abuseipdb

v0.1.0Verified publisher

Checks an IP address in AbuseIPDB: abuse confidence score, reports and what for, ISP, usage type, Tor, country

Run

TerminalAgent

Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).

{"tool":"osintverse-community/abuseipdb","target":"8.8.8.8","input_type":"ip"}

Or just say: "Run osintverse-community/abuseipdb on 8.8.8.8 with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.

ot run osintverse-community/abuseipdb ip:8.8.8.8 --format table

ot install osintverse-community/abuseipdb

Docker image in a read-only container · talks to api.abuseipdb.com · needs ABUSEIPDB_API_KEY · up to 1 min. The first ot run installs the tool after asking once. The example value is the registry's own test input, so this command has run. Drop --format table for JSON.

Don't have ot? Install it in one line

macOS / LinuxWindows

curl -fsSL https://get.otinstaller.com/ot | sh

What this script does

Downloads the latest ot release for your machine from GitHub Releases.
Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
Puts ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.

irm https://get.otinstaller.com/ot.ps1 | iex

What this script does

Downloads the latest ot release for your machine from GitHub Releases.
Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
Puts ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.

Evidence

Security tab →

Pinnedimage sha256:04c31a47…3a1d6e. The same bytes on every install; ot pulls by digest, never by tag.
Signedby https://github.com/osintverse-community/abuseipdb/.github/workflows/otinstaller-release.yml@refs/heads/main via token.actions.githubusercontent.com, verified by the registry on 24 Oct 2026. ot checks the same identity before every install and refuses another signer.
Scanned24 Oct 2026: 0 critical, 44 high, 63 medium, 62 low vulnerabilities; 0 embedded secrets, 0 malware heuristics; SBOM with 89 packages.
Workssmoke test passed on 24 Oct 2026 (exit 3 in 3.0 s, offline sandbox); the nightly health check has not run yet.
Backed upa copy of this image is on the registry's mirror. If the original registry refuses it, ot pulls the same digest from the mirror and checks the same signature.
Reviewedosintverse-community is a verified publisher: the registry confirmed who runs it, and a person reviewed its first release against the acceptable-use rules.

From the community

Issues →

Not health-checked yet; 0.1.0 came out today; nobody has said yet whether it works.

0.1.0 is in its first week. Nobody has said whether it works yet.

Used 0.1.0?It's broken for me

What you get back

Result envelope →

{
  "envelope": 1,
  "tool": "osintverse-community/abuseipdb@0.1.0",
  "runtime": "docker",
  "input": {
    "ip": "8.8.8.8"
  },
  "started_at": "2026-10-21T09:00:00Z",
  "duration_ms": 4100,
  "exit_code": 0,
  "entities": [
    {
      "type": "ip",
      "value": "192.0.2.1"
    },
    {
      "type": "organization",
      "value": "Example Ltd"
    },
    {
      "type": "domain",
      "value": "example.com"
    }
  ],
  "warnings": []
}

Every tool returns this shape, shaped here from what this tool declares it finds. --format table to read it; ot extract and ot auto to continue.

abuseipdb

Checks an IP address in AbuseIPDB, where system administrators report addresses that attack their servers. It gives AbuseIPDB's abuse confidence score (0 to 100), how many reports and distinct reporters the address had in a period and what they reported it for (brute force, port scans, spam and so on), the ten latest reports with their comments, and AbuseIPDB's data on the address's network: ISP, usage type (such as data center or mobile), the operator's domain, reverse DNS names, country, and whether it is a Tor exit node. Only AbuseIPDB's reports are read, so the target is not contacted.

ot run osintverse-community/abuseipdb --ip 8.8.8.8

Inputs

Input	Required
`ip`	yes	IPv4 or IPv6 address
`days`	no	Count only reports from this many days back, 90 by default, up to 365

Keys

ABUSEIPDB_API_KEY, set with ot keys set ABUSEIPDB_API_KEY. A free AbuseIPDB account's key allows 1,000 checks a day; AbuseIPDB's terms keep the free plan to non-commercial use, and paid plans cover the rest: https://www.abuseipdb.com/account/api. Without the key the tool exits with code 3.

Notes

The score is AbuseIPDB's own estimate of how likely the address is to be abusive, worked out from its reports and reporters; an address with no reports scores 0, which says nothing about whether it is safe. Report comments are written by the reporters and are shown as they wrote them, cut to 300 characters. A private or reserved address gives no entities and a note on stderr.

Next steps

See what runs on the address with osintverse-community/shodan-internetdb, or check it in more threat feeds with osintverse-community/pulsedive and osintverse-community/otx-indicators.

Development

python -m unittest
ot validate

Releases are built, signed and published by the otinstaller release workflow (Actions tab, with the version to release).

License

MIT

What next

abuseipdb finds ip, organization, domain, location. Tools that take those:

ip → 10 tools organization → 6 tools domain → 10 tools ot auto, with a saved result

Other ip address tools

All ip address tools →

Alternatives to abuseipdb that also take an ip address; ot auto runs every installed one on the same value.