360 Secure SkillHub
360 安全技能中心

IP Threat Check

核心功能：支持多源IP威胁情报查询，可获取地理位置、威胁分数、历史滥用报告，支持批量IP检测。典型场景：可疑IP安全分析、日志数据补全、网络事件应急响应、威胁狩猎。输入通过命令行指定单个IP或IP列表文件，可选数据源；输出为JSON格式，包含IP地理信息、威胁评分及风险等级等详情，部分功能需AbuseIPDB API密钥。

freeter226
freeter226
热度 43.67
最近更新 2026-05-11 17:35:03
分类：安全依赖：代码执行 / 第三方 API / 读写文件应用场景：API 集成 / 报告撰写 / 数据处理

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add ip-threat-check
Metadata
name
ip-threat-check
description
Check IP address threat intelligence. Query multiple sources for IP reputation, geolocation, and threat scores.
metadata
{"openclaw":{"emoji":"🔍","requires":{"bins":["python3"],"env":["ABUSEIPDB_API_KEY"]}}}

IP Threat Check

Check IP address threat intelligence from multiple sources.

Features

  • Multi-source Query - Query multiple threat intelligence sources
  • Geolocation - Get IP geolocation info
  • Threat Score - Check abuse/threat scores
  • History - View recent abuse reports
  • Bulk Check - Check multiple IPs at once

Usage

python3 skills/ip-threat-check/scripts/ip_threat.py <action> [options]

Actions

Action Description
check Check single IP address
bulk Check multiple IPs
info Get basic IP info (no API key needed)

Options

Option Type Default Description
--ip string - IP address to check
--file string - File with IPs (one per line)
--source string all Source (all, abuseipdb, ipapi)
--days int 30 Days of history to check

Data Sources

Source API Key Info Provided
ip-api.com ❌ Free Geolocation, ISP
AbuseIPDB ✅ Required Threat score, reports
VirusTotal ✅ Optional Additional threat info

Examples

# Basic IP info (no API key)
python3 skills/ip-threat-check/scripts/ip_threat.py info --ip 8.8.8.8

# Full threat check (requires API key)
python3 skills/ip-threat-check/scripts/ip_threat.py check --ip 192.168.1.1

# Bulk check
python3 skills/ip-threat-check/scripts/ip_threat.py bulk --file ips.txt

Environment Variables

Variable Required Description
ABUSEIPDB_API_KEY Optional AbuseIPDB API key

Output Example

{
  "success": true,
  "ip": "8.8.8.8",
  "geolocation": {
    "country": "United States",
    "city": "Mountain View",
    "isp": "Google LLC"
  },
  "threat": {
    "score": 0,
    "reports": 0,
    "risk": "low"
  }
}

Use Cases

  1. Security Analysis - Check suspicious IPs
  2. Log Analysis - Enrich log data with threat info
  3. Incident Response - Quick IP reputation check
  4. Threat Hunting - Identify malicious IPs

Current Status

In development.