isipsafe
curl and shell logo

curl and shell

Report and check from any script or cron job.

Everything in isipsafe is one HTTP request away. These are the building blocks the other integrations use.

Report an address

curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip=203.0.113.50 -d categories=ssh,brute-force -d comment="sshd: 40 failed root logins"

Reporting needs your API key (free; sign in to get one). Category codes are on the categories page; separate several with commas.

Check an address

curl -s "https://isipsafe.com/api/v1/check?ip=203.0.113.50&key=$ISIPSAFE_KEY"

Without a key you can make 400 lookups per 24 hours; with a free account's key, 10,000; Enterprise keys have no limit.

Only the score:

curl -s "https://isipsafe.com/api/v1/check?ip=203.0.113.50" | jq .data.abuseConfidenceScore

Download the blocklist

curl -s "https://isipsafe.com/api/v1/blocklist?key=$ISIPSAFE_KEY&format=txt&confidenceMinimum=90" -o blocklist.txt

Report every address in a file

xargs -r -I{} curl -s "https://isipsafe.com/api/v1/report?key=$ISIPSAFE_KEY" -d ip={} -d categories=port-scan < addresses.txt

For more than a few hundred, use the bulk upload instead.

Handling errors

  • 429 on a report usually means you already reported that address in the last 15 minutes. Treat it as success.
  • Report 127.0.0.2 to see what a 429 looks like when testing your script.
  • Every response has X-RateLimit-Remaining and, when limited, Retry-After.

Need a hand?

If something here does not work with your version of curl and shell, or you have improved it, tell us. We update these pages with what people send.

curl and shell and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.