AbuseIPDB · JSON Structure

Abuseipdb Check Response Structure

Structure of the response returned by GET /api/v2/check, describing the abuse data for a single IP address.

Type: object Properties: 15
Anti MalwareBlacklistCyber SecurityIP ReputationNetwork SecurityPublic APIsThreat Intelligence

CheckResponse is a JSON Structure definition published by AbuseIPDB, describing 15 properties. It conforms to the https://json-structure.org/meta/core/v0/# meta-schema.

Properties

ipAddress isPublic ipVersion isWhitelisted abuseConfidenceScore countryCode countryName usageType isp domain hostnames isTor totalReports numDistinctUsers lastReportedAt

Meta-schema: https://json-structure.org/meta/core/v0/#

JSON Structure

Raw ↑ 
{
  "$schema": "https://json-structure.org/meta/core/v0/#",
  "$id": "https://raw.githubusercontent.com/api-evangelist/abuseipdb/refs/heads/main/json-structure/abuseipdb-check-response-structure.json",
  "name": "CheckResponse",
  "description": "Structure of the response returned by GET /api/v2/check, describing the abuse data for a single IP address.",
  "type": "object",
  "properties": {
    "ipAddress": { "type": "string", "description": "The IPv4 or IPv6 address that was queried." },
    "isPublic": { "type": "boolean", "description": "Whether the address is publicly routable." },
    "ipVersion": { "type": "int32", "description": "IP version: 4 or 6." },
    "isWhitelisted": { "type": "boolean", "description": "Whether the IP appears on any AbuseIPDB whitelist." },
    "abuseConfidenceScore": { "type": "int32", "description": "Confidence (0-100) that the IP is malicious." },
    "countryCode": { "type": "string", "description": "ISO 3166-1 alpha-2 country code." },
    "countryName": { "type": "string", "description": "Full country name." },
    "usageType": { "type": "string", "description": "Reported usage type (e.g., Data Center, Residential)." },
    "isp": { "type": "string", "description": "Internet Service Provider name." },
    "domain": { "type": "string", "description": "Primary domain associated with the IP." },
    "hostnames": {
      "type": "array",
      "description": "Reverse DNS hostnames seen for the IP.",
      "items": { "type": "string" }
    },
    "isTor": { "type": "boolean", "description": "Whether the IP is a known Tor exit node." },
    "totalReports": { "type": "int32", "description": "Total reports against this IP within the requested window." },
    "numDistinctUsers": { "type": "int32", "description": "Number of unique reporters." },
    "lastReportedAt": { "type": "string", "description": "ISO 8601 timestamp of the most recent report." }
  }
}