Import AbuseIPDB threat intelligence into MISP

MISP is an open-source threat intelligence sharing platform. Its TAXII 2.1 Import module from misp-modules imports AbuseIPDB's crowdsourced IP threat indicators into an event as ip-dst attributes. That attribute type is the module's mapping for an IP indicator; it does not say whether the address was a source or a destination in your traffic. MISP has no scheduled TAXII feed: each import runs on demand, into one event. Not yet verified end to end against AbuseIPDB.

AbuseIPDB is a crowdsourced database of IP addresses reported for abuse, such as brute-force logins, port scans, spam and web attacks. Its STIX/TAXII feeds deliver those addresses in STIX 2.1, the standard format threat intelligence tools exchange, over TAXII 2.1, the protocol those tools use to fetch it. Each address arrives as an indicator with its 0–100 confidence score, so you can check your logs against addresses other organizations have reported.

Already pull the AbuseIPDB blacklist through the API? Free and Paid feeds draw from that same blacklist, delivered straight into your SIEM or threat intelligence platform instead of to a script, and your check and blacklist integrations keep working as before. Your client signs in with your account email and one of your existing API keys. STIX/TAXII feeds are bought separately from your API plan and have their own daily indicator allowance; during the beta, accounts on a paid API plan can try one free feed first, with up to 10,000 indicators a day of addresses scoring at least 100. See Plans.

Not yet verified means AbuseIPDB hasn't tested this client end to end: the steps follow the vendor's documentation, so field names or screens in your version may differ. If a step doesn't match what you see, contact us.

Before you start: a feed on My TAXII Feeds using the IP threat indicators output format (you need its collection URL), an API key, and MISP admin access to enable the import module. misp-modules must be installed and connected to MISP first.

1. Enable the module under Administration > Server Settings & Maintenance > Plugin settings: turn on import services and the taxii21 import module.
2. Open the event that should receive the indicators and choose Populate from… > TAXII 2.1 Import.
3. Fill in:
   • url: https://taxii.abuseipdb.com/taxii2/abuseipdb-taxii2/collections/{collection-id}/, using the feed's Collection ID from your My TAXII Feeds page, or copy the whole URL from the feed's ⋯ > Copy collection URL menu. This is the full collection URL, not the discovery or API root URL.
   • username: your AbuseIPDB account email.
   • password: any API key on your account.
   • added_after: the UTC timestamp to start from, e.g. 2026-11-01T00:00:00.000Z (Enterprise feeds only; Free and Paid feeds ignore it). Leave the other fields at their defaults.
4. Run the import. The module stops at its object limit (1,000 by default) and keeps no cursor, so ask your MISP administrator to raise the limit above the number of indicators you expect, plus the identity object. The "indicators currently match this feed" count on My TAXII Feeds is an estimate, not a completion check, and on Free and Paid plans your daily indicator cap still applies. Don't split a large import by moving added_after forward: many indicators share one timestamp, so a split run either repeats them or, if you step past the timestamp, misses them. Afterwards, the feed's Last accessed date shows today and the event holds the ip-dst attributes.

Output format

Use the IP threat indicators output format. misp-stix converts each indicator to an ip-dst attribute, its default for a bare IP address. The extra objects in the other output formats are not expected to map cleanly, but this has not been tested.

Pushing reports

This guide covers import only. Pushing reports from MISP to AbuseIPDB is not documented or tested.

Multiple feeds

Each custom feed has its own collection URL; run the import once per feed.

If you hit issues, contact us.