AbuseIPDB Integration module

[Shop Suey]

Do you have entered the "AbuseIPDB - User ID" ?
I can't find it at their website.

[Shop Suey]

I see at the logs that an IP has been abandoned via API.
Then ~6 hours later this IP shows up again and is again? blacklisted via API (as the logs suggest).

Is it possible to test so if I would use this bad IP?
The test mode seems to do something different.

[retched]

Do you have entered the "AbuseIPDB - User ID" ?
I can't find it at their website.

No. You don't need to use the AbuseIPDB-User ID. This is only if you want the Abuse IPDB Contributor Badge to appear in your backend to grant you the Webmaster+Supporter status so that you can check and report on 5000 IPs a day instead of 1000 IPs a day.

In order for the module to work however, you need to input the API Key from the API section.

Also please read my last response with regards to Contributor Badge. That is another way to see your Profile ID.

[Shop Suey]

Thank you.
I just wasn't sure how to deal with it.
And today there's no id I could extract of the url as said in the settings of my version (even if I wanted to do so).
Maybe they have changed that?!

[retched]

I'm going to create a new account because I'm not seeing how the User ID isn't viewable in the URL bar. I might have opted into something and not realize it.

EDIT: That was hella fast. Made a new account as a webmaster AND individual. I can click on the "View" link and see the URL to the new profiles and have the Contributor Badge tab too. (Didn't need to verify either one. Just made it and on the dashboard, I'm provided a link to the profile (the view link) and I can see it in the next page.)

What am I seeing that anyone else on this thread isn't as far as how to get your profile ID?

[retched]

For the sake of example:

After clicking on the View Profile link on the main AbuseIPDB dashboard just as you load in (of an unverified account I just made). I see the following:



That number at the end of the URL bar is the profile ID number to be inserted into the admin dashboard where prompted. Is no one else seeing this when you log in or am I overcomplicating things?

[Shop Suey]

I can falsify that.
I have just a clean basic url or any subfolders e.g. /report/ or /bulk-report/ and so on.
But no url paramaters.

[retched]

I can falsify that.
I have just a clean basic url or any subfolders e.g. /report/ or /bulk-report/ and so on.
But no url paramaters.

Where are you looking exactly? Like what does your member area of the AbuseIPDB website look like just after you log in?

[retched]

I can falsify that.
I have just a clean basic url or any subfolders e.g. /report/ or /bulk-report/ and so on.
But no url paramaters.

Can you visit the member area. The top right hand corner, click Account. And there should be a box that has a link to "View Profile". What you showed is the main abuseipdb.com when you visit. After you log in, you're taken immediately to the dashboard/account area.

[marcopolo]

🛡️ Major Release – AbuseIPDB v4.0.0

This version introduces advanced flood detection and blocking, giving you full control over how your site handles aggressive traffic patterns.

🚨 What’s New:
Flood Blocking by IP Range
You can now automatically block 2-octet (e.g., 192.168.*) or 3-octet (e.g., 192.168.1.*) IP ranges.
Example: If 192.168.x.x exceeds the request limit (default 25 hits in 30 minutes), the entire 2-octet range will be blocked. If 30 minutes pass with no further hits, the block resets.

Country & Foreign Blocking
Works the same way — if traffic from a country exceeds the flood threshold, the country is temporarily blocked.
You can choose to allow low-score IPs through by setting a minimum AbuseIPDB score (or set it to 0 to block all traffic from that country).
Manual country blocking is also supported.

High Score Caching
New AbuseIPDB high-score cache prevents repeated API calls. If an IP already scored above the block threshold, it won’t be rechecked for X days (default: 7).

New Visual Shields in Who’s Online
Clearly see why an IP is being blocked:

🔴 Red – Score-blocked by AbuseIPDB

🟣 Purple – Manually blacklisted

🔵 Blue – Manually country-blocked

🟠 Orange – Flood-blocked (range, country, or foreign)


Personal Recommendation:
For daily use, I recommend enabling only the 2-octet, 3-octet, and foreign flood protection.
Use country-based blocking only during an active attack — because it will also block IPs from your default country.

That’s why foreign blocking is preferred for general use — it works the same way but will never block your default country.


Enjoy!