slug: abuseipdb
provider: AbuseIPDB
generated_by: planning/capability-mapping/scripts/classify_capabilities.py
model: claude-opus-5
frame:
- Software & Technology
min_confidence: 0.7
capability_model:
  source: https://github.com/vincentmakes/turbo-ea-capabilities
  license: CC-BY-4.0
  attribution: Turbo EA Capabilities by Vincent Verdet — Turbo EA, https://github.com/vincentmakes/turbo-ea-capabilities,
    CC BY 4.0
  notice: NOTICE
edge_count: 3
edges:
- tag: Reputation
  spec_file: abuseipdb-reputation-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.82
  evidence: GET /check checkIp 'Check an IP Address'; GET /check-block checkBlock 'Check a CIDR Network
    Block' ... IpRecord
  reason: Querying IP reputation and CIDR ranges for malicious activity is a detection/triage input for
    security operations, matching Threat Detection & Response.
- tag: Blacklist
  spec_file: abuseipdb-blacklist-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.78
  evidence: GET /blacklist getBlacklist 'Download the AbuseIPDB Blacklist' ... BlacklistEntry
  reason: Downloading a curated blacklist of abusive IP addresses is threat-intelligence consumption feeding
    SOC/SIEM detection, so Threat Detection & Response is the honest fit for this security-reputation
    vendor.
- tag: Reports
  spec_file: abuseipdb-reports-api-openapi.yml
  capability_id: BC-620.30
  capability_id_l1: BC-620
  capability_name: Threat Detection & Response Management
  confidence: 0.78
  evidence: POST /report reportIp 'Report an Abusive IP Address'; POST /bulk-report bulkReportIps 'Bulk
    Report Abusive IP Addresses'
  reason: Submitting and listing abuse reports on malicious IP addresses is threat-intelligence sharing
    used by security analysts; it belongs to Threat Detection & Response rather than any customer-facing
    or complaints capability.