action neutrinoapi_ipblocklist {
  label: "IP Blocklist"
  description: "The IP Blocklist API will detect potentially malicious or dangerous IP addresses"
  provider: neutrinoapi
  method: GET
  path: "/ip-blocklist"
  encoding: json
  input: {
    type: "object"
    properties: {
      ip: {
        type: "string"
      }
      "vpn-lookup": {
        type: "boolean"
      }
    }
    required: ["ip"]
    additionalProperties: false
  }
  output: {
    type: "object"
    required: ["blocklists", "cidr", "ip", "is-bot", "is-dshield", "is-exploit-bot", "is-hijacked", "is-listed", "is-malware", "is-proxy", "is-spam-bot", "is-spider", "is-spyware", "is-tor", "is-vpn", "last-seen", "list-count", "sensors"]
    properties: {
      blocklists: {
        type: "array"
        description: "An array of strings indicating which blocklist categories this IP is listed on"
        items: {
          type: "string"
        }
      }
      cidr: {
        type: "string"
        description: "The CIDR address for this listing (only set if the IP is listed)"
      }
      ip: {
        type: "string"
        description: "The IP address"
      }
      "is-bot": {
        type: "boolean"
        description: "IP is hosting a malicious bot or is part of a botnet. This is a broad category which includes brute-force crackers"
      }
      "is-dshield": {
        type: "boolean"
        description: "IP has been flagged as a significant attack source by DShield (dshield.org)"
      }
      "is-exploit-bot": {
        type: "boolean"
        description: "IP is hosting an exploit finding bot or is running exploit scanning software"
      }
      "is-hijacked": {
        type: "boolean"
        description: "IP is part of a hijacked netblock or a netblock controlled by a criminal organization"
      }
      "is-listed": {
        type: "boolean"
        description: "Is this IP on a blocklist"
      }
      "is-malware": {
        type: "boolean"
        description: "IP is involved in distributing or is running malware"
      }
      "is-proxy": {
        type: "boolean"
        description: "IP has been detected as an anonymous web proxy or anonymous HTTP proxy"
      }
      "is-spam-bot": {
        type: "boolean"
        description: "IP address is hosting a spam bot, comment spamming or any other spamming type software"
      }
      "is-spider": {
        type: "boolean"
        description: "IP is running a hostile web spider / web crawler"
      }
      "is-spyware": {
        type: "boolean"
        description: "IP is involved in distributing or is running spyware"
      }
      "is-tor": {
        type: "boolean"
        description: "IP is a Tor node or running a Tor related service"
      }
      "is-vpn": {
        type: "boolean"
        description: "IP belongs to a public VPN provider (only set if the 'vpn-lookup' option is enabled)"
      }
      "last-seen": {
        type: "integer"
        format: "int32"
        description: "The unix time when this IP was last seen on any blocklist. IPs are automatically removed after 7 days therefor this value will never be older than 7 days"
      }
      "list-count": {
        type: "integer"
        format: "int32"
        description: "The number of blocklists the IP is listed on"
      }
      sensors: {
        type: "array"
        description: "An array of objects containing details on which specific sensors detected the IP"
        items: {
          type: "object"
          required: ["id", "blocklist", "description"]
          properties: {
            blocklist: {
              type: "string"
              description: "The primary blocklist category this sensor belongs to"
            }
            description: {
              type: "string"
              description: "Contains details about the sensor source and what type of malicious activity was detected"
            }
            id: {
              type: "integer"
              format: "int32"
              description: "The sensor ID. This is a permanent and unique ID for each sensor"
            }
          }
        }
      }
    }
  }
}