# checkMaliciousIp

**Identifier:** `abusedb_checkMaliciousIp`

**Provider:** [AbuseIPDB](https://kirha.com/providers/abusedb.md)

Check if an IP address has been reported for malicious activity. Returns abuse confidence score, report counts, usage type, ISP and country. Only reports within the last maxAgeInDays days are counted.

## Run it with the CLI

```bash
kirha tools run abusedb_checkMaliciousIp \
  --input '{
    "ip": "<ip>"
  }'
```

`--input` takes a JSON object that matches the input schema. Pass `--input -` to read it from stdin.

## Call it over HTTP

```bash
curl https://api.kirha.com/tools/v1/execute \
  --request POST \
  --header 'Content-Type: application/json' \
  --header 'Authorization: **********' \
  --data '{
  "tool_name": "abusedb_checkMaliciousIp",
  "input": {
    "ip": "<ip>"
  }
}'
```

Replace the stars with an API key from https://app.kirha.com/api-keys.

## Input schema

```json
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {
    "ip": {
      "description": "IPv4 or IPv6 address to check",
      "type": "string"
    },
    "maxAgeInDays": {
      "default": 30,
      "description": "Only count reports newer than this many days",
      "maximum": 365,
      "minimum": 1,
      "type": "integer"
    }
  },
  "required": [
    "ip"
  ],
  "type": "object"
}
```

## Output schema

```json
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false,
  "properties": {
    "abuseConfidenceScore": {
      "type": "number"
    },
    "context": {
      "type": "string"
    },
    "countryCode": {
      "type": "string"
    },
    "countryName": {
      "type": "string"
    },
    "domain": {
      "type": "string"
    },
    "hostnames": {
      "items": {
        "type": "string"
      },
      "type": "array"
    },
    "ipAddress": {
      "type": "string"
    },
    "ipVersion": {
      "type": "number"
    },
    "isPublic": {
      "type": "boolean"
    },
    "isTor": {
      "type": "boolean"
    },
    "isWhitelisted": {
      "type": "boolean"
    },
    "isp": {
      "type": "string"
    },
    "lastReportedAt": {
      "type": "string"
    },
    "numDistinctUsers": {
      "type": "number"
    },
    "totalReports": {
      "type": "number"
    },
    "usageType": {
      "type": "string"
    }
  },
  "required": [
    "context",
    "ipAddress",
    "isPublic",
    "ipVersion",
    "abuseConfidenceScore",
    "hostnames",
    "totalReports",
    "numDistinctUsers"
  ],
  "type": "object"
}
```

-----

[All AbuseIPDB tools](https://kirha.com/providers/abusedb.md) · [< Back to tools list](https://kirha.com/tools.md)