# 2s IP Block Abuse Report Lookup

> 2s IP Block Abuse Report Lookup is a paid API for AI agents from 2s.io, paid per call via x402, $0.0024/call, status unknown (last checked 2026-09-14).

Returns abuse reports and confidence scores for all IPs within a given CIDR network block, sourced from AbuseIPDB.

## Facts

- Endpoint: GET https://2s.io/api/security/ip-block
- Price: $0.0024/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/2s-ip-block-abuse-report-lookup-5ccd6728
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_FUOvLLme_1DmoNBl09DPA

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability 2s-ip-block-abuse-report-lookup-5ccd6728
```

Example prompt: Check the abuse history for the network block 118.25.0.0/24 — show me all reported IPs with their confidence scores and number of reports from the last 30 days.

## When to prefer this

Use this endpoint when you need to assess the abuse reputation of an entire subnet or IP range (CIDR notation) rather than a single IP. It is ideal for threat intelligence workflows, firewall rule generation, or evaluating whether a range of IPs associated with a data center, ISP, or attack campaign has a history of abuse. Prefer this over single-IP lookups when investigating a network block or validating traffic from a known CIDR range.

## Known failure modes

- Invalid or malformed CIDR network string returns an error
- Network block too large may return empty or partial results
- maxAgeInDays out of range (must be 1-365) returns validation error
- limit out of range (must be 1-1000) returns validation error
- No reports found for clean network returns empty items array
- Payment failure (402) if USDC balance insufficient

## How this service works

AbuseIPDB subnet (CIDR) check — which IPs inside a network block have been reported for abuse. Pass network as a CIDR (e.g. 118.25.0.0/24; AbuseIPDB supports up to /16 for IPv4, /112 for IPv6). Returns the block metadata (network/netmask/min-max addresses, possible hosts, address-space description) plus reportedAddress: each flagged IP with numReports, abuseConfidenceScore, mostRecentReport, and country. Optional maxAgeInDays (1-365, default 30) and limit. Use to vet a hosting range, score a customer's netblock, or sweep your own allocation.

## Output

Returns a JSON object with a list of network entries for the queried CIDR block, each containing the network address, netmask, min/max addresses, number of possible hosts, and an array of reported IPs — each with the specific IP address, number of abuse reports, country code, most recent report timestamp, and an abuse confidence score (0-100). Also includes total count and data source/license attribution from AbuseIPDB.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method",
    "queryParams"
   ],
   "properties": {
    "type": {
     "const": "http"
    },
    "method": {
     "const": "GET"
    },
    "queryParams": {
     "required": [
      "network"
     ],
     "properties": {
      "limit": {
       "type": "integer",
       "default": 100,
       "maximum": 1000,
       "minimum": 1
      },
      "network": {
       "type": "string",
       "description": "CIDR network, e.g. 118.25.0.0/24."
      },
      "maxAgeInDays": {
       "type": "integer",
       "default": 30,
       "maximum": 365,
       "minimum": 1
      }
     }
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/2s-ip-block-abuse-report-lookup-5ccd6728/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from 2s.io](https://www.zero.xyz/host/2s.io/llms.txt)