AbuseIPDB is a project dedicated to helping make the internet safer by providing a central repository for reporting and checking IP addresses associated with malicious activities.
AbuseIPDB is a project dedicated to helping make the internet safer by providing a central repository for reporting and checking IP addresses associated with malicious activities. On Nagent, AbuseIPDB is exposed as a fully-configurable security & identity tools integration that any agent can call — 6 actions, and API key authentication. No code is required to wire AbuseIPDB into your workflow — connect it once via the External Integrations panel and reuse it across every agent you build.
Agent builders use AbuseIPDB to automate the kinds of tasks security & identity tools teams previously handled manually. Concrete examples — each one is a single agent step in Nagent — include:
Every action and trigger is paired with a structured input/output schema (visible in the sections below), so when you wire AbuseIPDB into Helix — our agentic agent builder — the editor knows exactly what each step expects and produces. Configure once, deploy anywhere across your Nagent agents.
Every operation an agent can call against AbuseIPDB, with input parameters and output schema. Drop these into any step of an agent built in Helix.
ABUSELPDB_BLACKLISTRetrieves a list of the most reported malicious IP addresses from AbuseIPDB's database. Use this tool to build dynamic blocklists, threat intelligence feeds, or firewall rules. The blacklist is updated hourly and contains IPs with high abuse confidence scores. Free accounts receive up to 10,000 IPs. Paid subscriptions unlock filtering options (confidenceMinimum, country filters) and higher limits (up to 500,000 IPs).
Input parameters
Maximum number of IP addresses to return. Free accounts are limited to 10,000 IPs. Paid plans allow up to 100,000 or 500,000 depending on tier.
Filter by IP version: 4 for IPv4 addresses only, 6 for IPv6 addresses only. Omit to include both.
Comma-separated ISO 3166-1 alpha-2 country codes to include (e.g., 'US,CA,MX'). Only IPs from these countries are returned. Requires a paid subscription.
Comma-separated ISO 3166-1 alpha-2 country codes to exclude (e.g., 'CN,RU'). IPs from these countries are filtered out. Requires a paid subscription.
Minimum abuse confidence score (25-100) to filter reported IPs. Only IPs with scores at or above this threshold are returned. Requires a paid subscription.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
ABUSELPDB_BULK_REPORTSubmit multiple IP abuse reports to AbuseIPDB in bulk via CSV upload. Use this when you need to report many malicious IPs at once instead of one-by-one. Returns the count of successfully saved reports and details about any invalid entries.
Input parameters
CSV content containing IP abuse reports. Must include headers: IP, Categories, ReportDate, Comment. IP: Valid IPv4 or IPv6 address. Categories: Comma-separated category IDs (e.g., '18,22' for SSH abuse). Common categories: 3=Fraud Orders, 4=DDoS Attack, 5=FTP Brute-Force, 6=Ping of Death, 7=Phishing, 10=Email Spam, 11=Blog Spam, 14=Port Scan, 18=Brute-Force, 19=Bad Web Bot, 21=Web Spam, 22=SSH, 23=IoT Targeted. ReportDate: ISO 8601 format recommended (e.g., '2024-01-15T10:00:00-05:00'). Comment: Description of the attack (max 1024 characters). Limit: 10,000 rows max, 8MB max file size.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
ABUSELPDB_CHECK_BLOCKTool to check the reputation of all IP addresses in a CIDR range. Use when you need aggregated abuse data for a network block.
Input parameters
IPv4 network in CIDR notation (e.g., '192.168.1.0/24'). Free plans only support /24 networks; paid plans may use wider ranges up to /16.
Number of days back to include abuse reports (1-365). Free plans are limited to 30 days max. Defaults to 30.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
ABUSELPDB_CHECK_IPTool to check the reputation of an IP address. Use when you need to determine if an IP address has been reported for abusive activity within a specified look-back period. Example: CheckIp(ipAddress='8.8.8.8', maxAgeInDays=90).
Input parameters
When true, includes detailed abuse reports with comments, categories, and reporter information.
IP address (IPv4 or IPv6) to check for abuse reports.
Look-back period for reports in days (default=30, max=365).
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
ABUSELPDB_CLEAR_ADDRESSTool to remove all reports associated with a specific IP address. Use when you need to purge your own abuse records after verifying control of the IP.
Input parameters
A valid IPv4 or IPv6 address whose reports will be removed.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
ABUSELPDB_GET_REPORTSRetrieve abuse reports for a specific IP address from AbuseIPDB. Use this tool to view the history of abuse complaints filed against an IP address, including the reported abuse categories, reporter details, and timestamps. Supports pagination for IPs with many reports.
Input parameters
Page number for pagination (1-indexed). Default is 1.
Number of reports to return per page (1-100). Default is 25.
IPv4 or IPv6 address to retrieve reports for
Only return reports from the last N days (1-365). Default is 30 days.
Output
Data from the action execution
Error if any occurred during the execution of the action
Whether or not the action execution was successful or not
No publicly available marketplace agent is found using this tool yet. There are 74 agents privately built on Nagent that already use AbuseIPDB.
Build on Nagent
Connect AbuseIPDB to any Nagent agent in minutes — no API key management, no boilerplate. Just configure and deploy.
The five questions agent builders ask before adopting a new integration.
Open the External Integrations panel inside Nagent (app.nagent.ai/externalIntegration), find AbuseIPDB, and click "Connect Now." You'll authenticate with an API key — Nagent handles credential storage and refresh automatically. Once connected, AbuseIPDB is available to any agent in your workspace.
No. Nagent provides no-code integration for every tool. Once AbuseIPDB is connected, you configure its 6 actions directly in the agent builder UI — no API calls, no boilerplate, no schema management.
Helix — Nagent's agentic agent builder — lets you drop AbuseIPDB steps into any workflow visually. Pick an action (e.g., one of those listed above), fill in the inputs (Helix knows the required vs. optional schema for each parameter), and connect it to upstream/downstream steps. Triggers run as the entry point of an agent, so when a AbuseIPDB event fires, the agent kicks off automatically.
Every AbuseIPDB action and trigger ships with a fully-typed schema — input parameters with name, type, required flag, and description, plus the output payload shape. The schemas are documented in the sections above. Helix uses these schemas to validate your configuration at build time and to type-check the data flowing between steps.
Yes. While AbuseIPDB ships with 6 pre-built security & identity tools actions, you can layer custom logic around them inside Helix — pre/post-processing steps, conditional branches, retries, or stitching AbuseIPDB together with other connected tools. For deeper customization, talk to our team about Nagent's Agentic AI Lab — forward-deployed engineers who build AbuseIPDB-based workflows tailored to your business.