AbuseIPDB
Crowdsourced IP reputation database for abuse reports, blacklists, IP and CIDR reputation, and security signals.
Useful for security workflows that check IP or CIDR reputation, pull blacklists, submit bulk abuse reports, and clear address history.
Example Use Cases
These are the AbuseIPDB actions Snow can use when building apps with you. Connecting an account does not make Snow run these on its own.
Tool to check the reputation of an IP address. Use when you need to determine if an IP address has been reported for abusive activity within a specified look-back period. Example: CheckIp(ipAddress='8.8.8.8', maxAgeInDays=90).
Retrieve abuse reports for a specific IP address from AbuseIPDB. Use this tool to view the history of abuse complaints filed against an IP address, including the reported abuse categories, reporter details, and timestamps. Supports pagination for IPs with many reports.
Submit multiple IP abuse reports to AbuseIPDB in bulk via CSV upload. Use this when you need to report many malicious IPs at once instead of one-by-one. Returns the count of successfully saved reports and details about any invalid entries.
Tool to check the reputation of all IP addresses in a CIDR range. Use when you need aggregated abuse data for a network block.
Tool to remove all reports associated with a specific IP address. Use when you need to purge your own abuse records after verifying control of the IP.
Retrieves a list of the most reported malicious IP addresses from AbuseIPDB's database. Use this tool to build dynamic blocklists, threat intelligence feeds, or firewall rules. The blacklist is updated hourly and contains IPs with high abuse confidence scores. Free accounts receive up to 10,000 IPs. Paid subscriptions unlock filtering options (confidenceMinimum, country filters) and higher limits (up to 500,000 IPs).