AbuseIPDB

AbuseIPDB is a comprehensive IP address reputation and threat intelligence platform that provides critical information about malicious IP addresses, network abuse, and cybersecurity threats. This service maintains a collaborative database of reported IP addresses involved in malicious activities, including hacking attempts, spam distribution, brute force attacks, denial of service (DoS and DDoS) attacks, port scanning, vulnerability exploitation, and other forms of network abuse and cyber attacks.

Category	Threat intelligence
Direction	Query source
Sign-in	API Key
Query languages	SQLite
Tables	4
Query templates	6
Website	http://abuseipdb.com

Before you start

Huntbase signs in to AbuseIPDB with API Key. Create the credential in AbuseIPDB first, then keep it to hand for the Connect step.

1. Sign in to AbuseIPDB and open the API page of your account dashboard (https://www.abuseipdb.com/account/api).
2. Create a new API key and copy it.

Watch out for

• Daily request limits depend on your plan. The free Standard plan allows 1,000 check requests per day.

For the vendor's own instructions, see AbuseIPDB API documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect AbuseIPDB

1. Go to Connections and click New connection, or click New connection on the AbuseIPDB product page.
2. On Product, pick AbuseIPDB and choose the Owner.
3. On Details, give the connection a Name and, optionally, a Description.
4. On Connect, fill in the settings and credentials described below.
5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Credentials

The only Method is API Key. Enter a Credential label (for example Production), then fill in:

Field	Required	Notes
API Key	Yes	Secret — not shown again after you save it.

Query it

Once connected, AbuseIPDB can serve these languages in a query tab, and Scout can use it when you ask in Auto:

Language	Use it for
SQLite	SQL over the 4 tables listed below, alongside every other connected source.

Example: SQLite

Basic IP Deny List (Default Confidence Minimum of 90) — Retrieve the default AbuseIPDB deny list of IP addresses considered malicious based on a confidence score of 90 or above, useful for blocking potentially harmful traffic.

SELECT
  *
FROM
  abuseipdb_deny;

AbuseIPDB ships with 6 query templates. Find them in Library › Queries — see Query templates.

Tables

AbuseIPDB adds 4 tables. Browse their columns from Schema in the query bar's ⋯ menu.

All 4 tables

Table	Contains
abuseipdb_category	Abuse categories.
abuseipdb_check_cidr	List check results for all IPs within a CIDR range.
abuseipdb_check_ip	List all checks for a given IP address.
abuseipdb_deny	List all IP addresses over a given abuse confidence score (default 90).

Next steps

• Connections — health, credentials and settings after you connect
• Query languages — syntax, parameters and time ranges
• Chatting with Scout — ask questions without writing a query
• All integrations — the rest of the catalog