AbuseIPDB
IP-reputation data source for checking, reporting, and blacklisting IP addresses associated with malicious activity.
Three ways to use AbuseIPDB
Chat with Geni
Ask Geni to pull data, take actions, or answer questions using this integration in a conversation.
Build a workflow
Create automated workflows that trigger on events, run on a schedule, or chain multiple tools together.
Power an app
Use this integration as a data source or action layer behind a dashboard, form, or internal tool.
Supported tools
Actions your AI agents can perform with AbuseIPDB.
Bulk Report IPs
Submit many abuse reports at once by uploading a CSV file.
Check CIDR Block
Check every reported IP address within a CIDR network block.
Check IP Reputation
Look up the abuse reputation and metadata of a single IP address.
Clear Address Reports
Remove all abuse reports your own account has filed against an IP address.
Download Blacklist
Download the list of most-reported malicious IP addresses.
Get Abuse Reports
Retrieve the paginated history of abuse reports filed against an IP address.
Get started automating AbuseIPDB
Ready-to-use workflows
Prompts using AbuseIPDB
Bulk-report abusive IPs to AbuseIPDB from server logs
Paste raw log lines or a list of blocked IPs, check every address for existing abuse reports, assign categories, and file the whole batch in one reviewed pass.
IP reputation investigation console for security teams
Paste any suspicious IP address and get a side by side verdict from AbuseIPDB and VirusTotal, plus a shared log of every past investigation.
Firewall change review board for IP block and allow requests
Replace the firewall request spreadsheet with a board that checks every address against threat intelligence before anyone approves a change.
Trace phishing emails to the sending IP and report abuse
Every 15 minutes, forwarded phishing reports get traced back to the server that really sent them, with a verdict in Slack and the worst senders reported.
Daily malicious IP threat brief for your security team
Every weekday morning, get a short brief of the internet's most-reported malicious IPs, double-checked against a second source and posted straight to your security Slack channel.
Daily IP reputation screening with Slack threat alerts
Every morning we check your list of IP addresses for abusive activity, update your spreadsheet, and alert your team only about the risky ones.
Weekly self-audit of your company's IP address reputation
Every Monday we scan your office, VPN, mail, and hosting IP ranges for abuse reports, post a summary to Slack, and open a ticket when anything crosses your risk line.
Nightly AbuseIPDB threat list sync to Cloudflare firewall
Every night we pull the most-reported malicious IPs from AbuseIPDB and block them at your Cloudflare edge, so bad traffic never reaches your site.