDB to assess IP risk, evaluating the abuse confidence score and detailed reports to decide if the IP should be blocked.

Does this approach support automated lookups for multiple endpoints or domains?▼

Yes, the AbuseIPDB API querying process supports automated lookups, allowing you to programmatically assess risk for multiple networks, endpoints, or domains during threat intel enrichment.

What abuse data fields are parsed from the AbuseIPDB API response?▼

The process parses AbuseIPDB API responses to expose critical reputation fields including the abuse confidence score, total reports, country, and specific report details for incident response.