{"id":7851,"date":"2025-08-14T05:52:35","date_gmt":"2025-08-14T03:52:35","guid":{"rendered":"https:\/\/www.lrob.fr\/?p=7851"},"modified":"2025-08-14T07:12:50","modified_gmt":"2025-08-14T05:12:50","slug":"guide-monitoring-reputation-uptime-kuma-abuseipdb","status":"publish","type":"post","link":"https:\/\/www.lrob.fr\/en\/blog\/sysadmin\/guide-monitoring-reputation-uptime-kuma-abuseipdb\/","title":{"rendered":"Guide: Free IP reputation monitoring with Uptime Kuma and AbuseIPDB"},"content":{"rendered":"<div class=\"wp-block-group has-global-padding is-layout-constrained wp-container-core-group-is-layout-9e9be3cb wp-block-group-is-layout-constrained\" style=\"border-width:1px;padding-top:var(--wp--preset--spacing--20);padding-right:var(--wp--preset--spacing--20);padding-bottom:var(--wp--preset--spacing--20);padding-left:var(--wp--preset--spacing--20)\">\n<p class=\"translation-block\">A single compromise on a web server can turn it into an <strong>attack vector<\/strong>: mass spamming, botnets, and it's a guaranteed blacklisting of your IP. It is therefore important to <strong>quickly detect the first signs<\/strong> in order to react fast and reduce the negative impact.<\/p>\n<\/div>\n\n\n\n<p>Security experts are realistic and unanimous: given enough time, any service will end up hacked. A 0-day vulnerability, a technical error, a sufficiently long attack... 100% security is out of this world.<\/p>\n\n\n\n<p class=\"translation-block\">So the right approach, in addition to approaching 0% risk through <a href=\"https:\/\/www.lrob.fr\/en\/features\/secure-web-host-cybersecurity\/\" target=\"_self\">preventive security measures<\/a>, is to <strong>continuously monitor<\/strong> the reputation of its IPs, so as to <strong>react at the first sign of an incident<\/strong> to limit the attack surface and prevent blacklists from getting out of control.<\/p>\n\n\n\n<details class=\"wp-block-details is-layout-flow wp-block-details-is-layout-flow\"><summary>Info: What is an IP blacklist?<\/summary>\n<p>An IP blacklist is a register of IP addresses known to be malicious or undesirable (spam, attacks, fraud), which systems consult to deny or restrict access. It is used by firewalls, mail servers and web sites, but can also produce false positives; entries evolve and can be removed after verification.<\/p>\n<\/details>\n\n\n\n<p>In this article, we'll look at how to set up an alert system based on two free solutions:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"translation-block\"><strong>Uptime Kuma<\/strong>, a free monitoring tool, hosted on your own machine or a VPS ;<\/li>\n\n\n\n<li class=\"translation-block\"><strong>AbuseIPDB<\/strong>, collaborative database of reported IP addresses.<\/li>\n<\/ul>\n\n\n\n<p class=\"translation-block\">This adapted prevention is employed for the <a class=\"\" href=\"https:\/\/www.lrob.fr\/en\/web-hosting\/\" target=\"_self\">web hosting infrastructure<\/a> LRob and should be useful to you, if you also host services. We remind you that the real-time status of the LRob infratructure, including any presence in the AbuseIPDB blacklist, can be consulted publicly: <a class=\"\" href=\"https:\/\/uptime.lrob.net\/status\/lrob\" target=\"_blank\" rel=\"noopener\">https:\/\/uptime.lrob.net\/status\/lrob<\/a>.<\/p>\n\n\n\n<p>This step-by-step guide will show you how to reproduce this configuration at home. <\/p>\n\n\n\n<div class=\"wp-block-group has-global-padding is-layout-constrained wp-container-core-group-is-layout-80fb368b wp-block-group-is-layout-constrained\" style=\"border-width:1px;padding-top:var(--wp--preset--spacing--30);padding-right:var(--wp--preset--spacing--30);padding-bottom:var(--wp--preset--spacing--30);padding-left:var(--wp--preset--spacing--30)\">\n<p class=\"translation-block\">\u26a0\ufe0f Are your servers costing you too much money and time? Don't miss out on our <a href=\"https:\/\/www.lrob.fr\/en\/web-hosting\/web-agency\/\" target=\"_self\">multi-site hosting offers<\/a>, which will save you considerable <a href=\"https:\/\/www.lrob.fr\/en\/features\/high-performance-plesk-hosting-for-sites-and-agencies\/\" target=\"_self\">time<\/a> and <a href=\"https:\/\/www.lrob.fr\/en\/features\/secure-web-host-cybersecurity\/\" target=\"_self\">security<\/a>, while saving you money and benefiting from <a href=\"https:\/\/www.lrob.fr\/en\/features\/best-web-host-support\/\" target=\"_self\">outstanding support<\/a>! Also available as <a href=\"https:\/\/www.lrob.fr\/en\/web-hosting\/\" target=\"_self\">hosting for a single site<\/a>.<\/p>\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"pourquoi-surveiller-la-reputation-de-son-ip\">Why monitor your IP's reputation?<\/h2>\n\n\n\n<p class=\"translation-block\">It's better to act <strong>at the first sign<\/strong> of a problem than to wait until it's too late.<br>If a mailbox is compromised or a site has a vulnerability, your server can quickly become an <strong>attack vector<\/strong>, for example sending millions of spam messages in a matter of minutes.<\/p>\n\n\n\n<p class=\"translation-block\">LRob already applies effective protections, such as an <strong>anti-bruteforce<\/strong> on emails and an <strong>hourly sending limit<\/strong>, to limit this kind of damage. But whatever the measures, proactive monitoring of an IP's <strong>reputation<\/strong> means that any anomalies can be detected quickly, and action taken before the situation becomes embarrassing.<\/p>\n\n\n\n<p class=\"translation-block\">Because <strong>blacklists<\/strong> inform the public about the maliciousness of your IPs. And if your IP is blacklisted, providers often block emails, restrict access to certain services and overall damage the <strong>trust<\/strong> placed in a server or site.<\/p>\n\n\n\n<p class=\"translation-block\">So the aim of the game is this: Not to be a victim of blacklists, but to use them as a <strong>reliable indicator<\/strong> to spot suspicious behavior on a machine, even outside an active attack. Because attacks can be brief or very discreet. Those who receive them, on the other hand, can't miss them.<\/p>\n\n\n\n<p class=\"translation-block\">And for that, with regular monitoring, we can immediately identify any rise in the abuse score and intervene <strong>before<\/strong> the consequences become costly. Ultimately, it's a measure that's half preventive, half curative. Or, to put it another way, the worst is avoided.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"ce-que-lon-va-mettre-en-place\">What you need before you start<\/h2>\n\n\n\n<p>Before setting up this monitoring system, you need to have:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"translation-block\">access (free or paid) to the <strong><a href=\"https:\/\/www.abuseipdb.com\/register?plan=free\" target=\"_blank\" rel=\"noopener\">API AbuseIPDB<\/a><\/strong>.<\/li>\n\n\n\n<li class=\"translation-block\">a <strong>working <a href=\"https:\/\/github.com\/louislam\/uptime-kuma\" target=\"_blank\" rel=\"noopener\">Uptime Kuma<\/a><\/strong> instance, installed on a <strong>localVM<\/strong>, a <strong>VPS<\/strong> or any other permanently accessible server.<\/li>\n<\/ul>\n\n\n\n<p class=\"translation-block\">Uptime Kuma will be configured to <strong>query the AbuseIPDB API<\/strong> automatically, retrieve your IP's <strong>abuse score<\/strong>, and check whether it remains <strong>less than or equal<\/strong> to a set threshold (e.g. 5%).<br>If this score exceeds the chosen limit, you'll receive an alert to take prompt action.<\/p>\n\n\n\n<p class=\"translation-block\">This tutorial relies solely on <strong>AbuseIPDB<\/strong> as a source of reputation, which is already <strong>very reliable<\/strong> for everyday use.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"configuration-pas-a-pas-dans-uptime-kuma\">Step-by-step configuration in Uptime Kuma<\/h2>\n\n\n\n<p class=\"translation-block\">The aim is to create a <strong>monitor<\/strong> that will regularly check your IP's abuse score on AbuseIPDB, and alert you if it exceeds a set threshold. To do this, we're going to exploit a JSON expression that returns <code>true<\/code> or <code>false<\/code> depending on the result of the check. True: all's well. False: you receive the alert.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"1-creer-un-nouveau-moniteur\">1. Create a new base monitor<\/h3>\n\n\n\n<p>In the Uptime Kuma interface :<\/p>\n\n\n\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<p class=\"translation-block\">Click on <strong>\"Add a monitor\"<\/strong><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69e84ba8dc4e3&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69e84ba8dc4e3\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"250\" height=\"123\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-add-new-monitor.jpg\" alt=\"Uptime Kuma add new monitor\" class=\"wp-image-7855\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-add-new-monitor.jpg 250w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-add-new-monitor-150x74.jpg 150w\" sizes=\"auto, (max-width: 250px) 100vw, 250px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Enlarge\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<p class=\"translation-block\"><strong>Monitor type<\/strong>: <code>HTTP(s) - Json Query<\/code><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69e84ba8dc980&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69e84ba8dc980\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"348\" height=\"206\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-monitor-type-HTTPS-Json-Query.jpg\" alt=\"Uptime Kuma Json Query\" class=\"wp-image-7856\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-monitor-type-HTTPS-Json-Query.jpg 348w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-monitor-type-HTTPS-Json-Query-300x178.jpg 300w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-monitor-type-HTTPS-Json-Query-150x89.jpg 150w\" sizes=\"auto, (max-width: 348px) 100vw, 348px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Enlarge\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<p class=\"translation-block\"><strong>Display name<\/strong> (Friendly Name), for example:<br><code>AbuseIPDB HOSTNAME IP<\/code><br><em>(replace HOSTNAME and IP with your values)<\/em><\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69e84ba8dcd32&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69e84ba8dcd32\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"267\" height=\"77\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptim-kuma-abuseipdb-friendly-name.jpg\" alt=\"Uptime Kuma Friendly Name AbuseIPDB\" class=\"wp-image-7857\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptim-kuma-abuseipdb-friendly-name.jpg 267w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptim-kuma-abuseipdb-friendly-name-150x43.jpg 150w\" sizes=\"auto, (max-width: 267px) 100vw, 267px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Enlarge\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n<\/div>\n\n\n\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<ul class=\"wp-block-list\">\n<li class=\"translation-block\"><strong>Heartbeat Interval<\/strong>: set the desired frequency (e.g. every 3600 seconds, or 1h).<\/li>\n\n\n\n<li><strong>Retries<\/strong> : 0<\/li>\n<\/ul>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69e84ba8dd08f&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69e84ba8dd08f\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"517\" height=\"453\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-intervals.jpg\" alt=\"Uptime Kuma Frequency AbuseIPDB\" class=\"wp-image-7859\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-intervals.jpg 517w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-intervals-300x263.jpg 300w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-intervals-150x131.jpg 150w\" sizes=\"auto, (max-width: 517px) 100vw, 517px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Enlarge\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\">2. Basic AbuseIPDB API monitor settings<\/h3>\n\n\n\n<div class=\"wp-block-columns are-vertically-aligned-center is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<ul class=\"wp-block-list\">\n<li class=\"translation-block\"><strong>URL<\/strong>: <code>https:\/\/api.abuseipdb.com\/api\/v2\/check<\/code><\/li>\n\n\n\n<li><strong>Json Query<\/strong> : <code>$number($.data.abuseConfidenceScore) &lt;= 5<\/code>\n<ul class=\"wp-block-list\">\n<li><em>(replace <code><strong>5<\/strong><\/code> by your tolerance threshold, which corresponds to the percentage of risk on AbuseIPDB)<\/em><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li class=\"translation-block\"><strong>Expected Value<\/strong> : <code>true<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"translation-block\">\ud83d\udca1 This expression returns <code>true<\/code> if the score is less than or equal to your threshold, and <code>false<\/code> otherwise. Uptime Kuma then triggers an alert according to your notifications setting, only if the result is <code>false<\/code>.<\/p>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-vertically-aligned-center is-layout-flow wp-block-column-is-layout-flow\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69e84ba8dd41e&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69e84ba8dd41e\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"526\" height=\"328\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-api-query-settings2.jpg\" alt=\"\" class=\"wp-image-7862\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-api-query-settings2.jpg 526w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-api-query-settings2-300x187.jpg 300w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-abuseipdb-api-query-settings2-150x94.jpg 150w\" sizes=\"auto, (max-width: 526px) 100vw, 526px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Enlarge\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n<\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"4-configurer-les-options-http\">3. Setting HTTP options for the AbuseIPDB API<\/h3>\n\n\n\n<div class=\"wp-block-columns is-layout-flex wp-container-core-columns-is-layout-28f84493 wp-block-columns-is-layout-flex\">\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<p class=\"translation-block\">In <strong>HTTP Options<\/strong>:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"translation-block\"><strong>Method<\/strong> : <code>GET<\/code><\/li>\n\n\n\n<li class=\"translation-block\"><strong>Body Encoding<\/strong> : <code>JSON<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"translation-block\">In <strong>Body<\/strong>, define this code by replacing <code>Your_IP<\/code> with the IP to be monitored:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n    \"ipAddress\": \"Your_IP\",\n    \"maxAgeInDays\": \"1\",\n    \"verbose\": \"true\"\n}<\/code><\/pre>\n\n\n\n<p>In <strong>Headers<\/strong>put your API key in place of <code>Your_API_Key<\/code> :<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>{\n    \"Key\": \"Your_API_Key\",\n    \"Accept\": \"application\/json\"\n}<\/code><\/pre>\n<\/div>\n\n\n\n<div class=\"wp-block-column is-layout-flow wp-block-column-is-layout-flow\">\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69e84ba8dd81e&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69e84ba8dd81e\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"523\" height=\"723\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-http-options-abuseipdb.jpg\" alt=\"Uptime Kuma HTTP Options for AbuseIPDB API check\" class=\"wp-image-7861\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-http-options-abuseipdb.jpg 523w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-http-options-abuseipdb-217x300.jpg 217w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/uptime-kuma-http-options-abuseipdb-109x150.jpg 109w\" sizes=\"auto, (max-width: 523px) 100vw, 523px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Enlarge\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/div>\n<\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">4. Check final configuration<\/h3>\n\n\n\n<p>You should get a similar configuration:<\/p>\n\n\n\n<figure data-wp-context=\"{&quot;imageId&quot;:&quot;69e84ba8dd9c3&quot;}\" data-wp-interactive=\"core\/image\" data-wp-key=\"69e84ba8dd9c3\" class=\"wp-block-image size-full wp-lightbox-container\"><img loading=\"lazy\" decoding=\"async\" width=\"1078\" height=\"1265\" data-wp-class--hide=\"state.isContentHidden\" data-wp-class--show=\"state.isContentVisible\" data-wp-init=\"callbacks.setButtonStyles\" data-wp-on--click=\"actions.showLightbox\" data-wp-on--load=\"callbacks.setButtonStyles\" data-wp-on-window--resize=\"callbacks.setButtonStyles\" src=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/config-uptime-kuma-query-abuseipdb.jpg\" alt=\"Configuration Uptime Kuma Monitoring de Blacklist AbuseIPDB\" class=\"wp-image-7853\" srcset=\"https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/config-uptime-kuma-query-abuseipdb.jpg 1078w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/config-uptime-kuma-query-abuseipdb-256x300.jpg 256w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/config-uptime-kuma-query-abuseipdb-873x1024.jpg 873w, https:\/\/www.lrob.fr\/wp-content\/uploads\/2025\/08\/config-uptime-kuma-query-abuseipdb-128x150.jpg 128w\" sizes=\"auto, (max-width: 1078px) 100vw, 1078px\" \/><button\n\t\t\tclass=\"lightbox-trigger\"\n\t\t\ttype=\"button\"\n\t\t\taria-haspopup=\"dialog\"\n\t\t\taria-label=\"Enlarge\"\n\t\t\tdata-wp-init=\"callbacks.initTriggerButton\"\n\t\t\tdata-wp-on--click=\"actions.showLightbox\"\n\t\t\tdata-wp-style--right=\"state.imageButtonRight\"\n\t\t\tdata-wp-style--top=\"state.imageButtonTop\"\n\t\t>\n\t\t\t<svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"12\" height=\"12\" fill=\"none\" viewbox=\"0 0 12 12\">\n\t\t\t\t<path fill=\"#fff\" d=\"M2 0a2 2 0 0 0-2 2v2h1.5V2a.5.5 0 0 1 .5-.5h2V0H2Zm2 10.5H2a.5.5 0 0 1-.5-.5V8H0v2a2 2 0 0 0 2 2h2v-1.5ZM8 12v-1.5h2a.5.5 0 0 0 .5-.5V8H12v2a2 2 0 0 1-2 2H8Zm2-12a2 2 0 0 1 2 2v2h-1.5V2a.5.5 0 0 0-.5-.5H8V0h2Z\" \/>\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"5-sauvegarder-et-tester\">5. Save and test<\/h3>\n\n\n\n<p>Once you have defined the parameters, click on <strong>Save<\/strong> then observe the first test:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"translation-block\">If score is below threshold \u2192 monitor <strong>UP<\/strong><\/li>\n\n\n\n<li class=\"translation-block\">If score exceeds threshold \u2192 monitor <strong>DOWN<\/strong> and alert sent<\/li>\n<\/ul>\n\n\n\n<p>With this setting, you'll know immediately if your IP's reputation is deteriorating.<br>For example:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Score 0<\/strong> \u2192 everything's fine<\/li>\n\n\n\n<li><strong>Score 4<\/strong> \u2192 still acceptable<\/li>\n\n\n\n<li><strong>Score 12<\/strong> \u2192 alert<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">A word about the JSON detection threshold trick<\/h2>\n\n\n\n<p class=\"translation-block\">At LRob, almost 1 year ago, when we received a customer whose site had to be repaired following a hack, his site was exploited during the repair on our servers. This was the only instance of malicious use on LRob servers. This enabled us to <a href=\"https:\/\/www.lrob.fr\/en\/blog\/lrob-contributes-abuseipdb\/\" target=\"_self\">discover AbuseIPDB<\/a> with great enthusiasm since we were looking for just such a tool.<\/p>\n\n\n\n<p>A brief incident with a positive outcome, you might say.<\/p>\n\n\n\n<p class=\"translation-block\">Except that since this incident, an AbuseIPDB contributor continues to report the server's IP every week, even though the incident has been over for almost 1 year. And there's no way to stop it. As soon as he issues even a single report, the IP score goes back up to <strong>4%<\/strong> risk.<\/p>\n\n\n\n<p class=\"translation-block\">However, Uptime Kuma only allows you to check if <strong>Expected Value = 0<\/strong>.<br>In other words, a risk at 1% or 4% triggered alertE. So this server was on alert all the time.<br>A <strong>false positive<\/strong>.<\/p>\n\n\n\n<p class=\"translation-block\">The clean solution: <strong>evaluate a threshold<\/strong> directly in the <em>Json Query<\/em> thanks to a <strong>JSONata expression<\/strong>. Rather than waiting for the exact value \"0\", Uptime Kuma now checks that the score is <strong>less than or equal<\/strong> to a limit deemed healthy (e.g. <strong>5<\/strong>); and returns <code>true<\/code> or <code>false<\/code>. From now on, the state will only go into alert <strong>if the score exceeds the value<\/strong>.<\/p>\n\n\n\n<p>This is the principle of this code, which checks whether the value in question is less than or equal to 5.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>$number($.data.abuseConfidenceScore) &lt;= 5<\/code><\/pre>\n\n\n\n<p>Uptime Kuma waits for value <code>true<\/code> in return. If the threshold is below 5, no alert. If higher, alert.<\/p>\n\n\n\n<p class=\"translation-block\">This config correction has just been applied, so if you visit the <a href=\"https:\/\/uptime.lrob.net\/status\/lrob\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">server status<\/a> within 24 hours of publishing this article, you'll see that \"Blacklists\" isn't at 100% uptime, unlike all the other services. Now you've got the whole story.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"translation-block\">We hope that the configuration used for the <a class=\"\" href=\"https:\/\/www.lrob.fr\/en\/web-hosting\/\" target=\"_self\">web hosting infrastructure<\/a> LRob will help you better secure your servers, to help us make a better internet.<\/p>\n\n\n\n<p>And if you think that was very interesting, remember that it's just the tip of the iceberg of what LRob does to ensure exceptional service!<\/p>\n\n\n\n<p class=\"translation-block\">We are convinced that LRob deserves to be better known.<br>So take a tour of <a href=\"https:\/\/www.lrob.fr\/en\/\" target=\"_self\">the site<\/a>, read what we have to say, look at the offers, try out our in-house Chatbot, and don't hesitate to share what you find interesting on all your networks, it will support us in our mission for a clean internet!<\/p>\n\n\n\n<p>Thank you for reading and for your support.<\/p>","protected":false},"excerpt":{"rendered":"<p>Automatically check whether your IPs are blacklisted? Here's how, with free tools that can save you a lot of trouble!<\/p>","protected":false},"author":1,"featured_media":7853,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[29],"tags":[73,57,71,74,72],"class_list":["post-7851","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sysadmin","tag-abuseipdb","tag-hebergement-web","tag-monitoring","tag-reputation-ip","tag-uptime-kuma"],"_links":{"self":[{"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/posts\/7851","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/comments?post=7851"}],"version-history":[{"count":4,"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/posts\/7851\/revisions"}],"predecessor-version":[{"id":7908,"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/posts\/7851\/revisions\/7908"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/media\/7853"}],"wp:attachment":[{"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/media?parent=7851"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/categories?post=7851"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lrob.fr\/en\/wp-json\/wp\/v2\/tags?post=7851"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}