AbuseIPDB abuse report for a single IP — the crowd-sourced abuse-confidence score (0-100) the fail2ban / SSH-scanner / web-attack ecosystem reports into. Pass ip (IPv4 or IPv6). Returns abuseConfidenceScore, totalReports, numDistinctUsers, lastReportedAt, usageType (e.g. Data Center / Residential), ISP, domain, hostnames, isTor, isWhitelisted, and country. Set verbose=true for the individual report records (categories + reporter country). Optional maxAgeInDays (1-365, default 90) bounds the reporting window. Live crowd data an LLM cannot know — SOC alert triage, login-abuse blocking, and firewall decisions.
/api/security/ip-abusePAYMENT-SIGNATURE.The ip abuse API is a pay-per-call security endpoint built for AI agents and autonomous software. AbuseIPDB abuse report for a single IP — the crowd-sourced abuse-confidence score (0-100) the fail2ban / SSH-scanner / web-attack ecosystem reports into.
There is no signup and no API key. An agent (or any HTTP client) hits the endpoint, receives an x402 "402 Payment Required" challenge, signs a sub-cent USDC payment on Base or Solana, and retries — the data comes back on the paid request. That makes it a drop-in ip abuse data source for an agent tool-use loop, an MCP host, or a backend that needs security data on demand without onboarding to yet another vendor portal.
| Name | Type | Description |
|---|---|---|
iprequired | string | min 3 chars · max 45 chars |
maxAgeInDays | integer | min 1 · max 365 |
verbose | boolean |
# 1. Probe with no auth → 402 envelope with PaymentRequirements curl -sS 'https://2s.io/api/security/ip-abuse?ip=xxx&maxAgeInDays=90&verbose=false' # 2. Sign + retry with PAYMENT-SIGNATURE: curl -sS 'https://2s.io/api/security/ip-abuse?ip=xxx&maxAgeInDays=90&verbose=false' \ -H 'PAYMENT-SIGNATURE: <base64-json-payload>' # Or use the canonical runner (handles probe → sign → retry): # EVM_PRIVATE_KEY=0x... node --env-file=.env.local \ # --experimental-strip-types scripts/x402-pay.ts \ # 'https://2s.io/api/security/ip-abuse?ip=xxx&maxAgeInDays=90&verbose=false'
import { TwoS } from '@2sio/sdk'
const client = new TwoS({
privateKey: process.env.EVM_PRIVATE_KEY as `0x${string}`,
})
const result = await client.security.ipAbuse({
"ip": "xxx",
"maxAgeInDays": 90,
"verbose": false
})
console.log('endpoint:', result.endpoint)
console.log('cost:', result.costUsd, 'USDC')
console.log('tx:', result.settlement?.txHash)
console.log('data:', result.data)import os
from twosio import TwoS
client = TwoS(private_key=os.environ["EVM_PRIVATE_KEY"])
result = client.security.ip_abuse(ip="xxx", maxAgeInDays=90, verbose=False)
print("endpoint:", result.endpoint)
print("cost:", result.cost_usd, "USDC")
print("tx:", (result.settlement or {}).get("tx_hash"))
print("data:", result.data)// 1. Add @2sio/mcp to your MCP host config (Claude Desktop example below).
// EVM_PRIVATE_KEY funds x402 payments per call.
// claude_desktop_config.json
{
"mcpServers": {
"2sio": {
"command": "npx",
"args": ["-y", "@2sio/mcp"],
"env": { "EVM_PRIVATE_KEY": "0x..." }
}
}
}
// 2. Once the server is running, agents call this tool via standard MCP:
{
"jsonrpc": "2.0",
"id": 1,
"method": "tools/call",
"params": {
"name": "security.ip-abuse",
"arguments": {
"ip": "xxx",
"maxAgeInDays": 90,
"verbose": false
}
}
}| Field | Type | Description |
|---|---|---|
ok | boolean | one of: true |
items | array | |
total | integer | Total matching rows upstream; null when unknown. |
source | object |
{
"ok": true,
"items": [
{
"ipAddress": "example",
"isPublic": false,
"ipVersion": 1,
"isWhitelisted": false,
"abuseConfidenceScore": 1,
"countryCode": "example",
"usageType": "example",
"isp": "example",
"domain": "example",
"hostnames": [
"example"
],
"isTor": false,
"totalReports": 1,
"numDistinctUsers": 1,
"lastReportedAt": "example",
"reports": [
{
"reportedAt": "example",
"comment": "example",
"categories": [
1
],
"reporterId": 1,
"reporterCountryCode": "example"
}
]
}
],
"total": 1,
"source": {
"provider": "example",
"url": "example",
"license": "example"
}
}