360 Secure SkillHub
360 安全技能中心

IP Threat Check

通过 Python 脚本调用 ip-api 与 AbuseIPDB 查询单个或批量 IP 的地理位置、ISP 和威胁评分，支持 info、check、bulk 三种动作，需要 Python 3 运行，完整威胁查询需配置 AbuseIPDB API Key，结果以 JSON 格式输出。

freeter226
freeter226
热度 43.65
最近更新 2026-05-11 17:35:03
分类：安全依赖：代码执行 / 第三方 API / 读写文件应用场景：研究 / 数据处理

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add ip-threat-check
Metadata
name
ip-threat-check
description
Check IP address threat intelligence. Query multiple sources for IP reputation, geolocation, and threat scores.
metadata
{"openclaw":{"emoji":"🔍","requires":{"bins":["python3"],"env":["ABUSEIPDB_API_KEY"]}}}

IP Threat Check

Check IP address threat intelligence from multiple sources.

Features

  • Multi-source Query - Query multiple threat intelligence sources
  • Geolocation - Get IP geolocation info
  • Threat Score - Check abuse/threat scores
  • History - View recent abuse reports
  • Bulk Check - Check multiple IPs at once

Usage

python3 skills/ip-threat-check/scripts/ip_threat.py <action> [options]

Actions

Action Description
check Check single IP address
bulk Check multiple IPs
info Get basic IP info (no API key needed)

Options

Option Type Default Description
--ip string - IP address to check
--file string - File with IPs (one per line)
--source string all Source (all, abuseipdb, ipapi)
--days int 30 Days of history to check

Data Sources

Source API Key Info Provided
ip-api.com ❌ Free Geolocation, ISP
AbuseIPDB ✅ Required Threat score, reports
VirusTotal ✅ Optional Additional threat info

Examples

# Basic IP info (no API key)
python3 skills/ip-threat-check/scripts/ip_threat.py info --ip 8.8.8.8

# Full threat check (requires API key)
python3 skills/ip-threat-check/scripts/ip_threat.py check --ip 192.168.1.1

# Bulk check
python3 skills/ip-threat-check/scripts/ip_threat.py bulk --file ips.txt

Environment Variables

Variable Required Description
ABUSEIPDB_API_KEY Optional AbuseIPDB API key

Output Example

{
  "success": true,
  "ip": "8.8.8.8",
  "geolocation": {
    "country": "United States",
    "city": "Mountain View",
    "isp": "Google LLC"
  },
  "threat": {
    "score": 0,
    "reports": 0,
    "risk": "low"
  }
}

Use Cases

  1. Security Analysis - Check suspicious IPs
  2. Log Analysis - Enrich log data with threat info
  3. Incident Response - Quick IP reputation check
  4. Threat Hunting - Identify malicious IPs

Current Status

In development.