{"uid":"cap_SR9IFZF_oHxDWVgZLjBqp","slug":"2s-ip-abuse-check-6da623ac","name":"2s IP Abuse Check","description":"AbuseIPDB abuse report for a single IP — the crowd-sourced abuse-confidence score (0-100) the fail2ban / SSH-scanner / web-attack ecosystem reports into. Pass ip (IPv4 or IPv6). Returns abuseConfidenceScore, totalReports, numDistinctUsers, lastReportedAt, usageType (e.g. Data Center / Residential), ISP, domain, hostnames, isTor, isWhitelisted, and country. Set verbose=true for the individual report records (categories + reporter country). Optional maxAgeInDays (1-365, default 90) bounds the reporting window. Live crowd data an LLM cannot know — SOC alert triage, login-abuse blocking, and firewall decisions.","url":"https://2s.io/api/security/ip-abuse?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","queryParams"],"properties":{"type":{"const":"http"},"method":{"const":"GET"},"queryParams":{"required":["ip"],"properties":{"ip":{"type":"string","description":"IPv4 or IPv6 address."},"verbose":{"type":"boolean","default":false,"description":"Include individual report records."},"maxAgeInDays":{"type":"integer","default":90,"maximum":365,"minimum":1}}}}}}},"responseSchema":{"type":"json","schema":{"type":"object","properties":{"ok":{"type":"boolean"},"items":{"type":"array","items":{"type":"object","properties":{"isp":{"type":"string"},"isTor":{"type":"boolean"},"hostnames":{"type":"array","items":{}},"ipAddress":{"type":"string"},"usageType":{"type":"string"},"countryCode":{"type":"string"},"totalReports":{"type":"integer"},"lastReportedAt":{"type":"string"},"numDistinctUsers":{"type":"integer"},"abuseConfidenceScore":{"type":"integer"}}}},"total":{"type":"integer"},"source":{"type":"object","properties":{"url":{"type":"string"},"license":{"type":"string"},"provider":{"type":"string"}}}}},"example":{"ok":true,"items":[{"isp":"Tencent Cloud","isTor":false,"hostnames":[],"ipAddress":"118.25.6.39","usageType":"Data Center/Web Hosting/Transit","countryCode":"CN","totalReports":432,"lastReportedAt":"2026-06-19T22:17:01+00:00","numDistinctUsers":51,"abuseConfidenceScore":100}],"total":1,"source":{"url":"https://www.abuseipdb.com/","license":"AbuseIPDB API — free/commercial tiers; attribution required (CC BY 4.0 for data display)","provider":"AbuseIPDB"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.00216","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.00216/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0054","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0054","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_OdRBcox9WU9LGrQn_vJjq","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.0054","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Looks up an IP address against AbuseIPDB to return its abuse confidence score, report count, ISP, Tor status, and usage type","exampleAgentPrompt":"Can you check if 118.25.6.39 is a known malicious IP? I want its abuse confidence score, how many times it's been reported, whether it's a Tor node, and its ISP — look back up to 90 days.","exampleUseCases":null,"resultDescription":"Returns a JSON object with ok status, total count, and an array of items each containing the IP address, its abuse confidence score (0-100), total number of abuse reports, number of distinct reporting users, ISP name, usage type (e.g. Data Center), country code, whether it's a Tor exit node, any associated hostnames, and the timestamp of the most recent report. Also includes data source attribution (AbuseIPDB).","failureModes":["Missing required 'ip' query parameter returns validation error","Invalid IP format (non-IPv4/IPv6 string) returns error or empty result","maxAgeInDays outside 1-365 range returns validation error","IP not found in AbuseIPDB returns empty items array with total 0","Payment failure via x402 prevents request from being processed","AbuseIPDB upstream downtime causes failed response"],"whenToPreferThis":"Use this endpoint when you need structured IP abuse reputation data including confidence scores and report counts, especially in agent workflows that require no API key setup and support per-call USDC micropayments. Prefer this over direct AbuseIPDB calls when you need pay-as-you-go access without account registration.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T12:46:49.580Z","isFirstParty":false,"canonicalSlug":"2s-ip-abuse-check-6da623ac"}