add ip rep

README.md

@@ -68,6 +68,15 @@ Optional external reputation enrichment is disabled by default. To use VirusTota
 
 ```bash
 export FGAI_THREAT_INTEL=1
+export ABUSEIPDB_API_KEY='...'
+fgai recommend --logs logs/fg_syslog.jsonl --min-score 35 --threat-intel
+```
+
+VirusTotal is also supported:
+
+```bash
+export FGAI_THREAT_INTEL=1
+export FGAI_THREAT_INTEL_PROVIDER=virustotal
 export VIRUSTOTAL_API_KEY='...'
 fgai recommend --logs logs/fg_syslog.jsonl --min-score 35 --threat-intel
 ```
@@ -174,6 +183,9 @@ end
 - `OLLAMA_MODEL`: defaults to `llama3.3`.
 - `OLLAMA_TIMEOUT`: Ollama request timeout in seconds, defaults to `180`.
 - `FGAI_THREAT_INTEL`: set to `1` to enable external threat intelligence lookups.
+- `ABUSEIPDB_API_KEY`: AbuseIPDB API key for public IP reputation enrichment.
+- `ABUSEIPDB_MAX_AGE_DAYS`: report age window for AbuseIPDB, defaults to `90`.
+- `FGAI_THREAT_INTEL_PROVIDER`: `auto`, `abuseipdb`, or `virustotal`.
 - `VIRUSTOTAL_API_KEY`: VirusTotal API key for public IP reputation enrichment.
 
 ## Safety Model