Check and report abusive IP addresses and networks, and read AbuseIPDB's blacklist.
Explore 6 workflow actions for AbuseIPDB, including account permissions and operation limits.
4 read actions2 write actions
WORKFLOW ACTIONS
What you can configure.
Choose an action in the workflow builder, connect an account, and map its inputs. These actions are available in the catalog; your account access and a successful test determine whether they work for your setup.
Check IP
Read
Read an IP address's abuse confidence score, country, usage type, ISP and report count.
Permissions and limits
Account permissions
An AbuseIPDB API key
Operation limits
isWhitelisted gives the benefit of the doubt; AbuseIPDB recommends acting on abuseConfidenceScore.
Counts against the plan's daily check limit; AbuseIPDB answers 429 when it is used up.
Check network
Read
Read the reported addresses within a CIDR network.
Permissions and limits
Account permissions
An AbuseIPDB API key
Operation limits
Standard keys allow up to /24 and 30 days; subscriptions allow larger networks and longer.
Counts against the plan's daily check-block limit; AbuseIPDB answers 429 when it is used up.
Clear address
Write
Delete this account's own reports of an IP address.
Permissions and limits
Account permissions
An AbuseIPDB API key
Operation limits
Removes only reports made by this account.
Counts against the plan's daily clear-address limit; AbuseIPDB answers 429 when it is used up.
A repeated request may repeat the external action. Review the previous result before retrying a write.
Get blacklist
Read
Read the most reported IP addresses above a confidence score, optionally by country or IP version.
Permissions and limits
Account permissions
An AbuseIPDB API key
Operation limits
NodeHub reads up to 10,000 addresses in one answer.
Subscriber filters quietly fall back to the simple list when the subscription lapses.
Counts against the plan's daily blacklist limit; AbuseIPDB answers 429 when it is used up.
List IP reports
Read
Read a page of the abuse reports filed against an IP address.
Permissions and limits
Account permissions
An AbuseIPDB API key
Operation limits
AbuseIPDB marks this endpoint as open beta.
Counts against the plan's daily reports limit; AbuseIPDB answers 429 when it is used up.
Pagination: page. Check the result for additional pages; a single action may not return every record.
Report IP
Write
Report an IP address for abuse with categories, a comment and when it happened.
Permissions and limits
Account permissions
An AbuseIPDB API key
Operation limits
AbuseIPDB rejects a second report of the same IP from the same account within 15 minutes.
Counts against the plan's daily report limit; AbuseIPDB answers 429 when it is used up.
A repeated request may repeat the external action. Review the previous result before retrying a write.
SETUP
Start with a controlled test.
01Connect the intended account
Use the account and permissions required for your process. Review the connection check before configuring a workflow action.
02Review inputs and access
Select a listed operation and map its required inputs. Use test records and add a human approval before writes that need review.
03Confirm the result
Inspect step outputs and confirm the result in AbuseIPDB. A saved workflow is not a completed provider action.
Security & Identity · CONNECTION
