AbuseIPDB Blacklist Generator

A Python script that queries the AbuseIPDB v2 API to generate a firewall-ready IP address blacklist. Supports plain-text and JSON output, country filtering, and confidence score thresholds.

• Fetches a plain-text or JSON IP blacklist from AbuseIPDB
• Configurable IP limit (up to your subscription tier's hard cap)
• Subscriber options: filter by country (onlyCountries / exceptCountries) and confidence score (confidenceMinimum)
• API key managed securely via .env file (never hardcoded)
• Graceful degradation — if your limit exceeds your subscription cap, the list is silently truncated with no error thrown

• REST API integration using the requests library
• Secure credential management with python-dotenv
• Query parameter construction for flexible, configurable API calls
• Understanding of HTTP response formats (text/plain vs application/json)
• GRC-aligned design: built with audit trails, tiered risk tolerance, and firewall pipeline ingestion in mind
• Awareness of API rate limiting, subscription tiers, and graceful degradation behavior

requests
python-dotenv

Install with:

pip install requests python-dotenv

1. Clone the repository

git clone https://github.com/aarondutton-grc/abuseipdb-blacklist-generator.git
cd abuseipdb-blacklist-generator

2. Install dependencies

pip install requests python-dotenv

3. Create a .env file in the project root:

ABUSEIPDB_API_KEY=your_api_key_here

Register for a free API key at abuseipdb.com/register.
Manage your keys at abuseipdb.com/account/api/keys.

4. Run the script

python abuseipdb_blacklist.py

Edit the querystring and headers dictionaries in the script to customize behavior.

• If your limit value exceeds your tier's cap, the list is silently truncated — no error is thrown.
• HTTP 429 Too Many Requests = daily download limit reached.
• Check current usage: abuseipdb.com/account/api/usage

Firewall blocklist
Plain-text output feeds directly into most firewall and SIEM ingestion pipelines with no transformation required.

Regional threat blocking
Combine onlyCountries + confidenceMinimum to build a targeted blocklist aligned to your org's threat model. For example, an organization with no international user base can block all foreign high-confidence IPs in a single API call.

Audit trail
Switch to JSON output to capture per-IP metadata (confidence score, country, last reported date). This supports evidence collection for SOC 2, HIPAA, or internal security reviews.

Tiered confidence tuning
Adjust confidenceMinimum based on risk tolerance:

• 100 → High precision: fewer blocks, minimal false positives
• 75–90 → Broader coverage: more blocks, periodic review recommended

• AbuseIPDB support will never ask for your API key or account password. They may ask for your user ID or email in support tickets.
• Download your API request logs (CSV format, gzipped if large) at: abuseipdb.com/account/api/logs
• Never commit your .env file. Add it to .gitignore:

.env

MIT — see LICENSE for details.

Aaron Dutton
GitHub · LinkedIn