IP Space Documentation & API Reference

curl -s "https://ip.space.ua/api/198.51.100.42" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

curl -s "https://ip.space.ua/api?ip=198.51.100.42&r=SSH&s=h01&a=ban" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

[Definition]
# 1. Triggered when Fail2ban reaches maxretry and issues a ban:
#    Records the ban in 'ips', logs incident in 'log', submits telemetry to AbuseIPDB.
actionban = curl -s -m 5 "https://ip.space.ua/api/ip=<ip>/r=<name>/s=<server_name>/a=ban" \
            -H "Authorization: Bearer YOUR_API_TOKEN" > /dev/null 2>&1

# 2. Triggered on preliminary detection / first failure strike (pre-ban hook):
#    Performs intelligence lookup, logs incident to 'found' table for multi-node aggregation.
#    If coordinated attacks exceed threshold across servers, automatically elevates to 'ban'.
actionfound = curl -s -m 5 "https://ip.space.ua/api/ip=<ip>/r=<name>/s=<server_name>/a=found" \
              -H "Authorization: Bearer YOUR_API_TOKEN" > /dev/null 2>&1

# 3. Optional: notify IP Space when local ban is lifted
actionunban = curl -s -m 5 "https://ip.space.ua/api/ip=<ip>/r=<name>/s=<server_name>/a=unban" \
              -H "Authorization: Bearer YOUR_API_TOKEN" > /dev/null 2>&1

[Init]
server_name = my-production-node-01

action = %(action_)s
         ip-space[name=%(__name__)s]

#!/usr/bin/env bash
TARGET_IP="198.51.100.42"
API_TOKEN="YOUR_API_TOKEN"

# Query IP Space API
RESPONSE=$(curl -s -m 4 "https://ip.space.ua/api/ip=${TARGET_IP}/r=SSH/s=$(hostname)/a=check" \
  -H "Authorization: Bearer ${API_TOKEN}")

# Extract recommended action and risk score using jq
ACTION=$(echo "$RESPONSE" | jq -r '.recommendedAction // "allow"')
RISK=$(echo "$RESPONSE" | jq -r '.riskScore // 0')

echo "Evaluated ${TARGET_IP}: Action=${ACTION}, RiskScore=${RISK}"

if [ "$ACTION" = "ban" ]; then
    echo "Dropping ${TARGET_IP} via iptables..."
    iptables -I INPUT -s "${TARGET_IP}" -j DROP
fi

#!/usr/bin/env bash
# /usr/local/bin/sync_ipspace_ipset.sh
set -euo pipefail

API_KEY="YOUR_API_KEY"
CONFIDENCE_MIN=90
IPSET_NAME="ipspace_blacklist"
TEMP_SET="ipspace_temp"
URL="https://ip.space.ua/api/v2/blacklist?confidenceMinimum=${CONFIDENCE_MIN}&plaintext=true"

# Ensure main set and iptables rule exist
ipset create -exist "$IPSET_NAME" hash:ip hashsize 65536 maxelem 1000000
iptables -C INPUT -m set --match-set "$IPSET_NAME" src -j DROP 2>/dev/null || \
    iptables -I INPUT -m set --match-set "$IPSET_NAME" src -j DROP

# Create temporary working set
ipset create -exist "$TEMP_SET" hash:ip hashsize 65536 maxelem 1000000
ipset flush "$TEMP_SET"

# Download blacklist and populate temporary set
TMP_LIST=$(mktemp)
curl -sS -m 30 -H "Key: ${API_KEY}" "$URL" -o "$TMP_LIST"

while read -r ip; do
    [[ -n "$ip" && ! "$ip" =~ ^# ]] && ipset add "$TEMP_SET" "$ip" -exist
done < "$TMP_LIST"
rm -f "$TMP_LIST"

# Atomically swap active set with new set (zero downtime)
ipset swap "$TEMP_SET" "$IPSET_NAME"
ipset destroy "$TEMP_SET"

echo "Successfully synchronized $(ipset list $IPSET_NAME | grep -c '^[0-9]') IPs into $IPSET_NAME"

# 1. Firewall Drop Filter Rule (execute once):
/ip firewall filter add chain=input src-address-list=ipspace_blacklist action=drop comment="Drop IP Space Blacklist"
/ip firewall filter add chain=forward src-address-list=ipspace_blacklist action=drop comment="Drop IP Space Blacklist"

# 2. Automated Sync Script:
/system script add name="sync_ipspace" source={
    :local apiKey "YOUR_API_KEY"
    :local listName "ipspace_blacklist"
    :local url "https://ip.space.ua/api/v2/blacklist?confidenceMinimum=100&plaintext=true&limit=5000"

    /tool fetch url=$url http-header-field="Key: $apiKey" dst-path="ipspace_block.txt" mode=https
    
    # Flush existing dynamic entries
    /ip firewall address-list remove [find list=$listName dynamic=yes]
    
    :local content [/file get ipspace_block.txt contents]
    :local lineEnd 0
    :local lineStart 0
    :while ($lineEnd < [:len $content]) do={
        :set lineEnd [:find $content "\n" $lineStart]
        :if ([:typeof $lineEnd] = "nil") do={ :set lineEnd [:len $content] }
        :local ip [:pick $content $lineStart $lineEnd]
        :if ([:len $ip] > 6) do={
            /ip firewall address-list add list=$listName address=$ip timeout=6h comment="IPSpace Auto-Block"
        }
        :set lineStart ($lineEnd + 1)
    }
    /file remove "ipspace_block.txt"
    :log info "IP Space Blacklist synchronized successfully."
}

# 3. Schedule execution every 4 hours:
/system scheduler add name="sched_ipspace" interval=4h on-event="sync_ipspace"

#!/usr/bin/env bash
# /etc/cron.hourly/update_nginx_blocklist.sh
set -euo pipefail

API_KEY="YOUR_API_KEY"
CONF_PATH="/etc/nginx/conf.d/ipspace_blocklist.conf"
TMP_PATH="/tmp/ipspace_blocklist.conf.tmp"

# 1. Fetch plain-text IPs and wrap each with 'deny IP;'
curl -sS -m 20 -H "Key: ${API_KEY}" \
  "https://ip.space.ua/api/v2/blacklist?confidenceMinimum=100&plaintext=true&limit=10000" \
  | awk '{print "deny " $1 ";"}' > "${TMP_PATH}"

# 2. Check if output is non-empty and valid
if [ -s "${TMP_PATH}" ]; then
    mv "${TMP_PATH}" "${CONF_PATH}"
    # 3. Test nginx configuration and reload gracefully
    if nginx -t >/dev/null 2>&1; then
        systemctl reload nginx
        echo "NGINX blocklist refreshed: $(wc -l < ${CONF_PATH}) IPs denied."
    else
        echo "NGINX config test failed! Reverting."
        rm -f "${CONF_PATH}"
    fi
fi

import requests

API_TOKEN = "YOUR_API_TOKEN"
API_URL = "https://ip.space.ua/api"

def check_ip_reputation(ip_address: str, reason: str = "SSH", server_id: str = "app-01") -> dict:
    url = f"{API_URL}/ip={ip_address}/r={reason}/s={server_id}/a=check"
    headers = {"Authorization": f"Bearer {API_TOKEN}"}
    
    try:
        response = requests.get(url, headers=headers, timeout=5)
        response.raise_for_status()
        return response.json()
    except requests.RequestException as e:
        print(f"Error querying IP Space: {e}")
        return {"recommendedAction": "monitor", "riskScore": 0}

# Example usage
verdict = check_ip_reputation("198.51.100.42")
print(f"Verdict for {verdict.get('ipAddress')}: {verdict.get('recommendedAction')} (Risk: {verdict.get('riskScore')})")
if verdict.get("recommendedAction") == "ban":
    print(f"Blocking for {verdict.get('recommendedTtl')} seconds.")