> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # AbuseIPDB API > Check the IP addresses in security alerts against AbuseIPDB's abuse reports, read the reports, and report confirmed attackers The AbuseIPDB API tool gives Neo agents IP reputation from AbuseIPDB, a shared database of IP addresses reported for abuse. The common use is a security alert ticket (a risky sign-in from SaaS Alerts, an outside-approved-location alert, a firewall or EDR detection): the agent checks the IP behind it and adds the result to its investigation before it judges the alert. Automatically enabled when you configure AbuseIPDB permissions in your agent workflow. ## What It Does * Check an IP address: its abuse confidence score (0 to 100), how many reports and reporters, the newest report, the ISP, domain, country and usage type (ISP, mobile, data centre), and whether it is a Tor exit node * Read the reports on an IP, with their attack categories (brute force, phishing, port scan, hacking and others) * Check a whole network range (CIDR) for reported addresses * Read the blacklist of the most reported IPs * Report an attacking IP, alone or in a bulk CSV, and delete your account's own reports of an IP filed in error ## How the agent uses it on an alert The agent takes the IP from the alert or the ticket, skips a private address, and checks it once. A high score with recent reports from several users counts as threat-intelligence evidence that the IP is malicious; a score of zero means AbuseIPDB gives the IP no current abuse confidence, and the report count says whether anyone reported it; neither is proof that the sign-in is safe. A Tor exit node or a data centre address behind a user's sign-in counts as suspicious. Your agent's instructions decide the verdict and the action: AbuseIPDB is one piece of evidence, and the agent names its findings in the note with a link to the IP's AbuseIPDB page. ## Permission Groups | Group | Access levels | Covers | | - | - | - | | IP Reputation Lookups | Disabled, Read Only | Check an IP, read its reports, check a network, read the blacklist | | Abuse Reports | Disabled, Read / Write | Report an IP, send a bulk report, delete your account's own reports of an IP | ## Access Profiles | Profile | What runs on its own | What asks a technician | | - | - | - | | **Read Only** | Every lookup | No report is allowed | | **Helpdesk** | Every lookup | Every report and deletion | | **IT Admin** | Every lookup | Every report and deletion | | **Full Automation** | Every lookup, report and deletion | Nothing | Reporting needs an AbuseIPDB account approved for reporting: request reporting privilege on [abuseipdb.com/report](https://www.abuseipdb.com/report). A report is public: every AbuseIPDB user sees it, and it adds to the address's score, which can put it on the AbuseIPDB blacklist that some firewalls block. So both Helpdesk and IT Admin ask before a report. The agent reports only an address your instructions or a technician confirm as an attacker, never a client's own office, a user's home or mobile address, or an approved location, and it keeps user names, email addresses, client names, host names and internal addresses out of the published comment. ## Limits AbuseIPDB sets a daily limit per endpoint by plan. The free plan allows 1,000 IP checks, 100 report lists, 100 network checks (up to a /24 and 30 days back), 5 blacklists and 1,000 reports a day; paid plans raise them. When a limit is spent, the agent says the AbuseIPDB check could not run and judges the alert on the other evidence; it does not wait or retry. AbuseIPDB also refuses a second report of one IP within 15 minutes. ## Safety Controls | Control | Behavior | | - | - | | **Your key only** | Neo sends your stored key in a header on every call, and drops any key an agent or script tries to send | | **No replay** | A report is never sent twice after a dropped connection, and a limit refusal is never retried | | **Documented calls only** | Neo sends only the seven operations in AbuseIPDB's API docs, each with its documented method | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.