{"id":7851,"date":"2025-08-14T05:52:35","date_gmt":"2025-08-14T03:52:35","guid":{"rendered":"https:\/\/www.lrob.fr\/?p=7851"},"modified":"2025-08-14T05:52:35","modified_gmt":"2025-08-14T03:52:35","slug":"guide-monitoring-reputation-uptime-kuma-abuseipdb","status":"publish","type":"post","link":"https:\/\/www.lrob.fr\/en\/blog\/sysadmin\/guide-monitoring-reputation-uptime-kuma-abuseipdb\/","title":{"rendered":"Guide: Free IP reputation monitoring with Uptime Kuma and AbuseIPDB"},"content":{"rendered":"<div class=\"wp-block-group has-global-padding is-layout-constrained wp-container-core-group-is-layout-38c38467 wp-block-group-is-layout-constrained\" style=\"border-width:1px;padding-top:var(--wp--preset--spacing--20);padding-right:var(--wp--preset--spacing--20);padding-bottom:var(--wp--preset--spacing--20);padding-left:var(--wp--preset--spacing--20)\">\n<p class=\"wp-block-paragraph\">A single compromise on a web server can turn it into a <strong>attack vector<\/strong> You'll be blacklisted for your IP if you don't send out massive amounts of spam or botnets. So you need to <strong>detect quickly<\/strong> the first signs to react quickly and reduce the negative impact.<\/p>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Security experts are realistic and unanimous: given enough time, any service will end up hacked. A 0-day vulnerability, a technical error, a sufficiently long attack... Security at 100% is out of this world.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So the right approach, in addition to getting closer to 0% risk by <a href=\"https:\/\/www.lrob.fr\/en\/features\/secure-web-host-cybersecurity\/\">preventive safety measures<\/a>, is to <strong>continuous monitoring<\/strong> the reputation of its IPs, so as to <strong>react at the first sign of trouble<\/strong> to limit the attack surface and prevent blacklists from getting out of control.<\/p>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Info: What is an IP blacklist?<\/summary>\n<p class=\"wp-block-paragraph\">An IP blacklist is a register of IP addresses known to be malicious or undesirable (spam, attacks, fraud), which systems consult to deny or restrict access. It is used by firewalls, mail servers and web sites, but can also produce false positives; entries evolve and can be removed after verification.<\/p>\n<\/details>\n\n\n\n<p class=\"wp-block-paragraph\">In this article, we'll look at how to set up an alert system based on two free solutions:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Uptime Kuma<\/strong>, a free monitoring tool, hosted on your own machine or a VPS ;<\/li>\n\n\n\n<li><strong>AbuseIPDB<\/strong>, collaborative database of reported IP addresses.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This adapted prevention is used for the\u2019<a class=\"\" href=\"https:\/\/www.lrob.fr\/en\/web-hosting\/\">web hosting infrastructure<\/a> LRob and should be useful to you, if you also host services. We remind you that the real-time status of the LRob infratructure, including any presence in the AbuseIPDB blacklist, is publicly available: <a class=\"\" href=\"https:\/\/uptime.lrob.net\/status\/lrob\" target=\"_blank\" rel=\"noopener\">https:\/\/uptime.lrob.net\/status\/lrob<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This step-by-step guide will show you how to reproduce this configuration at home. <\/p>\n\n\n\n<div class=\"wp-block-group has-global-padding is-layout-constrained wp-container-core-group-is-layout-c9a371c5 wp-block-group-is-layout-constrained\" style=\"border-width:1px;padding-top:var(--wp--preset--spacing--30);padding-right:var(--wp--preset--spacing--30);padding-bottom:var(--wp--preset--spacing--30);padding-left:var(--wp--preset--spacing--30)\">\n<p class=\"wp-block-paragraph\">\u26a0\ufe0f Are your servers costing you too much time and money? Don't miss our <a href=\"https:\/\/www.lrob.fr\/en\/web-hosting\/web-agency\/\">multi-site hosting packages<\/a>, that will earn you a <a href=\"https:\/\/www.lrob.fr\/en\/features\/high-performance-plesk-hosting-for-sites-and-agencies\/\">time<\/a> and a <a href=\"https:\/\/www.lrob.fr\/en\/features\/secure-web-host-cybersecurity\/\">safety<\/a> while saving money and benefiting from a high level of service. <a href=\"https:\/\/www.lrob.fr\/en\/features\/best-web-host-support\/\">exceptional support<\/a> ! Also available in <a href=\"https:\/\/www.lrob.fr\/en\/web-hosting\/\">single-site hosting<\/a>.<\/p>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"pourquoi-surveiller-la-reputation-de-son-ip\">Why monitor your IP's reputation?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Better to act <strong>at the first sign of trouble<\/strong> of a problem than waiting until it's too late.<br>If a mailbox is compromised or a website has a vulnerability, your server can quickly become a <strong>attack vector<\/strong>, for example, to send millions of spam messages in just a few minutes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">LRob already applies effective protection measures, such as a <strong>anti-bruteforce<\/strong> on emails and a <strong>hourly dispatch limit<\/strong>, to limit this kind of damage. But whatever the measures, proactive monitoring of the <strong>IP reputation<\/strong> enables any anomalies to be detected quickly, and action taken before the situation becomes a nuisance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Because <strong>abuse lists<\/strong> (<em>blacklists<\/em>) inform the public about the malicious use of your IP. And if your IP is blacklisted, providers often block e-mails, restrict access to certain services and generally harm the <strong>trust<\/strong> granted to a server or site.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">So the aim of the game is this: Not to be a victim of blacklists, but to use them as a tool <strong>reliable indicator<\/strong> to detect suspicious behavior on a machine, even when no active attack is taking place. Because attacks can be brief or very discreet. Those who receive them, on the other hand, can't miss them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">With regular monitoring, we can immediately identify any rise in the abuse score and take action. <strong>before<\/strong> before the consequences become costly. In short, it's half preventive, half curative. Or, to put it another way, the worst is avoided.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"ce-que-lon-va-mettre-en-place\">What you need before you start<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Before setting up this monitoring system, you need to have :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>access (free or paid) to the\u2019<strong><a href=\"https:\/\/www.abuseipdb.com\/register?plan=free\" target=\"_blank\" rel=\"noopener\">API AbuseIPDB<\/a><\/strong><\/li>\n\n\n\n<li>a <strong>instance <a href=\"https:\/\/github.com\/louislam\/uptime-kuma\" target=\"_blank\" rel=\"noopener\">Uptime Kuma<\/a><\/strong> functional, installed on a <strong>Local VM<\/strong>, a <strong>VPS<\/strong> or any other permanently accessible server.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Uptime Kuma will be configured to <strong>automatically query the AbuseIPDB API<\/strong>, retrieve the <strong>abuse score<\/strong> of your IP, and check if there's still <strong>less than or equal to<\/strong> to a fixed threshold (e.g. 5%).<br>If this score exceeds the chosen limit, you'll receive an alert so you can take prompt action.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This tutorial is based solely on <strong>AbuseIPDB<\/strong> as a source of reputation, which is already <strong>very reliable<\/strong> for everyday use.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"configuration-pas-a-pas-dans-uptime-kuma\">Step-by-step configuration in Uptime Kuma<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The aim is to create a <strong>monitor<\/strong> which will regularly check the abuse score of your IP on AbuseIPDB, and alert you if this score exceeds a set threshold. To do this, we'll use a JSON expression that returns <code>true<\/code> or <code>false<\/code> according to the result of the check. True: all is well. False: you receive the alert.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"1-creer-un-nouveau-moniteur\">1. Create a new base monitor<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In the Uptime Kuma interface :<\/p>\n\n\n\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-794e3cfa wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Click on <strong>\u201cAdd a monitor\u201d<\/strong><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a2f77a2c9224&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a2f77a2c9224\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"250\" height=\"123\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-add-new-monitor.jpg\" alt=\"Uptime Kuma add new monitor\" class=\"wp-image-7855\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-add-new-monitor.jpg 250w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-add-new-monitor-150x74.jpg 150w\" sizes=\"auto, (max-width: 250px) 100vw, 250px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-794e3cfa wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Monitor type<\/strong> : <code>HTTP(s) - Json Query<\/code><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a2f77a2c94bd&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a2f77a2c94bd\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"348\" height=\"206\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-monitor-type-HTTPS-Json-Query.jpg\" alt=\"Uptime Kuma Json Query\" class=\"wp-image-7856\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-monitor-type-HTTPS-Json-Query.jpg 348w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-monitor-type-HTTPS-Json-Query-300x178.jpg 300w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-monitor-type-HTTPS-Json-Query-150x89.jpg 150w\" sizes=\"auto, (max-width: 348px) 100vw, 348px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-794e3cfa wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Display name<\/strong> (Friendly Name), for example :<br><code>AbuseIPDB HOSTNAME IP<\/code><br><em>(replace HOSTNAME and IP with your values)<\/em><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a2f77a2c96a6&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a2f77a2c96a6\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"267\" height=\"77\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptim-kuma-abuseipdb-friendly-name.jpg\" alt=\"Uptime Kuma Friendly Name AbuseIPDB\" class=\"wp-image-7857\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptim-kuma-abuseipdb-friendly-name.jpg 267w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptim-kuma-abuseipdb-friendly-name-150x43.jpg 150w\" sizes=\"auto, (max-width: 267px) 100vw, 267px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-794e3cfa wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<ul class=\"wp-block-list\">\n<li><strong>Heartbeat Interval<\/strong> Set the desired frequency (e.g. every 3600 seconds, i.e. 1h).<\/li>\n\n\n\n<li><strong>Retries<\/strong> : 0<\/li>\n<\/ul>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a2f77a2c9888&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a2f77a2c9888\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"517\" height=\"453\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-intervals.jpg\" alt=\"Uptime Kuma Frequency AbuseIPDB\" class=\"wp-image-7859\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-intervals.jpg 517w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-intervals-300x263.jpg 300w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-intervals-150x131.jpg 150w\" sizes=\"auto, (max-width: 517px) 100vw, 517px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">2. Basic AbuseIPDB API monitor settings<\/h3>\n\n\n\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-794e3cfa wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<ul class=\"wp-block-list\">\n<li><strong>URL<\/strong> : <code>https:\/\/api.abuseipdb.com\/api\/v2\/check<\/code><\/li>\n\n\n\n<li><strong>Json Query<\/strong> : <code>$number($.data.abuseConfidenceScore) &lt;= 5<\/code>\n<ul class=\"wp-block-list\">\n<li><em>(replace <code><strong>5<\/strong><\/code> by your tolerance threshold, which corresponds to the percentage of risk on AbuseIPDB)<\/em><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Expected Value<\/strong> : <code>true<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\ud83d\udca1 This expression returns <code>true<\/code> if the score is less than or equal to your threshold, and <code>false<\/code> otherwise. Uptime Kuma then triggers an alert according to your notification settings, only if the result is <code>false<\/code>.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a2f77a2c9aae&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a2f77a2c9aae\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"526\" height=\"328\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-api-query-settings2.jpg\" alt=\"\" class=\"wp-image-7862\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-api-query-settings2.jpg 526w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-api-query-settings2-300x187.jpg 300w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-api-query-settings2-150x94.jpg 150w\" sizes=\"auto, (max-width: 526px) 100vw, 526px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n<\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"4-configurer-les-options-http\">3. Setting HTTP options for the AbuseIPDB API<\/h3>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-794e3cfa wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p class=\"wp-block-paragraph\">In <strong>HTTP Options<\/strong> :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Method<\/strong> : <code>GET<\/code><\/li>\n\n\n\n<li><strong>Body Encoding<\/strong> : <code>JSON<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">In <strong>Body<\/strong>, define this code by replacing <code>Your_IP<\/code> by the IP to be monitored :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n    \"ipAddress\": \"Your_IP\",\n    \"maxAgeInDays\": \"1\",\n    \"verbose\": \"true\"\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">In <strong>Headers<\/strong>, put your API key in place of <code>Your_API_Key<\/code> :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n    \"Key\": \"Your_API_Key\",\n    \"Accept\": \"application\/json\"\n}<\/code><\/pre>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a2f77a2c9d0c&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a2f77a2c9d0c\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"523\" height=\"723\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-http-options-abuseipdb.jpg\" alt=\"Uptime Kuma HTTP Options for AbuseIPDB API check\" class=\"wp-image-7861\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-http-options-abuseipdb.jpg 523w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-http-options-abuseipdb-217x300.jpg 217w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-http-options-abuseipdb-109x150.jpg 109w\" sizes=\"auto, (max-width: 523px) 100vw, 523px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n<\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">4. Check final configuration<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You should get a similar configuration:<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;6a2f77a2c9ece&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"6a2f77a2c9ece\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1078\" height=\"1265\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on--pointerdown=\"actions.preloadImage\" data-wp-on--pointerenter=\"actions.preloadImageWithDelay\" data-wp-on--pointerleave=\"actions.cancelPreload\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/config-uptime-kuma-query-abuseipdb.jpg\" alt=\"Configuration Uptime Kuma Monitoring de Blacklist AbuseIPDB\" class=\"wp-image-7853\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/config-uptime-kuma-query-abuseipdb.jpg 1078w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/config-uptime-kuma-query-abuseipdb-256x300.jpg 256w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/config-uptime-kuma-query-abuseipdb-873x1024.jpg 873w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/config-uptime-kuma-query-abuseipdb-128x150.jpg 128w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/config-uptime-kuma-query-abuseipdb-768x901.jpg 768w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/config-uptime-kuma-query-abuseipdb-600x704.jpg 600w\" sizes=\"auto, (max-width: 1078px) 100vw, 1078px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\tdata-wp-bind--aria-label=\"state.thisImage.triggerButtonAriaLabel\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.thisImage.buttonRight\"\n\t\t\tdata-wp-style--top=\"state.thisImage.buttonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"5-sauvegarder-et-tester\">5. Save and test<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Once you have defined the parameters, click on <strong>Save<\/strong> then observe the first test:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If the score is below the threshold \u2192 monitor <strong>UP<\/strong><\/li>\n\n\n\n<li>If the score exceeds the \u2192 monitor threshold <strong>DOWN<\/strong> and alert sent<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">With this setting, you'll know immediately if your IP's reputation is deteriorating.<br>For example:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Score 0<\/strong> \u2192 everything's fine<\/li>\n\n\n\n<li><strong>Score 4<\/strong> \u2192 still acceptable<\/li>\n\n\n\n<li><strong>Score 12<\/strong> \u2192 alert<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">A word about the JSON detection threshold trick<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">At LRob, almost 1 year ago, when we received a customer whose site had to be repaired following a hack, his site was exploited during the repair on our servers. This was the only instance of malicious use on LRob servers. This enabled us to <a href=\"https:\/\/www.lrob.fr\/en\/blog\/news-lrob\/lrob-contributes-abuseipdb\/\">discover AbuseIPDB<\/a> with great enthusiasm, as we were looking for just such a tool.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A brief incident with a positive outcome, you might say.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Except that since this incident, an AbuseIPDB contributor continues to report the server's IP every week, even though the incident has been over for almost 1 year. And there's no way to stop it. As soon as he issues even a single report, the IP score rises to <strong>4%<\/strong> of risk.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Basically, Uptime Kuma can only be used to check whether <strong>Expected Value = 0<\/strong>.<br>In other words, a risk at 1% or 4% triggered alertE. So this server was always on alert.<br>A <strong>false positive<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The clean solution: <strong>evaluate a threshold<\/strong> directly into the <em>Json Query<\/em> thanks to a <strong>expression JSONata<\/strong>. Rather than waiting for the exact value \u201c0\u201d, Uptime Kuma now checks that the score is <strong>less than or equal to<\/strong> to a healthy limit (e.g. <strong>5<\/strong>); and returns <code>true<\/code> or <code>false<\/code>. From now on, the state will only go on alert <strong>if the score exceeds the<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This is the principle of this code, which checks whether the value in question is less than or equal to 5.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$number($.data.abuseConfidenceScore) &lt;= 5<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Uptime Kuma waits for value <code>true<\/code> in return. If the threshold is below 5, no alert. If higher, alert.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This configuration correction has just been applied, so if you visit the\u2019<a href=\"https:\/\/uptime.lrob.net\/status\/lrob\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">server status<\/a> within 24 hours of the publication of this article, you'll see that \u00abBlacklists\u00bb is not at 100% uptime, unlike all the other services. Now you've got the whole story.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">We hope that the configuration used for the\u2019<a class=\"\" href=\"https:\/\/www.lrob.fr\/en\/web-hosting\/\">web hosting infrastructure<\/a> LRob will help you better secure your servers, to help us make a better Internet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">And if you think that was very interesting, remember that it's just the tip of the iceberg of what LRob does to ensure exceptional service!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We're convinced that LRob deserves to be better known.<br>Then take a look at <a href=\"https:\/\/www.lrob.fr\/en\/\">the site<\/a>, Read what we have to say, take a look at our offers, try out our in-house Chatbot, and don't hesitate to share what you find interesting on all your networks, to support our mission for a clean Internet!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Thank you for reading and for your support.<\/p>","protected":false},"excerpt":{"rendered":"<p>Automatically check whether your IPs are blacklisted? Here's how, with free tools that can save you a lot of trouble!<\/p>","protected":false},"author":1,"featured_media":7853,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ai_generated_summary":"","footnotes":""},"categories":[46],"tags":[74,61,75,76,77],"class_list":["post-7851","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sysadmin","tag-abuseipdb","tag-hebergement-web","tag-monitoring","tag-reputation-ip","tag-uptime-kuma"],"_links":{"self":[{"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/posts\/7851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/comments?post=7851"}],"version-history":[{"count":0,"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/posts\/7851\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/media\/7853"}],"wp:attachment":[{"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/media?parent=7851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/categories?post=7851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/tags?post=7851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}