The IP Abuse Data Extractor API is a tool designed to support security, monitoring, and traffic analysis processes in computer systems. Its main function is to provide structured and consolidated information about an IP's history, including abuse reports, incident frequency, types of activity detected, and metadata associated with the network provider. This information allows developers, system administrators, and cybersecurity teams to make informed decisions about how to handle incoming or outgoing connections.
The API collects data from multiple sources, both automated and manual, that report potentially suspicious behavior such as unauthorized connection attempts, port scans, brute force attacks, or anomalous traffic. In addition, it integrates contextual information such as the Internet service provider, country of origin, type of network usage, and whitelist or blacklist status. All of this is presented in a standardized response that is easily processable by applications.
One of the key values of this API is the abuse score or confidence level, which helps differentiate between confirmed malicious activity and false positives generated by automated security systems.
{"ip":"8.8.8.8","is_listed":false,"confidence_of_abuse":0,"total_reports":14,"distinct_reporters":8,"first_reported_at":"2026-01-15","last_reported_at":"2026-01-22","is_recent_activity":true,"isp":"Google LLC","usage_type":"Content Delivery Network","asn":null,"hostname":"dns.google","domain":"google.com","country":"United States of America","country_code":"US","city":null,"region":null,"reports":[{"reported_at":"2026-01-22T20:28:34Z","reporter":134282,"comment":"Unauthorized connection attempt","categories":[14,15,20]},{"reported_at":"2026-01-20T16:49:05Z","reporter":134282,"comment":"Unauthorized connection attempt","categories":[14,15,20]},{"reported_at":"2026-01-20T11:02:29Z","reporter":116616,"comment":"Detected port scanning activity (SIP\/VoIP scanner).","categories":[8,14,15,18]},{"reported_at":"2026-01-20T06:07:19Z","reporter":209271,"comment":"Blocked by UFW (TCP on 52983)\nSource port: 53\nTTL: 112\nPacket length: 40\nTOS: 0x00\n\nThis report (for 8.8.8.8) was generated by:\nhttps:\/\/github.com\/sefinek\/UFW-AbuseIPDB-Reporter","categories":[14]},{"reported_at":"2026-01-20T03:29:35Z","reporter":264073,"comment":"...","categories":[18,22]},{"reported_at":"2026-01-19T05:43:19Z","reporter":209271,"comment":"Blocked by UFW (TCP on 52128)\nSource port: 53\nTTL: 113\nPacket length: 40\nTOS: 0x00\n\nThis report (for 8.8.8.8) was generated by:\nhttps:\/\/github.com\/sefinek\/UFW-AbuseIPDB-Reporter","categories":[14]},{"reported_at":"2026-01-18T06:56:55Z","reporter":258755,"comment":"Auto-reported by Fail2Ban (NPM-Auth)","categories":[18,21]},{"reported_at":"2026-01-18T05:11:10Z","reporter":264073,"comment":"...","categories":[18,22]},{"reported_at":"2026-01-17T23:07:19Z","reporter":56171,"comment":"ThreatBook Intelligence: Whitelist,cdn more details on https:\/\/threatbook.io\/ip\/8.8.8.8\n2026-01-17 01:28:07 \/cgi-bin\/network_config\/nsg_masq.cgi?user_name=admin&session_id=..\/&lang=zh_CN.UTF-8&act=2&proto=;ls>\/usr\/local\/lyx\/lyxcenter\/web\/SpVk.html;","categories":[21]},{"reported_at":"2026-01-17T08:25:47Z","reporter":209271,"comment":"Blocked by UFW (TCP on 65265)\nSource port: 53\nTTL: 117\nPacket length: 40\nTOS: 0x00\n\nThis report (for 8.8.8.8) was generated by:\nhttps:\/\/github.com\/sefinek\/UFW-AbuseIPDB-Reporter","categories":[14]},{"reported_at":"2026-01-17T06:28:36Z","reporter":261807,"comment":"Fail2Ban identified brute-force attack from 8.8.8.8","categories":[22]},{"reported_at":"2026-01-17T04:02:14Z","reporter":44461,"comment":"IPFire IPS Alert (2026-01-17): ET MALWARE Possible Tinba DGA NXDOMAIN Responses. Observed events: 1","categories":[21]},{"reported_at":"2026-01-16T10:16:38Z","reporter":209271,"comment":"Blocked by UFW (TCP on 64329)\nSource port: 53\nTTL: 117\nPacket length: 40\nTOS: 0x00\n\nThis report (for 8.8.8.8) was generated by:\nhttps:\/\/github.com\/sefinek\/UFW-AbuseIPDB-Reporter","categories":[14]},{"reported_at":"2026-01-15T15:05:06Z","reporter":134282,"comment":"Unauthorized connection attempt","categories":[14,15,20]}],"scraped_at":"2026-01-23T12:53:32Z","is_whitelisted":true,"is_public":true,"_cached":true,"_cache_key":"ipx_api:abuse_check:8_8_8_8"}
curl --location --request GET 'https://zylalabs.com/api/11761/ip+abuse+data+extractor+api/22308/ip+verification?ip=8.8.8.8' --header 'Authorization: Bearer YOUR_API_KEY'
| Header | Description |
|---|---|
Authorization
|
[Required] Should be Bearer access_key. See "Your API Access Key" above when you are subscribed. |
No long-term commitment. Upgrade, downgrade, or cancel anytime. Free Trial includes up to 50 requests.
The IP Verification endpoint returns detailed information about an IP address, including its reputation, abuse reports, recent activity, network context, and metadata such as ISP, country, and usage type.
Key fields in the response include "ip," "is_listed," "confidence_of_abuse," "total_reports," "distinct_reporters," "first_reported_at," "last_reported_at," and "reports," which detail specific incidents.
The response data is structured in JSON format, with top-level fields providing summary information and a nested "reports" array detailing individual abuse incidents, including timestamps and comments.
The endpoint provides information on abuse reports, incident frequency, types of detected activities, ISP details, country of origin, and the IP's whitelist or blacklist status.
The API aggregates data from multiple sources, including automated systems and manual reports, that track suspicious behaviors like unauthorized access attempts and port scans.
Data accuracy is maintained through continuous monitoring and validation from various reporting sources, ensuring that the information reflects current and reliable abuse reports.
Typical use cases include enhancing security measures, monitoring network traffic for suspicious activity, and making informed decisions about allowing or blocking IP connections.
Users can analyze the "confidence_of_abuse" score to assess threat levels, review "reports" for specific incidents, and use the ISP and country information to contextualize the IP's behavior.
To obtain your API key, first sign in to your account and navigate to the API you want to use. From the API's Pricing section, choose a plan and complete the subscription process. Once subscribed, return to the API page and you will see your API Access Key displayed at the top of the documentation page. You can use this key to authenticate your requests.
You can’t switch APIs during the free trial. If you subscribe to a different API, your trial will end and the new subscription will start as a paid plan.
The free trial lasts for 7 days and allows you to make up to 50 API requests.
No, the free trial is available only once, so we recommend using it on the API that interests you the most. Most of our APIs offer a free trial, but some may not include this option.
Yes. If the API offers a free trial, you will see a "Free 7-Day Trial" option in its Pricing section. The trial lasts for 7 days and allows up to 50 API requests, enabling you to evaluate the API before subscribing to a paid plan.
Zyla API Hub is like a big store for APIs, where you can find thousands of them all in one place. We also offer dedicated support and real-time monitoring of all APIs. Once you sign up, you can pick and choose which APIs you want to use. Just remember, each API needs its own subscription. But if you subscribe to multiple ones, you'll use the same key for all of them, making things easier for you.
You can monitor your API usage through the response headers included with every request:
x-zyla-api-calls-monthly-used: Shows the total number of API requests you have used during the current billing period.
x-zyla-api-calls-monthly-remaining: Shows the number of API requests you have remaining for the current billing period.
Yes, you can cancel your subscription at any time. Simply go to the Pricing section of the API you're subscribed to and click the "Unsubscribe" button.
Please note that upgrades, downgrades, and cancellations take effect immediately. Once your subscription is canceled, access to the service will end immediately, regardless of any remaining API calls in your quota.
Please have a look at our Refund Policy: https://zylalabs.com/terms#refund
Service Level:
100%
Response Time:
188ms
Service Level:
100%
Response Time:
543ms
Service Level:
100%
Response Time:
361ms
Service Level:
100%
Response Time:
136ms
Service Level:
100%
Response Time:
111ms
Service Level:
100%
Response Time:
593ms
Service Level:
100%
Response Time:
0ms
Service Level:
100%
Response Time:
3,497ms
Service Level:
100%
Response Time:
170ms
Service Level:
100%
Response Time:
680ms
Service Level:
100%
Response Time:
3,472ms
Service Level:
100%
Response Time:
1,249ms
Service Level:
100%
Response Time:
2,684ms
Service Level:
100%
Response Time:
1,130ms
Service Level:
100%
Response Time:
883ms
Service Level:
100%
Response Time:
4,671ms
Service Level:
100%
Response Time:
53ms
Service Level:
100%
Response Time:
1,867ms
Service Level:
100%
Response Time:
4,553ms
Service Level:
100%
Response Time:
780ms