AbuseIPDB

AbuseIPDB

Warning

This module requires an active API key. If the AbuseIPDB configuration value is empty, the module will not be registered by the dispatcher and will not execute. For comprehensive instructions on managing keys, refer to the API Credentials page.

Official Website: https://www.abuseipdb.com/

The AbuseIPDB module performs IP reputation checks against the AbuseIPDB service. It is designed to identify and analyze malicious IP addresses associated with spam, DDoS attacks, hacking attempts, and other abusive network behaviors.

Capabilities

The module accepts IPv4 and IPv6 addresses as input and returns comprehensive threat intelligence data.

Extracted Information

The module extracts and returns the following specific properties for a given IP address:

• Abuse Confidence Score: A numerical value indicating the probability that the IP address is malicious.
• Total Reports: The aggregate number of abuse reports filed by the community.
• ISP: The Internet Service Provider managing the IP address.
• Usage Type: The primary categorization of the IP network (e.g., Data Center, Fixed Line ISP).
• Geo: The originating Country Code of the IP address.
• Domain: Known hostnames and associated domains resolved via reverse IP lookups (each domain is automatically tagged with Reverse IP).
• Abuse Report: Detailed snippets of recent abuse reports, including timestamps, reporter comments, and specific threat categories.

Possible Threat Categories in Reports: The API can flag the IP with any combination of the following 23 categories inside the abuse reports: DNS Compromise, DNS Poisoning, Fraud Orders, DDoS Attack, FTP Brute-Force, Ping of Death, Phishing, Fraud VoIP, Open Proxy, Web Spam, Email Spam, Blog Spam, VPN IP, Port Scan, Hacking, SQL Injection, Spoofing, Brute-Force, Bad Web Bot, Exploited Host, Web App Attack, SSH, IoT Targeted.

Security Tagging

Based on the API response, the module automatically enriches the target with contextual tags to aid in rapid analysis. The complete list of possible tags assigned by this module includes:

• Confidence Tags:
  • Suspicious (assigned if the abuse score is between 1 and 49)
  • Malicious (assigned if the abuse score is 50 or higher)
• Attribute Tags:
  • Whitelisted (assigned if the IP is known to be clean or belongs to a trusted entity)
  • Public IP (assigned if the IP is publicly routable)
  • Tor Exit (assigned if the IP is a known Tor exit node)
  • Reverse IP (assigned to any discovered domains or hostnames)
• Behavioral Threat Tags (aggregated from recent reports):
  • Spam (triggers on Web Spam, Email Spam, or Blog Spam reports)
  • DDoS (triggers on DDoS Attack reports)
  • Bruteforce (triggers on SSH or general Brute-Force reports)
  • Scanner (triggers on Port Scan reports)