Reporting API & tokens

POST https://reports.provider.tools/api/v1/abuse/report
Content-Type: application/json
X-Report-Token: ar_YOURTOKEN   (optional)

{ "ip": "203.0.113.7", "service": "ssh", "port": 22, "count": 5 }

Supported services (100+): server access (ssh, rdp, vpn...), mail (imap, smtp-auth...), databases (mysql, postgresql...), web attacks (http, sqli, xss...), DDoS, malware/botnet, game servers and more. Full machine-readable list: GET /api/v1/abuse/report

Tokens are created in the Reporting page (free account, one per server) or via API:

POST https://reports.provider.tools/api/v1/abuse/tokens          (account auth required)
{ "label": "mail-01" }

GET https://reports.provider.tools/api/v1/abuse/tokens/{token}   (your token's statistics)

Send the token as X-Report-Token header with every report. Anonymous reports (no token) count exactly the same for listing.

• Only public IP addresses are accepted (private/reserved ranges are rejected).
• Rate limit: 120 reports per 5 minutes per source IP.
• Deduplication: identical (IP, service) reports within 10 minutes are not counted twice.
• Whitelisted IPs are ignored.

Method	Endpoint	Description
GET	/api/v1/abuse/check?ip=..	Check an IP with anonymized evidence (JSON)
GET	/api/v1/abuse/export	Plain-text list of all listed IPs, optional ?service= / ?format=json
GET	/api/v1/abuse/stats	Public aggregate network statistics
GET	/api/v1/abuse/fail2ban-install	Installer script (?block=0, ?token=, ?block_service=)
GET	/api/v1/abuse/fail2ban-config	fail2ban action file / jail examples download