Skip to main content
verifyngo can automatically report IP addresses to AbuseIPDB when they have been banned multiple times. This helps the wider community by contributing to the shared abuse database, making it easier for other operators to identify and block the same bad actors. You will need a free AbuseIPDB API key to enable this feature.

​
Getting an API key

Go to abuseipdb.com, create an account, and generate a new API key. Make sure the key has the report permission enabled. Copy the key — you will paste it into your verifyngo config in the next step.

​
Configuration

Add an abuseipdb block to your verifyngo config file and fill in the fields below.
​
boolean
default:"false"
Set to true to enable AbuseIPDB reporting. No reports are sent while this is false, even if an API key is configured.
​
string
required
Your AbuseIPDB API key. Required when enabled is true.
​
string
default:"\"19,21\""
Comma-separated list of AbuseIPDB category IDs to attach to each report. The defaults are 19 (Web App Attack) and 21 (DDoS). Adjust these to match the type of abuse you are seeing.
​
string
default:"\"verifyngo: exceeded walk-away threshold\""
The comment included with each report. verifyngo automatically appends the most recent request paths seen from the IP (up to 10) so reviewers have context. You can override the base comment here; the paths are always appended regardless.
​
integer
default:"3"
The number of ban events that must occur for an IP before verifyngo submits a report. This prevents a single accidental ban from triggering a report — only persistent offenders are reported.
verifyngo enforces a 15-minute cooldown between reports for the same IP address. This prevents the same IP from being reported repeatedly in a short window and avoids flooding AbuseIPDB with duplicate submissions.
If you want to be conservative about what you report, raise report_after_bans to 5 or 10. This way only IPs that have been banned many times — strong evidence of persistent automated abuse — are reported to AbuseIPDB.