Daily IP reputation screening with Slack threat alerts

Every morning at 7am, run on a cron schedule to screen my IP watchlist against AbuseIPDB and only bother me about the risky ones.

First, read the column of IP addresses from my Google Sheet using Google Sheets' Get Values. These are the IPs hitting our login and API endpoints, or an allowlist we want to keep clean. Assume the IPs sit in a single column (for example column A, with a header row) and read the current values each run so we always work from the latest list.

For each IP, check its abuse reputation with AbuseIPDB's Check IP Reputation. AbuseIPDB enforces a daily per-endpoint quota, so cap how many rows are checked per run (default to the first 200 IPs) to avoid exhausting the quota. The abuseConfidenceScore is an integer from 0 to 100, where higher means more likely malicious.

Write the abuse confidence score, the last-reported date, and the top abuse category back next to each IP using Google Sheets' Update Values, so the sheet stays current. AbuseIPDB returns abuse categories as integer IDs, so translate them to words before writing (for example 18 = Brute-Force, 22 = SSH, 14 = Port Scan, 4 = DDoS, 10 = Email Spam). Use the most-reported category as the top abuse category.

For any IP whose confidence score crosses the threshold I set (default 75), post a Slack alert with Send a Message that names the IP, its score, and what it has been reported for, so my team can decide whether to block it. Only alert on IPs at or above the threshold to avoid noise; the clean IPs should still be updated in the sheet but should not trigger a message.

If several IPs cross the threshold in the same run, group them into a single Slack alert so the channel is not flooded, listing each risky IP with its score and top abuse category.