id: api-abuseipdb

info:
  name: AbuseIPDB API Test
  author: daffainfo
  severity: info
  reference:
    - https://docs.abuseipdb.com/
    - https://github.com/daffainfo/all-about-apikey/blob/main/Anti%20Malware/AbuseIPDB.md
  tags: token-spray,abuseipdb

self-contained: true
requests:
  - raw:
      - |
        POST https://api.abuseipdb.com/api/v2/report HTTP/1.1
        Host: api.abuseipdb.com
        Key: {{token}}
        Accept: application/json
        Content-Type: application/x-www-form-urlencoded
        Content-Length: 16

        ip=127.0.0.1&categories=18,22&comment=SSH%20login%20attempts%20with%20user%20root.

    matchers:
      - type: word
        part: body
        words:
          - 'data":'
          - 'ipAddress":'
        condition: and