The Retrieve IP Abuse Reports API is a tool designed to support security, monitoring, and traffic analysis processes in computer systems. Its main function is to provide structured and consolidated information about an IP's history, including abuse reports, incident frequency, types of activity detected, and metadata associated with the network provider. This information allows developers, system administrators, and cybersecurity teams to make informed decisions about how to handle incoming or outgoing connections.
The API collects data from multiple sources, both automated and manual, that report potentially suspicious behavior such as unauthorized connection attempts, port scans, brute force attacks, or anomalous traffic. In addition, it integrates contextual information such as the Internet service provider, country of origin, type of network usage, and whitelist or blacklist status. All of this is presented in a standardized response that is easily processable by applications.
One of the key values of this API is the abuse score or confidence level, which helps differentiate between confirmed malicious activity and false positives generated by automated security systems.
Check IP address reputation, returning abuse reports, recent activity, and network context for security decisions.
IP Verification - Endpoint Features
| Object | Description |
|---|---|
ip |
[Required] Enter an IP address. |
{"ip":"8.8.8.8","is_listed":false,"confidence_of_abuse":0,"total_reports":14,"distinct_reporters":8,"first_reported_at":"2026-01-15","last_reported_at":"2026-01-22","is_recent_activity":true,"isp":"Google LLC","usage_type":"Content Delivery Network","asn":null,"hostname":"dns.google","domain":"google.com","country":"United States of America","country_code":"US","city":null,"region":null,"reports":[{"reported_at":"2026-01-22T20:28:34Z","reporter":134282,"comment":"Unauthorized connection attempt","categories":[14,15,20]},{"reported_at":"2026-01-20T16:49:05Z","reporter":134282,"comment":"Unauthorized connection attempt","categories":[14,15,20]},{"reported_at":"2026-01-20T11:02:29Z","reporter":116616,"comment":"Detected port scanning activity (SIP\/VoIP scanner).","categories":[8,14,15,18]},{"reported_at":"2026-01-20T06:07:19Z","reporter":209271,"comment":"Blocked by UFW (TCP on 52983)\nSource port: 53\nTTL: 112\nPacket length: 40\nTOS: 0x00\n\nThis report (for 8.8.8.8) was generated by:\nhttps:\/\/github.com\/sefinek\/UFW-AbuseIPDB-Reporter","categories":[14]},{"reported_at":"2026-01-20T03:29:35Z","reporter":264073,"comment":"...","categories":[18,22]},{"reported_at":"2026-01-19T05:43:19Z","reporter":209271,"comment":"Blocked by UFW (TCP on 52128)\nSource port: 53\nTTL: 113\nPacket length: 40\nTOS: 0x00\n\nThis report (for 8.8.8.8) was generated by:\nhttps:\/\/github.com\/sefinek\/UFW-AbuseIPDB-Reporter","categories":[14]},{"reported_at":"2026-01-18T06:56:55Z","reporter":258755,"comment":"Auto-reported by Fail2Ban (NPM-Auth)","categories":[18,21]},{"reported_at":"2026-01-18T05:11:10Z","reporter":264073,"comment":"...","categories":[18,22]},{"reported_at":"2026-01-17T23:07:19Z","reporter":56171,"comment":"ThreatBook Intelligence: Whitelist,cdn more details on https:\/\/threatbook.io\/ip\/8.8.8.8\n2026-01-17 01:28:07 \/cgi-bin\/network_config\/nsg_masq.cgi?user_name=admin&session_id=..\/&lang=zh_CN.UTF-8&act=2&proto=;ls>\/usr\/local\/lyx\/lyxcenter\/web\/SpVk.html;","categories":[21]},{"reported_at":"2026-01-17T08:25:47Z","reporter":209271,"comment":"Blocked by UFW (TCP on 65265)\nSource port: 53\nTTL: 117\nPacket length: 40\nTOS: 0x00\n\nThis report (for 8.8.8.8) was generated by:\nhttps:\/\/github.com\/sefinek\/UFW-AbuseIPDB-Reporter","categories":[14]},{"reported_at":"2026-01-17T06:28:36Z","reporter":261807,"comment":"Fail2Ban identified brute-force attack from 8.8.8.8","categories":[22]},{"reported_at":"2026-01-17T04:02:14Z","reporter":44461,"comment":"IPFire IPS Alert (2026-01-17): ET MALWARE Possible Tinba DGA NXDOMAIN Responses. Observed events: 1","categories":[21]},{"reported_at":"2026-01-16T10:16:38Z","reporter":209271,"comment":"Blocked by UFW (TCP on 64329)\nSource port: 53\nTTL: 117\nPacket length: 40\nTOS: 0x00\n\nThis report (for 8.8.8.8) was generated by:\nhttps:\/\/github.com\/sefinek\/UFW-AbuseIPDB-Reporter","categories":[14]},{"reported_at":"2026-01-15T15:05:06Z","reporter":134282,"comment":"Unauthorized connection attempt","categories":[14,15,20]}],"scraped_at":"2026-01-23T12:53:32Z","is_whitelisted":true,"is_public":true,"_cached":true,"_cache_key":"ipx_api:abuse_check:8_8_8_8"}
curl --location --request GET 'https://zylalabs.com/api/11762/retrieve+ip+abuse+reports+api/22309/ip+verification?ip=8.8.8.8' --header 'Authorization: Bearer YOUR_API_KEY'
| Header | Description |
|---|---|
Authorization
|
[Required] Should be Bearer access_key. See "Your API Access Key" above when you are subscribed. |
No long-term commitment. Upgrade, downgrade, or cancel anytime. Free Trial includes up to 50 requests.
The GET IP Verification endpoint returns data on an IP address's reputation, including abuse reports, recent activity, network context, and metadata such as ISP, country, and usage type.
Key fields in the response include "ip," "is_listed," "confidence_of_abuse," "total_reports," "distinct_reporters," "first_reported_at," "last_reported_at," and detailed "reports" with timestamps and comments.
The response data is structured in JSON format, with a main object containing summary fields and an array of "reports" detailing individual incidents, including timestamps, reporter IDs, and comments.
The endpoint provides information on abuse reports, incident frequency, types of detected activities, and contextual data such as ISP details, country of origin, and network usage type.
The data is collected from multiple sources, including automated systems and manual reports, which track suspicious behaviors like unauthorized access attempts and port scans.
Typical use cases include enhancing cybersecurity measures, monitoring network traffic for suspicious activity, and making informed decisions about allowing or blocking IP connections.
Users can customize requests by specifying the IP address they want to verify. The API does not currently support additional parameters for filtering or modifying the response.
Data accuracy is maintained through a combination of automated monitoring and manual reporting, with regular updates and quality checks to ensure the reliability of the abuse reports.
To obtain your API key, you first need to sign in to your account and subscribe to the API you want to use. Once subscribed, go to your Profile, open the Subscription section, and select the specific API. Your API key will be available there and can be used to authenticate your requests.
You can’t switch APIs during the free trial. If you subscribe to a different API, your trial will end and the new subscription will start as a paid plan.
If you don’t cancel before the 7th day, your free trial will end automatically and your subscription will switch to a paid plan under the same plan you originally subscribed to, meaning you will be charged and gain access to the API calls included in that plan.
The free trial ends when you reach 50 API requests or after 7 days, whichever comes first.
No, the free trial is available only once, so we recommend using it on the API that interests you the most. Most of our APIs offer a free trial, but some may not include this option.
Yes, we offer a 7-day free trial that allows you to make up to 50 API calls at no cost, so you can test our APIs without any commitment.
Zyla API Hub is like a big store for APIs, where you can find thousands of them all in one place. We also offer dedicated support and real-time monitoring of all APIs. Once you sign up, you can pick and choose which APIs you want to use. Just remember, each API needs its own subscription. But if you subscribe to multiple ones, you'll use the same key for all of them, making things easier for you.
Please have a look at our Refund Policy: https://zylalabs.com/terms#refund
Service Level:
100%
Response Time:
361ms
Service Level:
100%
Response Time:
119ms
Service Level:
100%
Response Time:
188ms
Service Level:
100%
Response Time:
152ms
Service Level:
100%
Response Time:
136ms
Service Level:
100%
Response Time:
645ms
Service Level:
100%
Response Time:
169ms
Service Level:
100%
Response Time:
939ms
Service Level:
100%
Response Time:
121ms
Service Level:
100%
Response Time:
9ms
Service Level:
100%
Response Time:
449ms
Service Level:
100%
Response Time:
49ms
Service Level:
100%
Response Time:
0ms
Service Level:
100%
Response Time:
2,379ms
Service Level:
100%
Response Time:
886ms
Service Level:
100%
Response Time:
935ms
Service Level:
100%
Response Time:
1,254ms
Service Level:
100%
Response Time:
0ms
Service Level:
100%
Response Time:
819ms
Service Level:
100%
Response Time:
605ms