Skip to Content
ReferenceAPI referenceReports

Build an abuse report for an IP or an ASN

GET
/api/v1/reports/abuse

Returns what an abuse desk needs about one IP, or about the busiest IPs of one ASN, in the range: request counts, the busiest hour or day, the top paths and user agents, the newest log lines and CrowdSec data. Times are in UTC, and the raw access logs it reads go back ANALYTICS_RAW_RETENTION_DAYS days, 180 by default. The report leaves out the Host header, server name, referrer and remote user of each line, and the machine name and message of each alert. Your host names and public addresses become [redacted] in URLs and user agents. In a query string, the whole value of a parameter that names one of your hosts or carries a credential, such as token or api_key, also becomes [redacted].

Authorization

cookiesession<token>

Session cookie authentication.

Query Parameters

startDate*string

Start of the range, inclusive, as ISO 8601 with a timezone, such as 2026-11-01T00:00:00Z.

Formatdate-time
endDate*string

End of the range, exclusive, as ISO 8601 with a timezone, such as 2026-11-02T00:00:00Z.

Formatdate-time
ipAddress?|

The IP, IPv4 or IPv6. Pass this or asn, not both. A value that is not an IP gets a 400.

asn?|

The AS number, from 0 to 4294967295, such as 13335. Pass this or ipAddress, not both.

Rangevalue <= 4294967295
maxIps?integer

With asn, how many of its busiest IPs to report on, from 1 to 100. Defaults to 25.

Range1 <= value <= 100
Default25
linesPerIp?integer

How many of each IP's newest log lines to include, from 0 to 500. Defaults to 20.

Range0 <= value <= 500
Default20

Response Body

Request fulfilled, document follows

application/json
  1. response

Evidence for an abuse report.

Its times are in UTC, apart from startDate and endDate, which echo the request.

crowdsec*

How much CrowdSec data the report holds.

endDate*string

The request's endDate, echoed as ISO 8601.

generatedAt*string

When GeoMetrikks built the report, as ISO 8601 in UTC.

granularity*string

The bucket size of each peak. hourly for ranges up to 7 days, daily above.

Value in"hourly""daily"
ipCount*integer

The IPs of the target that sent requests in the range, which can be more than ips holds. 0 or 1 for an IP report.

ips*array<>

For an ASN report, its busiest IPs, at most maxIps. An IP report has one entry, with zero counts when the IP sent nothing.

redactions*integer

How many host names, addresses and query values became [redacted].

startDate*string

The request's startDate, echoed as ISO 8601.

status4xx*integer

Those requests that got a 4xx status.

target*

What the report is about, one IP or the IPs of one ASN.

totalRequests*integer

Requests from every IP of the target in the range.

Example Request
curl -X GET 'https://geometrikks.example.com/api/v1/reports/abuse?startDate=2026-11-01T00%3A00%3A00Z&endDate=2026-11-02T00%3A00%3A00Z'
Example Response
{  "crowdsec": {    "message": "string",    "status": "disabled"  },  "endDate": "string",  "generatedAt": "string",  "granularity": "hourly",  "ipCount": 0,  "ips": [    {      "alerts": [        {          "createdAt": "string",          "decisions": [            {              "duration": "string",              "expired": true,              "type": "string"            }          ],          "eventsCount": 0,          "kind": "string",          "scenario": "string",          "startAt": "string",          "stopAt": "string"        }      ],      "alertsTruncated": true,      "asn": 0,      "asnDrop": true,      "asnOrganization": "string",      "countryCode": "string",      "countryName": "string",      "decisions": [        {          "duration": "string",          "origin": "string",          "scenario": "string",          "scope": "string",          "type": "string",          "value": "string"        }      ],      "distinctPaths": 0,      "dropNetwork": {        "cidr": "string",        "sblId": "string"      },      "firstSeen": "string",      "ipAddress": "string",      "lastSeen": "string",      "lines": [        {          "bytesSent": 0,          "httpVersion": "string",          "method": "string",          "statusCode": 0,          "timestamp": "string",          "url": "string",          "userAgent": "string"        }      ],      "malformedRequests": 0,      "paths": [        {          "errorHits": 0,          "hits": 0,          "url": "string"        }      ],      "peak": {        "hits": 0,        "timestamp": "string"      },      "status2xx": 0,      "status3xx": 0,      "status4xx": 0,      "status5xx": 0,      "totalBytes": 0,      "totalRequests": 0,      "userAgents": [        {          "hits": 0,          "userAgent": "string"        }      ]    }  ],  "redactions": 0,  "startDate": "string",  "status4xx": 0,  "target": {    "asn": 0,    "asnDrop": true,    "asnOrganization": "string",    "ipAddress": "string",    "kind": "ip"  },  "totalRequests": 0}

Get the newest app or login log records GET

Returns the last `lines` lines of geometrikks.log or login.log as records, oldest first. It skips lines that do not parse, so fewer records can come back. App log records keep every key the event carried, so expect more keys than the schema lists.

Look up the abuse contact for an IP or an ASN GET

Asks the RDAP registry that holds the IP or AS number for its network or AS record and the abuse contact on it. Only the queried address or number leaves the server, and GeoMetrikks caches each answer for up to 24 hours. A private or reserved address gets a 400.