lookup-abuseipdb

Retrieve AbuseIPDB abuse-report history for an IP address.

15|5|Updated Apr 6, 2026
One-click install
npx skills add https://github.com/Liberty91LTD/cti-skills --skill lookup-abuseipdb
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: lookup-abuseipdb
Source: https://github.com/Liberty91LTD/cti-skills/tree/main/skills/lookup-abuseipdb
Command: npx skills add https://github.com/Liberty91LTD/cti-skills --skill lookup-abuseipdb

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Retrieves abuse-report history for an IP address using AbuseIPDB, including confidence scores, total reports, and reporter counts.

Core Features & Use Cases

  • IP reputation lookup: fetch abuse reports, confidence scores, and usage type for an IPv4/IPv6 address.
  • Threat context: support incident triage and threat intel reporting with historical abuse data.
  • Real-world scenario: investigator looks up an IP to assess whether it has a history of abuse for risk assessment.

Quick Start

Run the AbuseIPDB lookup by providing an IP address to retrieve its abuse history.

Frequently Asked Questions about lookup-abuseipdb

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check IP reputation and abuse history during threat intelligence investigations?

To check IP reputation, you can fetch abuse history from AbuseIPDB, which retrieves abuse confidence scores, total reports, and distinct reporter counts for an IPv4 or IPv6 address. This supports incident triage and threat intelligence reporting by providing historical abuse context.

What specific abuse report details are returned when I look up an IP address?

Looking up an IP address returns structured results including abuse_confidence, total_reports, distinct_reporters, last_reported, country, and ISP information. These fields help assess an IP's historical abuse activity and support risk assessment.

Do I need an API key to fetch IP abuse reports from AbuseIPDB?

Yes, retrieving IP abuse reports from AbuseIPDB requires an API key. You must provide this key to authenticate requests and fetch the abuse confidence, reporter counts, and other reputation data for your investigation.

Can I use AbuseIPDB lookup data for incident triage and risk assessment?

Yes, AbuseIPDB lookup data is designed for incident triage and risk assessment. It provides the abuse confidence score and historical report counts needed to evaluate whether an IP address poses a threat during security investigations.

Does the IP reputation lookup support both IPv4 and IPv6 addresses?

Yes, the IP reputation lookup supports both IPv4 and IPv6 addresses. You can provide either address format to retrieve the abuse history, confidence scores, and ISP details from AbuseIPDB.