Report an IP Address. Special permission required

Parameters:

• "api_token" your api token required
• "ip" the ip address to report (IPv4 or IPv6) required
• "reason" the reason the ip adress is being reported. required

Responses:

• 200 {"message":"Reported successfully"}
• 401 {"error":"Not authorized"}
• 422 {"error":"Error in request"}

Fetch information about an IP Address.

Parameters:

• "api_token" your api token required
• "ip" the ip address you wish to fetch information about (IPv4 or IPv6) required

Responses:

• 200 {"ip":(string),"country_code":(string),"country_name":(string),"region_code":(string),"region_name":(string),"city":(string),"zip_code":(string),"time_zone":(string),"latitude":(float),"longitude":(float),"metro_code":(string),"first_seen":{"date":(timestamp),"timezone_type":(int),"timezone":(string)},"last_seen":{"date":(timestamp),"timezone_type":(int),"timezone":(string)},"registered_events":(int),"events":[{"reason":(string),"target_country_code":(string),"target_country_name":(string),"time":{"date":(timestamp),"timezone_type":(int),"timezone":(string)}}]}
• 401 {"error":"Not authorized"}

Get a list of listed IP addresses.

Parameters:

• "api_token" your api token required
• "limit" The number of records returned per query default: 25 - maximum: 250
• "page" The page number of records returned default: 1
• "sort" Sort the records by "last_report", "country" default: "last_report"

Responses:

• 200 [{"ip":(string),"country_code":(string),"country_name":(string),"region_code":(string),"region_name":(string),"city":(string),"zip_code":(string),"time_zone":(string),"latitude":(float),"longitude":(float),"metro_code":(string),"first_seen":{"date":(timestamp),"timezone_type":(int),"timezone":(string)},"last_seen":{"date":(timestamp),"timezone_type":(int),"timezone":(string)},"registered_events":(int),"events":[{"reason":(string),"target_country_code":(string),"target_country_name":(string),"time":{"date":(timestamp),"timezone_type":(int),"timezone":(string)}}]}]
• 401 {"error":"Not authorized"}

Get a list of IP addresses usable for ipset.

Parameters:

• "api_token" your api token required

Responses:

• 200 returns a raw list of IP addresses
• 401 {"error":"Not authorized"}

Use Fail2ban to report and contribute to the list.

Usage:

• Modify your jail file(s) for example: "/etc/fail2ban/action.d/iptables-multiport.conf" and add the following to your "actionban":
  curl -H "Content-Type: application/json" -X POST -d '{"api_token":"your_api_token","ip":"<ip>","reason":"<name>"}' http://blacklist.netabuse.net/api/report

Use ipset create and update a banlist.

Usage:

• Create a file blacklist.sh with the following contents:
  #!/bin/sh
  curl -H "Content-Type: application/json" -X GET -d '{"api_token":"your_api_key"}' https://blacklist.netabuse.net/api/ipset > blacklist.txt
  ipset flush blacklist
  ipset -N blacklist iphash
  while read ip; do ipset -A blacklist "$ip"; done < blacklist.txt
  iptables -t raw -I PREROUTING -m set --match-set blacklist src,dst -j DROP