> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pinkfish.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# abuseipdb

> AbuseIPDB Threat Intelligence

**Server path:** `/abuseipdb` | **Type:** Application | **PCID required:** Yes

## Tools

| Tool                                                  | Description                                                                                                                                    |
| ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| [`abuseipdb_bulk_report`](#abuseipdb_bulk_report)     | Submit abuse reports for multiple IP addresses via CSV data. Each line should contain: IP, categories, timestamp, and optional comment.        |
| [`abuseipdb_check_ip`](#abuseipdb_check_ip)           | Check an IP address for abuse reports. Returns abuse confidence score, country, ISP, usage type, and recent report details.                    |
| [`abuseipdb_check_subnet`](#abuseipdb_check_subnet)   | Check a subnet (CIDR notation) for abuse reports. Returns aggregated abuse data for all IPs in the range.                                      |
| [`abuseipdb_clear_address`](#abuseipdb_clear_address) | Remove all reports your account has submitted for a specific IP address. This only removes your own reports, not reports from other users.     |
| [`abuseipdb_get_blacklist`](#abuseipdb_get_blacklist) | Download the AbuseIPDB blacklist of reported IP addresses. Returns IPs with the highest abuse confidence scores.                               |
| [`abuseipdb_get_reports`](#abuseipdb_get_reports)     | Retrieve paginated abuse reports for a specific IP address. Returns individual report entries with categories, comments, and reporter details. |
| [`abuseipdb_report_ip`](#abuseipdb_report_ip)         | Submit an abuse report for an IP address. Requires at least one abuse category.                                                                |

***

## abuseipdb\_bulk\_report

Submit abuse reports for multiple IP addresses via CSV data. Each line should contain: IP, categories, timestamp, and optional comment.

**Parameters:**

| Parameter | Type   | Required | Default | Description                                                                                                                                                                                         |
| --------- | ------ | -------- | ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `csv`     | string | Yes      | —       | CSV data with columns: IP, Categories, ReportDate, Comment. First row must be the header row. Example: "IP,Categories,ReportDate,Comment\n1.2.3.4,18,2025-01-15T00:00:00-05:00,Brute force attempt" |

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "PCID": {
        "type": "string",
        "description": "Pink Connect ID for the authenticated connection"
      },
      "csv": {
        "type": "string",
        "description": "CSV data with columns: IP, Categories, ReportDate, Comment. First row must be the header row. Example: \"IP,Categories,ReportDate,Comment\\n1.2.3.4,18,2025-01-15T00:00:00-05:00,Brute force attempt\""
      }
    },
    "required": [
      "PCID",
      "csv"
    ]
  }
  ```
</Expandable>

***

## abuseipdb\_check\_ip

Check an IP address for abuse reports. Returns abuse confidence score, country, ISP, usage type, and recent report details.

**Parameters:**

| Parameter      | Type    | Required | Default | Description                                            |
| -------------- | ------- | -------- | ------- | ------------------------------------------------------ |
| `ipAddress`    | string  | Yes      | —       | IPv4 or IPv6 address to check                          |
| `maxAgeInDays` | integer | No       | —       | Maximum age of reports to consider (1-365, default 30) |
| `verbose`      | boolean | No       | —       | Include full report details in the response            |

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "PCID": {
        "type": "string",
        "description": "Pink Connect ID for the authenticated connection"
      },
      "ipAddress": {
        "type": "string",
        "description": "IPv4 or IPv6 address to check"
      },
      "maxAgeInDays": {
        "type": "integer",
        "description": "Maximum age of reports to consider (1-365, default 30)"
      },
      "verbose": {
        "type": "boolean",
        "description": "Include full report details in the response"
      }
    },
    "required": [
      "PCID",
      "ipAddress"
    ]
  }
  ```
</Expandable>

***

## abuseipdb\_check\_subnet

Check a subnet (CIDR notation) for abuse reports. Returns aggregated abuse data for all IPs in the range.

**Parameters:**

| Parameter      | Type    | Required | Default | Description                                                                           |
| -------------- | ------- | -------- | ------- | ------------------------------------------------------------------------------------- |
| `network`      | string  | Yes      | —       | Subnet in CIDR notation (e.g., "192.168.1.0/24"). Maximum /24 for IPv4, /48 for IPv6. |
| `maxAgeInDays` | integer | No       | —       | Maximum age of reports to consider (1-365, default 30)                                |

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "PCID": {
        "type": "string",
        "description": "Pink Connect ID for the authenticated connection"
      },
      "network": {
        "type": "string",
        "description": "Subnet in CIDR notation (e.g., \"192.168.1.0/24\"). Maximum /24 for IPv4, /48 for IPv6."
      },
      "maxAgeInDays": {
        "type": "integer",
        "description": "Maximum age of reports to consider (1-365, default 30)"
      }
    },
    "required": [
      "PCID",
      "network"
    ]
  }
  ```
</Expandable>

***

## abuseipdb\_clear\_address

Remove all reports your account has submitted for a specific IP address. This only removes your own reports, not reports from other users.

**Parameters:**

| Parameter   | Type   | Required | Default | Description                                    |
| ----------- | ------ | -------- | ------- | ---------------------------------------------- |
| `ipAddress` | string | Yes      | —       | IPv4 or IPv6 address to clear your reports for |

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "PCID": {
        "type": "string",
        "description": "Pink Connect ID for the authenticated connection"
      },
      "ipAddress": {
        "type": "string",
        "description": "IPv4 or IPv6 address to clear your reports for"
      }
    },
    "required": [
      "PCID",
      "ipAddress"
    ]
  }
  ```
</Expandable>

***

## abuseipdb\_get\_blacklist

Download the AbuseIPDB blacklist of reported IP addresses. Returns IPs with the highest abuse confidence scores.

**Parameters:**

| Parameter           | Type    | Required | Default | Description                                                                   |
| ------------------- | ------- | -------- | ------- | ----------------------------------------------------------------------------- |
| `confidenceMinimum` | integer | No       | —       | Minimum abuse confidence score (1-100, default 100)                           |
| `limit`             | integer | No       | —       | Maximum number of IPs to return (up to 10000)                                 |
| `onlyCountries`     | string  | No       | —       | Comma-separated ISO 3166-1 alpha-2 country codes to filter by (e.g., "US,CN") |
| `exceptCountries`   | string  | No       | —       | Comma-separated ISO 3166-1 alpha-2 country codes to exclude (e.g., "US,CN")   |

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "PCID": {
        "type": "string",
        "description": "Pink Connect ID for the authenticated connection"
      },
      "confidenceMinimum": {
        "type": "integer",
        "description": "Minimum abuse confidence score (1-100, default 100)"
      },
      "limit": {
        "type": "integer",
        "description": "Maximum number of IPs to return (up to 10000)"
      },
      "onlyCountries": {
        "type": "string",
        "description": "Comma-separated ISO 3166-1 alpha-2 country codes to filter by (e.g., \"US,CN\")"
      },
      "exceptCountries": {
        "type": "string",
        "description": "Comma-separated ISO 3166-1 alpha-2 country codes to exclude (e.g., \"US,CN\")"
      }
    },
    "required": [
      "PCID"
    ]
  }
  ```
</Expandable>

***

## abuseipdb\_get\_reports

Retrieve paginated abuse reports for a specific IP address. Returns individual report entries with categories, comments, and reporter details.

**Parameters:**

| Parameter      | Type    | Required | Default | Description                                          |
| -------------- | ------- | -------- | ------- | ---------------------------------------------------- |
| `ipAddress`    | string  | Yes      | —       | IPv4 or IPv6 address to get reports for              |
| `maxAgeInDays` | integer | No       | —       | Maximum age of reports to return (1-365, default 30) |
| `page`         | integer | No       | —       | Page number for pagination (default 1)               |
| `perPage`      | integer | No       | —       | Number of results per page (1-100, default 25)       |

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "PCID": {
        "type": "string",
        "description": "Pink Connect ID for the authenticated connection"
      },
      "ipAddress": {
        "type": "string",
        "description": "IPv4 or IPv6 address to get reports for"
      },
      "maxAgeInDays": {
        "type": "integer",
        "description": "Maximum age of reports to return (1-365, default 30)"
      },
      "page": {
        "type": "integer",
        "description": "Page number for pagination (default 1)"
      },
      "perPage": {
        "type": "integer",
        "description": "Number of results per page (1-100, default 25)"
      }
    },
    "required": [
      "PCID",
      "ipAddress"
    ]
  }
  ```
</Expandable>

***

## abuseipdb\_report\_ip

Submit an abuse report for an IP address. Requires at least one abuse category.

**Parameters:**

| Parameter    | Type   | Required | Default | Description                                                                                                                                                                                                                                                                                                                                                                                                               |
| ------------ | ------ | -------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `ip`         | string | Yes      | —       | IPv4 or IPv6 address to report                                                                                                                                                                                                                                                                                                                                                                                            |
| `categories` | string | Yes      | —       | Comma-separated abuse category IDs (e.g., "18,22"). Categories: 1=DNS Compromise, 2=DNS Poisoning, 3=Fraud Orders, 4=DDoS Attack, 5=FTP Brute-Force, 6=Ping of Death, 7=Phishing, 8=Fraud VoIP, 9=Open Proxy, 10=Web Spam, 11=Email Spam, 12=Blog Spam, 13=VPN IP, 14=Port Scan, 15=Hacking, 16=SQL Injection, 17=Spoofing, 18=Brute-Force, 19=Bad Web Bot, 20=Exploited Host, 21=Web App Attack, 22=SSH, 23=IoT Targeted |
| `comment`    | string | No       | —       | Description of the malicious activity (max 1024 characters)                                                                                                                                                                                                                                                                                                                                                               |
| `timestamp`  | string | No       | —       | ISO 8601 datetime of the event (e.g., "2025-01-15T13:00:00-05:00")                                                                                                                                                                                                                                                                                                                                                        |

<Expandable title="inputSchema">
  ```json theme={null}
  {
    "type": "object",
    "properties": {
      "PCID": {
        "type": "string",
        "description": "Pink Connect ID for the authenticated connection"
      },
      "ip": {
        "type": "string",
        "description": "IPv4 or IPv6 address to report"
      },
      "categories": {
        "type": "string",
        "description": "Comma-separated abuse category IDs (e.g., \"18,22\"). Categories: 1=DNS Compromise, 2=DNS Poisoning, 3=Fraud Orders, 4=DDoS Attack, 5=FTP Brute-Force, 6=Ping of Death, 7=Phishing, 8=Fraud VoIP, 9=Open Proxy, 10=Web Spam, 11=Email Spam, 12=Blog Spam, 13=VPN IP, 14=Port Scan, 15=Hacking, 16=SQL Injection, 17=Spoofing, 18=Brute-Force, 19=Bad Web Bot, 20=Exploited Host, 21=Web App Attack, 22=SSH, 23=IoT Targeted"
      },
      "comment": {
        "type": "string",
        "description": "Description of the malicious activity (max 1024 characters)"
      },
      "timestamp": {
        "type": "string",
        "description": "ISO 8601 datetime of the event (e.g., \"2025-01-15T13:00:00-05:00\")"
      }
    },
    "required": [
      "PCID",
      "ip",
      "categories"
    ]
  }
  ```
</Expandable>