# 2s IP Abuse Check

> 2s IP Abuse Check is a paid API for AI agents from 2s.io, paid per call via x402, $0.00216/call, status unknown (last checked 2026-10-11).

Looks up an IP address against AbuseIPDB to return its abuse confidence score, report count, ISP, Tor status, and usage type

## Facts

- Endpoint: GET https://2s.io/api/security/ip-abuse?utm_source=zero.xyz
- Price: $0.00216/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-11
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/2s-ip-abuse-check-6da623ac
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_SR9IFZF_oHxDWVgZLjBqp

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 2s-ip-abuse-check-6da623ac
```

Example prompt: Can you check if 118.25.6.39 is a known malicious IP? I want its abuse confidence score, how many times it's been reported, whether it's a Tor node, and its ISP — look back up to 90 days.

## When to prefer this

Use this endpoint when you need structured IP abuse reputation data including confidence scores and report counts, especially in agent workflows that require no API key setup and support per-call USDC micropayments. Prefer this over direct AbuseIPDB calls when you need pay-as-you-go access without account registration.

## Known failure modes

- Missing required 'ip' query parameter returns validation error
- Invalid IP format (non-IPv4/IPv6 string) returns error or empty result
- maxAgeInDays outside 1-365 range returns validation error
- IP not found in AbuseIPDB returns empty items array with total 0
- Payment failure via x402 prevents request from being processed
- AbuseIPDB upstream downtime causes failed response

## How this service works

AbuseIPDB abuse report for a single IP — the crowd-sourced abuse-confidence score (0-100) the fail2ban / SSH-scanner / web-attack ecosystem reports into. Pass ip (IPv4 or IPv6). Returns abuseConfidenceScore, totalReports, numDistinctUsers, lastReportedAt, usageType (e.g. Data Center / Residential), ISP, domain, hostnames, isTor, isWhitelisted, and country. Set verbose=true for the individual report records (categories + reporter country). Optional maxAgeInDays (1-365, default 90) bounds the reporting window. Live crowd data an LLM cannot know — SOC alert triage, login-abuse blocking, and firewall decisions.

## Output

Returns a JSON object with ok status, total count, and an array of items each containing the IP address, its abuse confidence score (0-100), total number of abuse reports, number of distinct reporting users, ISP name, usage type (e.g. Data Center), country code, whether it's a Tor exit node, any associated hostnames, and the timestamp of the most recent report. Also includes data source attribution (AbuseIPDB).

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "required": [
      "ip"
     ],
     "properties": {
      "ip": {
       "type": "string",
       "description": "IPv4 or IPv6 address."
      },
      "verbose": {
       "type": "boolean",
       "default": false,
       "description": "Include individual report records."
      },
      "maxAgeInDays": {
       "type": "integer",
       "default": 90,
       "maximum": 365,
       "minimum": 1
      }
     }
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "schema": {
  "type": "object",
  "properties": {
   "ok": {
    "type": "boolean"
   },
   "items": {
    "type": "array",
    "items": {
     "type": "object",
     "properties": {
      "isp": {
       "type": "string"
      },
      "isTor": {
       "type": "boolean"
      },
      "hostnames": {
       "type": "array",
       "items": {}
      },
      "ipAddress": {
       "type": "string"
      },
      "usageType": {
       "type": "string"
      },
      "countryCode": {
       "type": "string"
      },
      "totalReports": {
       "type": "integer"
      },
      "lastReportedAt": {
       "type": "string"
      },
      "numDistinctUsers": {
       "type": "integer"
      },
      "abuseConfidenceScore": {
       "type": "integer"
      }
     }
    }
   },
   "total": {
    "type": "integer"
   },
   "source": {
    "type": "object",
    "properties": {
     "url": {
      "type": "string"
     },
     "license": {
      "type": "string"
     },
     "provider": {
      "type": "string"
     }
    }
   }
  }
 },
 "example": {
  "ok": true,
  "items": [
   {
    "isp": "Tencent Cloud",
    "isTor": false,
    "hostnames": [],
    "ipAddress": "118.25.6.39",
    "usageType": "Data Center/Web Hosting/Transit",
    "countryCode": "CN",
    "totalReports": 432,
    "lastReportedAt": "2026-06-19T22:17:01+00:00",
    "numDistinctUsers": 51,
    "abuseConfidenceScore": 100
   }
  ],
  "total": 1,
  "source": {
   "url": "https://www.abuseipdb.com/",
   "license": "AbuseIPDB API — free/commercial tiers; attribution required (CC BY 4.0 for data display)",
   "provider": "AbuseIPDB"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/2s-ip-abuse-check-6da623ac/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)